diff --git a/datamodels/2.x/combodo-data-feature-removal/src/Controller/DataFeatureRemovalController.php b/datamodels/2.x/combodo-data-feature-removal/src/Controller/DataFeatureRemovalController.php
index c1880c8e8..944b5e88a 100644
--- a/datamodels/2.x/combodo-data-feature-removal/src/Controller/DataFeatureRemovalController.php
+++ b/datamodels/2.x/combodo-data-feature-removal/src/Controller/DataFeatureRemovalController.php
@@ -85,11 +85,8 @@ class DataFeatureRemovalController extends Controller
{
$aParams = [];
- try {
- //from setup wizard/mtp
- SetupUtils::CheckSetupToken();
- SetupUtils::EraseSetupToken();
- } catch (SecurityException $e) {
+ //from setup wizard/mtp
+ if (!SetupUtils::IsSessionSetupTokenValid()) {
//from same module
$this->ValidateTransactionId();
}
@@ -184,7 +181,6 @@ class DataFeatureRemovalController extends Controller
$aParams['aSetupParams'] = [
"_class" => "WizStepLandingBeforeAudit",
"operation" => "next",
- "_params[authent]" => SetupUtils::CreateSetupToken(),
];
foreach ($aHiddenInputs as $sInputName => $sInputValue) {
@@ -200,6 +196,10 @@ class DataFeatureRemovalController extends Controller
$aParams['bDeletionNeeded'] = ($aParams['iQueryCount'] > 0);
Session::Set('aDeletionExecutionSummary', serialize($this->aDeletionExecutionSummary));
+ if (!$aParams['bHasDeletionNeeded']) {
+ SetupUtils::CreateSetupToken();
+ }
+
$this->DisplayPage($aParams, 'AnalysisResult');
}
diff --git a/setup/ajax.dataloader.php b/setup/ajax.dataloader.php
index 53c672faa..1d5370643 100644
--- a/setup/ajax.dataloader.php
+++ b/setup/ajax.dataloader.php
@@ -35,6 +35,7 @@
* 'percent': integer 0..100 the percentage of completion once the file has been loaded
*/
+use Combodo\iTop\Application\Helper\Session;
use Combodo\iTop\Application\WebPage\AjaxPage;
$bBypassMaintenance = true; // Reset maintenance mode in case of problem
@@ -129,7 +130,10 @@ header("Expires: Fri, 17 Jul 1970 05:00:00 GMT"); // Date in the past
*/
$sOperation = utils::ReadParam('operation', '');
try {
- SetupUtils::CheckSetupToken();
+ Session::Start();
+ if (!SetupUtils::IsSessionSetupTokenValid()) {
+ throw new SecurityException("Invalid session token");
+ }
switch ($sOperation) {
case 'async_action':
@@ -150,14 +154,7 @@ try {
/** @var WizardStep $oStep */
$oStep = new $sClass($oDummyController, $sState);
$sConfigFile = utils::GetConfigFilePath(ITOP_DEFAULT_ENV);
- if (file_exists($sConfigFile) && !is_writable($sConfigFile) && $oStep->RequiresWritableConfig()) {
- $sRelativePath = utils::GetConfigFilePathRelative(ITOP_DEFAULT_ENV);
- $sErrorMsg = "Error: the configuration file '".$sRelativePath."' already exists and cannot be overwritten.";
- $sErrorMsg .= "The wizard cannot modify the configuration file for you. If you want to upgrade ".ITOP_APPLICATION.", make sure that the file '".$sRelativePath."' can be modified by the web server.";
- throw new Exception($sErrorMsg);
- } else {
- $oStep->AsyncAction($oPage, $sActionCode, $aParams);
- }
+ $oStep->AsyncAction($oPage, $sActionCode, $aParams);
}
$oPage->output();
break;
diff --git a/setup/setup.js b/setup/setup.js
index 26026dddd..f385f08b0 100644
--- a/setup/setup.js
+++ b/setup/setup.js
