d_s_bisht/devsofttech_hms_ci4
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow one-time setup access via .env key for server use

Browse Source
This commit is contained in:
DevSoftTech Server 2026-02-28 20:48:27 +05:30
parent a10908e227
commit d541bbb9ad
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/Controllers/Setup.php
View File

@ -22,6 +22,14 @@ class Setup extends BaseController
return $this->response->setStatusCode(404)->setBody('Setup is already completed and locked.');
}
$keyFromEnv = trim((string) env('setup.dbToolsKey', ''));
if ($keyFromEnv !== '') {
$keyFromRequest = trim((string) ($this->request->getGet('key') ?? $this->request->getPost('key') ?? ''));
if ($keyFromRequest !== '' && hash_equals($keyFromEnv, $keyFromRequest)) {
return null;
}
}
if (!function_exists('auth')) {
return null;
}
@ -77,6 +85,7 @@ class Setup extends BaseController
'tables' => $tableRows,
'msg' => $flash,
'lock_file' => $this->lockFilePath(),
'setup_key' => trim((string) env('setup.dbToolsKey', '')),
]);
}

6
app/Views/setup/db_setup.php
View File

@ -19,6 +19,9 @@
<form method="post" action="<?= base_url('setup/db-tools/generate') ?>">
<?= csrf_field() ?>
<?php if (!empty($setup_key ?? '')) : ?>
<input type="hidden" name="key" value="<?= esc($setup_key) ?>">
<?php endif; ?>
<div class="table-responsive" style="max-height:520px; overflow:auto; border:1px solid #eee;">
<table class="table table-striped table-bordered">
<thead>
@ -64,6 +67,9 @@
<form method="post" action="<?= base_url('setup/db-tools/complete') ?>" onsubmit="return confirm('This will lock setup page. Continue?');">
<?= csrf_field() ?>
<?php if (!empty($setup_key ?? '')) : ?>
<input type="hidden" name="key" value="<?= esc($setup_key) ?>">
<?php endif; ?>
<button type="submit" class="btn btn-danger">Complete Setup and Lock Page</button>
<p class="text-muted" style="margin-top:8px;">Lock file: <?= esc($lock_file ?? '') ?></p>
</form>