Avoid redirect to install.php on production environments

Created on 29 November 2019, over 4 years ago
Updated 1 September 2023, 10 months ago

Redirecting to /core/install.php is a great feature for people playing with Drupal as they can quickly understand what's going on.

But on the contrary, it's very bad in production with a (big) database problem ! (Even worse when it falls in the varnish cache hush!) 

I was thinking of a configuration key in backoffice, section "Error pages", but since we have no database, it should be a variable in settings.php.

I would like to have the community opinion first ?

=============================
In Drupal\Core\EventSubscriber\ExceptionDetectNeedsInstallSubscriber :

/**
   * Handles errors for this subscriber.
   *
   * @param \Symfony\Component\HttpKernel\Event\GetResponseForExceptionEvent $event
   *   The event to process.
   */
  public function onException(GetResponseForExceptionEvent $event) {
    $exception = $event->getException();
    if ($this->shouldRedirectToInstaller($exception, $this->connection)) {
      // Only redirect if this is an HTML response (i.e., a user trying to view
      // the site in a web browser before installing it).
      $request = $event->getRequest();
      $format = $request->query->get(MainContentViewSubscriber::WRAPPER_FORMAT, $request->getRequestFormat());
      if ($format == 'html') {
        $event->setResponse(new RedirectResponse($request->getBasePath() . '/core/install.php', 302, ['Cache-Control' => 'no-cache']));
      }
    }
  }
Feature request
Status

Active

Version

11.0 🔥

Component
Install 

Last updated about 6 hours ago

No maintainer
Created by

🇫🇷France pguillard

Live updates comments and jobs are added and updated live.
  • Security

    It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.69.0 2024