@@ -2,9 +2,8 @@ function WizardAsyncAction(sActionCode, oParams, OnErrorFunction)
{
var sStepClass = $('#_class').val();
var sStepState = $('#_state').val();
- var sAuthent = $('#authent_token').val();
- var oMap = { operation: 'async_action', step_class: sStepClass, step_state: sStepState, code: sActionCode, authent : sAuthent, params: oParams };
+ var oMap = { operation: 'async_action', step_class: sStepClass, step_state: sStepState, code: sActionCode, params: oParams };
var ErrorFn = OnErrorFunction;
$(document).ajaxError(function(event, request, settings) {
diff --git a/setup/wizard.php b/setup/wizard.php
index f48fda0c2..f7367dd1d 100644
--- a/setup/wizard.php
+++ b/setup/wizard.php
@@ -67,7 +67,34 @@ if (SetupUtils::IsSessionSetupTokenValid()) {
$oWizard->Run();
} else {
SetupUtils::ExitMaintenanceMode(false);
- // Force initializing the setup
- $oWizard->Start();
+
+ $sConfigFile = utils::GetConfigFilePath(ITOP_DEFAULT_ENV);
+ if (file_exists($sConfigFile)) {
+ // The configuration file already exists
+ if (!is_writable($sConfigFile)) {
+ SetupUtils::ExitReadOnlyMode(false); // Reset readonly mode in case of problem
+ SetupUtils::EraseSetupToken();
+ $sRelativePath = utils::GetConfigFilePathRelative(ITOP_DEFAULT_ENV);
+ $oP = new SetupPage('Installation Cannot Continue');
+ $oP->add("
Fatal error
\n");
+ $oP->error("Error: the configuration file '".$sRelativePath."' already exists and cannot be overwritten.");
+ $oP->p("The wizard cannot modify the configuration file for you. If you want to upgrade ".ITOP_APPLICATION.", make sure that the file '".$sRelativePath."' can be modified by the web server.");
+
+ $sButtonsHtml = <<Reload
+HTML;
+ $oP->p($sButtonsHtml);
+
+ $oP->output();
+ // Prevent token creation
+ exit;
+ } else {
+ chmod($sConfigFile, 0440);
+ }
+ }
+
SetupUtils::CreateSetupToken();
+
+ // Start the setup
+ $oWizard->Start();
}
diff --git a/setup/wizardcontroller.class.inc.php b/setup/wizardcontroller.class.inc.php
index 97cd4a425..860f7f666 100644
--- a/setup/wizardcontroller.class.inc.php
+++ b/setup/wizardcontroller.class.inc.php
@@ -195,30 +195,6 @@ class WizardController
{
SetupLog::Info("=== Setup screen: ".$oStep->GetTitle().' ('.get_class($oStep).')');
$oPage = new SetupPage($oStep->GetTitle());
- if ($oStep->RequiresWritableConfig()) {
- $sConfigFile = utils::GetConfigFilePath(ITOP_DEFAULT_ENV);
- if (file_exists($sConfigFile)) {
- // The configuration file already exists
- if (!is_writable($sConfigFile)) {
- SetupUtils::ExitReadOnlyMode(false); // Reset readonly mode in case of problem
- SetupUtils::EraseSetupToken();
- $sRelativePath = utils::GetConfigFilePathRelative(ITOP_DEFAULT_ENV);
- $oP = new SetupPage('Installation Cannot Continue');
- $oP->add("
Fatal error
\n");
- $oP->error("Error: the configuration file '".$sRelativePath."' already exists and cannot be overwritten.");
- $oP->p("The wizard cannot modify the configuration file for you. If you want to upgrade ".ITOP_APPLICATION.", make sure that the file '".$sRelativePath."' can be modified by the web server.");
-
- $sButtonsHtml = <<Reload
-HTML;
- $oP->p($sButtonsHtml);
-
- $oP->output();
- // Prevent token creation
- exit;
- }
- }
- }
$oPage->LinkScriptFromAppRoot('setup/setup.js');
$oPage->add('