Closed Xenforo allows resetting existing install if it fails to connect to cloud storage provider

K

K a M a L

Well-known member
Licensed customer
Affected version
ALL
If an error occurs during an attempt to read the install-lock.php file, XenForo handles the exception gracefully and returns false, as shown in the code below:

PHP: 
public static function installLockExists()
    {
        try
        {
            // If this path doesn't exist, then this will throw an exception. We need to handle this elsewhere.
            return \XF::fs()->has('internal-data://install-lock.php');
        }
        catch (\Exception $e)
        {
            return false;
        }
    }
This behavior inadvertently allows anyone to reset the XenForo database by accessing the installation path if the cloud storage provider (e.g., DigitalOcean Spaces, AWS S3) is temporarily unreachable.

A current real-world example is the ongoing DigitalOcean Spaces outage: https://status.digitalocean.com/incidents/jm44h02t22ck.

​

XenForo should distinguish between:

  • The actual absence of the install-lock.php file.
  • An inability to access the cloud storage system due to connectivity issues.
If the storage system is unavailable, the installation process should halt and log an error instead of assuming the lock file is missing. This will prevent unintended resets of active installations.
 
Automated triage: Not a bug

Thank you for reporting this issue. Since XenForo 2.3.7, if the install lock file can't be checked because storage is unavailable, the error is logged and the site is treated as installed, so the installer stays locked. If you still see the installer open on a current version, please post a new report with the steps.

This is an automated assessment. A member of staff may review and update it.
 
Back
Top Bottom