Fixed CLI commands executable when addon not yet installed

Sim

Well-known member
Affected version
2.1.9
I can't recall whether this has already been reported?

If you have an addon which contains CLI commands, just copying the addon files to the server will make those CLI commands appear in the list of available commands and will be executable - you don't even need to install the addon.

Can I suggest that the CLI runner class check whether an addon is installed before adding the path to the command directory map?

In \XF\Cli\Runner:

PHP:
protected function isAddOnRootDirectory(\DirectoryIterator $entry)
{
   $ds = \XF::$DS;

   $pathname = $entry->getPathname();
   $addOnJson = "{$pathname}{$ds}addon.json";
   $outputDir = "{$pathname}{$ds}_output";
   $dataDir = "{$pathname}{$ds}_data";

   if (file_exists($addOnJson) || file_exists($outputDir) || file_exists($dataDir))
   {
      // CHECK WHETHER ADDON IS INSTALLED FIRST ???

      return true;
   }
   else
   {
      return false;
   }
}
 

XF Bug Bot

XenForo bug fixer bot
Staff member
Thank you for reporting this issue, it has now been resolved. We are aiming to include any changes that have been made in a future XF release (2.2.0 Beta 2).

Change log:
Make CLI command handling for disabled add-ons more explicit
There may be a delay before changes are rolled out to the XenForo Community.
 

Mike

XenForo developer
Staff member
Just to expand on this a bit, we now check whether the add-on is active by default, but we do offer a way to opt out of this by having the command implement the new \XF\Cli\Command\AllowInactiveAddOnCommandInterface interface. You don't have to implement anything with it, but it skips the check. Notable uses could involve custom install routines (for example, to trigger an online alter of a large table) or just a command that doesn't directly depend on the add-on.
 
Top