From cc70e52303ccca1410b1a782eb1d1b5c5b4affe9 Mon Sep 17 00:00:00 2001
From: Adrian Greeve <adrian@moodle.com>
Date: Mon, 10 Nov 2025 09:54:59 +0800
Subject: [PATCH] MDL-86745 install: Stop installation if public directory
 visible

---
 public/install.php             | 21 +++++++++++++++++++--
 public/install/stringnames.txt |  2 ++
 public/lang/en/install.php     |  2 ++
 public/lib/installlib.php      | 18 ++++++++++++++++--
 4 files changed, 39 insertions(+), 4 deletions(-)

diff --git a/public/install.php b/public/install.php
index 60a15e8c8d4..9554e80fd9a 100644
--- a/public/install.php
+++ b/public/install.php
@@ -557,6 +557,7 @@ if ($config->stage == INSTALL_PATHS) {
                    'dirroot'  => get_string('dirroot', 'install'),
                    'dataroot' => get_string('dataroot', 'install'));
 
+    $stageclass = "alert-info";
     $sub = '<dl>';
     foreach ($paths as $path=>$name) {
         $sub .= '<dt>'.$name.'</dt><dd>'.get_string('pathssub'.$path, 'install').'</dd>';
@@ -566,7 +567,22 @@ if ($config->stage == INSTALL_PATHS) {
     }
     $sub .= '</dl>';
 
-    install_print_header($config, get_string('paths', 'install'), get_string('pathshead', 'install'), $sub);
+    $warnings = '';
+    $wwwroot = $CFG->wwwroot;
+    if (str_ends_with($CFG->wwwroot, '/public')) {
+        $wwwroot = substr($CFG->wwwroot, 0, -7);
+        $warnings .= '<dt>' . get_string('webservernotconfigured', 'install') . '</dt>';
+        $warnings .= '<dd>' . get_string('webserverconfigproblemdescription', 'install', s($wwwroot)) . '</dd>';
+    }
+
+    install_print_header(
+        $config,
+        get_string('paths', 'install'),
+        get_string('pathshead', 'install'),
+        $sub,
+        $stageclass,
+        $warnings,
+    );
 
     $strwwwroot      = get_string('wwwroot', 'install');
     $strdirroot      = get_string('dirroot', 'install');
@@ -606,7 +622,8 @@ if ($config->stage == INSTALL_PATHS) {
         }
     }
 
-    install_print_footer($config);
+    $requiresreload = ($warnings !== '');
+    install_print_footer($config, $requiresreload);
     die;
 }
 
diff --git a/public/install/stringnames.txt b/public/install/stringnames.txt
index f540aeba335..c46aa50613b 100644
--- a/public/install/stringnames.txt
+++ b/public/install/stringnames.txt
@@ -65,6 +65,8 @@ remotedownloaderror,error
 thisdirection,langconfig
 thislanguage,langconfig
 upgradekeyset,admin
+webservernotconfigured,install
+webserverconfigproblemdescription,install
 welcomep10,install
 welcomep20,install
 welcomep30,install
diff --git a/public/lang/en/install.php b/public/lang/en/install.php
index 1e328aacc0d..78b072e9a9e 100644
--- a/public/lang/en/install.php
+++ b/public/lang/en/install.php
@@ -215,6 +215,8 @@ $string['sessionautostarthelp'] = '<p>Moodle requires session support and will n
 
 <p>Sessions can be enabled in the php.ini file ... look for the session.auto_start parameter.</p>';
 $string['upgradingqtypeplugin'] = 'Upgrading question/type plugin';
+$string['webserverconfigproblemdescription'] = 'Your web server is not configured to prevent access to files outside the /public directory. Please refer to <a href="https://moodledev.io/docs/5.1/guides/restructure">https://moodledev.io/docs/5.1/guides/restructure</a> for details on how to configure your web server. Once reconfigured, please <a href="{$a}">revisit the web root</a>.';
+$string['webservernotconfigured'] = 'Web server not configured';
 $string['welcomep10'] = '{$a->installername} ({$a->installerversion})';
 $string['welcomep20'] = 'You are seeing this page because you have successfully installed and
     launched the <strong>{$a->packname} {$a->packversion}</strong> package in your computer. Congratulations!';
diff --git a/public/lib/installlib.php b/public/lib/installlib.php
index 745fa1a130f..69e1ad26809 100644
--- a/public/lib/installlib.php
+++ b/public/lib/installlib.php
@@ -268,9 +268,17 @@ function install_generate_configphp($database, $cfg) {
  * @param string $heading
  * @param string $stagetext
  * @param string $stageclass
+ * @param string $warning Additional information that is a warning
  * @return void
  */
-function install_print_header($config, $stagename, $heading, $stagetext, $stageclass = "alert-info") {
+function install_print_header(
+    $config,
+    $stagename,
+    $heading,
+    $stagetext,
+    $stageclass = "alert-info",
+    $warning = '',
+) {
     global $CFG;
 
     @header('Content-Type: text/html; charset=UTF-8');
@@ -312,6 +320,11 @@ function install_print_header($config, $stagename, $heading, $stagetext, $stagec
         echo $stagetext;
         echo '</div>';
     }
+    if ($warning !== '') {
+        echo '<div class="alert alert-danger">';
+        echo $warning;
+        echo '</div>';
+    }
     // main
     echo '<form id="installform" method="post" action="install.php"><fieldset>';
     foreach ($config as $name=>$value) {
@@ -344,7 +357,8 @@ function install_print_footer($config, $reload=false) {
     }
 
     if ($reload) {
-        $next = '<input type="submit" id="nextbutton" class="btn btn-primary ms-1 flex-grow-0 me-auto" name="next" value="'.s(get_string('reload')).'" />';
+        $next = '<input type="submit" id="nextbutton" class="btn btn-primary ms-1 flex-grow-0 me-auto" name="reload"
+         value="' . s(get_string('reload')) . '" />';
     } else {
         $next = '<input type="submit" id="nextbutton" class="btn btn-primary ms-1 flex-grow-0 me-auto" name="next" value="'.s(get_string('next')).' &raquo;" />';
     }