From b0c7e827d2db9db980458dd03d92c8bdeb05b644 Mon Sep 17 00:00:00 2001
From: James Cole <james@firefly-iii.org>
Date: Tue, 30 Jun 2026 12:10:32 +0200
Subject: [PATCH] Stop access to install page.

---
 .../Controllers/System/InstallController.php  | 16 +++++--
 app/Http/Middleware/Installer.php             | 42 ----------------
 app/Support/System/IsOldVersion.php           | 48 +++++++++++++++++++
 3 files changed, 59 insertions(+), 47 deletions(-)

diff --git a/app/Http/Controllers/System/InstallController.php b/app/Http/Controllers/System/InstallController.php
index a456384fd7..d8543dd6aa 100644
--- a/app/Http/Controllers/System/InstallController.php
+++ b/app/Http/Controllers/System/InstallController.php
@@ -30,6 +30,8 @@ use FireflyIII\Http\Controllers\Controller;
 use FireflyIII\Support\Facades\AppConfiguration;
 use FireflyIII\Support\Facades\Preferences;
 use FireflyIII\Support\Http\Controllers\GetConfigurationData;
+use FireflyIII\Support\System\IsOldVersion;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Contracts\View\Factory;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -48,6 +50,7 @@ use function Safe\file_put_contents;
 final class InstallController extends Controller
 {
     use GetConfigurationData;
+    use IsOldVersion;
 
     public const string BASEDIR_ERROR   = 'Firefly III cannot execute the upgrade commands. It is not allowed to because of an open_basedir restriction.';
     public const string FORBIDDEN_ERROR = 'Internal PHP function "proc_close" is disabled for your installation. Auto-migration is not possible.';
@@ -73,13 +76,16 @@ final class InstallController extends Controller
      */
     public function index(): Factory|\Illuminate\Contracts\View\View
     {
-        app('view')->share('FF_VERSION', config('firefly.version'));
+        if ($this->hasNoTables() || $this->isOldVersionInstalled()) {
+            app('view')->share('FF_VERSION', config('firefly.version'));
 
-        // index will set FF3 version.
-        AppConfiguration::set('ff3_version', (string) config('firefly.version'));
-        AppConfiguration::set('ff3_build_time', (int) config('firefly.build_time'));
+            // index will set FF3 version.
+            AppConfiguration::set('ff3_version', (string)config('firefly.version'));
+            AppConfiguration::set('ff3_build_time', (int)config('firefly.build_time'));
 
-        return view('install.index');
+            return view('install.index');
+        }
+        throw new AuthorizationException('No access to this page.');
     }
 
     /**
diff --git a/app/Http/Middleware/Installer.php b/app/Http/Middleware/Installer.php
index dd5ef803df..eccb605758 100644
--- a/app/Http/Middleware/Installer.php
+++ b/app/Http/Middleware/Installer.php
@@ -86,47 +86,5 @@ class Installer
         return false !== stripos($message, 'Access denied');
     }
 
-    /**
-     * Is no tables exist error.
-     */
-    protected function noTablesExist(string $message): bool
-    {
-        return false !== stripos($message, 'Base table or view not found');
-    }
 
-    /**
-     * Check if the tables are created and accounted for.
-     *
-     * @throws FireflyException
-     */
-    private function hasNoTables(): bool
-    {
-        // Log::debug('Now in routine hasNoTables()');
-
-        try {
-            DB::table('users')->count();
-        } catch (QueryException $e) {
-            $message = $e->getMessage();
-            Log::error(sprintf('Error message trying to access users-table: %s', $message));
-            if ($this->isAccessDenied($message)) {
-                throw new FireflyException(
-                    'It seems your database configuration is not correct. Please verify the username and password in your .env file.',
-                    0,
-                    $e
-                );
-            }
-            if ($this->noTablesExist($message)) {
-                // redirect to UpdateController
-                Log::warning('There are no Firefly III tables present. Redirect to migrate routine.');
-
-                return true;
-            }
-
-            throw new FireflyException(sprintf('Could not access the database: %s', $message), 0, $e);
-        }
-
-        // Log::debug('Everything seems OK with the tables.');
-
-        return false;
-    }
 }
diff --git a/app/Support/System/IsOldVersion.php b/app/Support/System/IsOldVersion.php
index 62fa481059..4e913c59f0 100644
--- a/app/Support/System/IsOldVersion.php
+++ b/app/Support/System/IsOldVersion.php
@@ -25,11 +25,59 @@ declare(strict_types=1);
 namespace FireflyIII\Support\System;
 
 use Carbon\Carbon;
+use FireflyIII\Exceptions\FireflyException;
 use FireflyIII\Support\Facades\AppConfiguration;
+use Illuminate\Database\QueryException;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
 
 trait IsOldVersion
 {
+
+    /**
+     * Check if the tables are created and accounted for.
+     *
+     * @throws FireflyException
+     */
+    private function hasNoTables(): bool
+    {
+        // Log::debug('Now in routine hasNoTables()');
+
+        try {
+            DB::table('users')->count();
+        } catch (QueryException $e) {
+            $message = $e->getMessage();
+            Log::error(sprintf('Error message trying to access users-table: %s', $message));
+            if ($this->isAccessDenied($message)) {
+                throw new FireflyException(
+                    'It seems your database configuration is not correct. Please verify the username and password in your .env file.',
+                    0,
+                    $e
+                );
+            }
+            if ($this->noTablesExist($message)) {
+                // redirect to UpdateController
+                Log::warning('There are no Firefly III tables present. Redirect to migrate routine.');
+
+                return true;
+            }
+
+            throw new FireflyException(sprintf('Could not access the database: %s', $message), 0, $e);
+        }
+
+        // Log::debug('Everything seems OK with the tables.');
+
+        return false;
+    }
+    /**
+     * Is no tables exist error.
+     */
+    protected function noTablesExist(string $message): bool
+    {
+        return false !== stripos($message, 'Base table or view not found');
+    }
+
+
     /**
      * By default, version_compare() returns -1 if the first version is lower than the second, 0 if they are equal, and
      * 1 if the second is lower.