[4.0] Re-Implementing FTP-layer during CMS installation

[Hackwar]

Pull Request for Issue #20774 .

Summary of Changes

Joomla 3.x (and below) supports installing on a system without write permissions for the apache user. This means, that we either provide FTP credentials during installation to write the configuration.php or you get the configuration.php displayed at one point and need to create that file manually. This feature is missing in Joomla 4 right now.

This PR adds that back in. When the installation can't write to the filesystem (specifically the root folder of the installation or an existing configuration.php), it redirects to a preinstall screen, where you can provide the FTP credentials. Below are 2 buttons, one to check the credentials and one to skip this step. There is also a button next to the path field to auto-discover the correct path of the installation.

Clicking the auto-discover button triggers an AJAX request which takes the FTP credentials and tries to connect with those. It then will fill that field. Clicking the "Verify FTP Settings" button checks if all given info is correct and we are now able to write to that folder. "Manually create file" skips this step and later displays the content for the configuration.php.

When displaying the content for the configuration.php, there is a button "Continue", which will check if the configuration.php has been created and then redirects to the "remove" page.

Testing Instructions

1. Get a setup (preferably on Unix), where only your FTP user has write access to the folder, none else.
2. Clone this repo and try the installation. Before this PR, you can only progress with the installation when fixing the write permissions. Afterwards you can also install with FTP credentials.

Notes

I'm more than welcome for any PRs to improve the language strings here.

[brianteeman]

Does this mean that you have found a way to test this?

[Hackwar]

Yes, I've created a VM with a deliberately botched installation. Installed Ubuntu Server, then apache, mysql, php and vsftpd. Added a user "ftpuser" and set /var/www as its home dir, changed the owner to ftpuser and set permissions to 755. Unfortunately I don't think I can share my VM somehow... But that triggered the permissions warning and stops the installation until you have fixed this.

This draft currently is still missing the possibility of simply displaying the configuration.php at the end and some cleanup.

[brianteeman]

Can be deleted as you deleted the field

[Hackwar]

@PhilETaylor I saw your docker container, but for my coding, I needed something else and rolled my own. For testing, your container is a good solution. Since the code currently does not have any of the features to get around an unwritable filesystem, I did my own solution.

[Hackwar]

So, this should be ready now. Please test! :-)

[brianteeman]

With invalid ftp details and using the verify settings button

With valid ftp details and using the verify settings button

[brianteeman]

After entering the mysql details and waiting for it to complete you are silently returned to the first page as shown below

[brianteeman]

@PhilETaylor please create a new issue

[brianteeman]

Installing to a remote mysql server did not go through the expected security checks

[brianteeman]

I have tested this item 🔴 unsuccessfully on 1d6227e

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/31857.}

[brianteeman]

There is another issue which I am sure will occur is with the creation of the autoload_psr4.php file but as I havent been able to get as far as a complete install using ftp I cannot be 100% certain. However I cant see how it can be created on a site that requires ftp to create the configuration.php

[brianteeman]

I have tested this item 🔴 unsuccessfully on 183c748

Forgot to record my tests before

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/31857.}

[brianteeman]

there really is no point in having ftp during installation if you cant update with ftp

[brianteeman]

There is another issue which I am sure will occur is with the creation of the autoload_psr4.php file

However, without any FTP Credentials yet stored, this file cannot be written when first visiting /installation/index.php

Exactly my point - but its actually worse than that as FTP credentials are never saved now and you have to re-enter them each time they are needed. So this can never work for autoload

[brianteeman]

@rdeutz its been a month now. Is there really any point in pretending that this will ever be resolved. Looks like all release blockers are stuck in the same place

[brianteeman]

#33079 (comment)

I guess jumping on the FLoC bandwagon is more important than releasing joomla

[Hackwar]

Since @brianteeman asked so nicely: I tested this code on my machine with FTP and it works fine. With the information given by you, I can't debug this. The FTP user could be misconfigured to only allow reading for himself and not for other users, like the user of the webserver. Thus I would need more information to move this forward. You say that the configuration.php is created and seems to have the right content, so my assumption would be, that your FTP server is configured to write the files with 600 permissions or something similar.

[brianteeman]

As stated before I used the docker container provided by @PhilETaylor no idea what extra information you need

[Hackwar]

Ok, so you already did all the work to debug this and apparently also found the code and the place to fix this. You seem to have fun letting me do all that work again instead of creating a PR against my branch here to move us forward. I don't have time for that, so here we are. Again: Teaches me to volunteer to execute decisions the PLT has made.

[brianteeman]

But does it work in Joomla 3 right now. Because if its broken then there really is little point as it means no one is using it

[Hackwar]

The Production Team decided to drop the FTP layer. See #33390 (comment) for further comments.