From 25250f46b4f110e9c9a1a1f4366889c3701bca18 Mon Sep 17 00:00:00 2001
From: Inverle <inverle@proton.me>
Date: Tue, 16 Sep 2025 00:53:15 +0200
Subject: Safer calling of `install.php` (#7971)

To prevent `install.php` from being accessed in unintended places
---
 app/install.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/app/install.php b/app/install.php
index 3d7f88913..f7b15d468 100644
--- a/app/install.php
+++ b/app/install.php
@@ -1,6 +1,11 @@
 <?php
 declare(strict_types=1);
 
+if (isset($_SESSION) || basename(is_string($_SERVER['SCRIPT_NAME']) ? $_SERVER['SCRIPT_NAME'] : '') !== 'index.php') {
+	header('HTTP/1.1 403 Forbidden');
+	exit('Forbidden');
+}
+
 if (function_exists('opcache_reset')) {
 	opcache_reset();
 }
-- 
cgit v1.2.3