Xenforo allows resetting existing install if it fails to connect to cloud storage provider

K

K a M a L

Well-known member
Affected version
ALL
If an error occurs during an attempt to read the install-lock.php file, XenForo handles the exception gracefully and returns false, as shown in the code below:

PHP: 
public static function installLockExists()
    {
        try
        {
            // If this path doesn't exist, then this will throw an exception. We need to handle this elsewhere.
            return \XF::fs()->has('internal-data://install-lock.php');
        }
        catch (\Exception $e)
        {
            return false;
        }
    }
This behavior inadvertently allows anyone to reset the XenForo database by accessing the installation path if the cloud storage provider (e.g., DigitalOcean Spaces, AWS S3) is temporarily unreachable.

A current real-world example is the ongoing DigitalOcean Spaces outage: https://status.digitalocean.com/incidents/jm44h02t22ck.

​

XenForo should distinguish between:

  • The actual absence of the install-lock.php file.
  • An inability to access the cloud storage system due to connectivity issues.
If the storage system is unavailable, the installation process should halt and log an error instead of assuming the lock file is missing. This will prevent unintended resets of active installations.
 
Back
Top Bottom