Safer calling of `install.php` (#7971)

To prevent `install.php` from being accessed in unintended places

1 files changed, 5 insertions, 0 deletions

diff --git a/app/install.php b/app/install.php
index 3d7f88913..f7b15d468 100644
--- a/app/install.php
+++ b/app/install.php
@@ -1,6 +1,11 @@
 <?php
 declare(strict_types=1);
 
+if (isset($_SESSION) || basename(is_string($_SERVER['SCRIPT_NAME']) ? $_SERVER['SCRIPT_NAME'] : '') !== 'index.php') {
+	header('HTTP/1.1 403 Forbidden');
+	exit('Forbidden');
+}
+
 if (function_exists('opcache_reset')) {
 	opcache_reset();
 }