From 189a474082256c0631e276cadca900d192f931d6 Mon Sep 17 00:00:00 2001 From: cproudlock Date: Tue, 4 Aug 2026 12:57:00 -0400 Subject: [PATCH] fix(installer): do not demand a password the installer already holds Asked why the password box does not pre-fill from .dbpass. It should not - but it should not have been demanding a password either. .dbpass is the ACL'd handoff stage 0 writes when it creates the database itself, and stage 2 already reads it automatically when no password is supplied. The wizard, though, required a password whenever .env was absent, without checking for the handoff. On a server where stage 0 had completed but stage 2 had not - which is exactly what a partly-failed install leaves - the operator was blocked on a secret the installer already had, and sent hunting for a generated password they were never meant to handle. Blank is now accepted when either .env or .dbpass is present, and the sign-in page says so when it sees a handoff. Deliberately NOT pre-filled into the password box, for two reasons. It is the only copy of a generated password, so round-tripping it through a UI control and back out through a temporary password file adds exposure for no benefit - stage 2 reads the file directly. And .dbpass belongs to the BUNDLED database; on the existing-database page the operator is pointing at someone else's server, where a locally generated password is simply the wrong answer. --- deploy/windows/installer/ShopDBFlask.iss | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/deploy/windows/installer/ShopDBFlask.iss b/deploy/windows/installer/ShopDBFlask.iss index cf147c7..fa82b61 100644 --- a/deploy/windows/installer/ShopDBFlask.iss +++ b/deploy/windows/installer/ShopDBFlask.iss @@ -885,8 +885,15 @@ begin MsgBox('Enter the username the application connects with.', mbError, MB_OK); Result := False; end + // Blank is allowed when the password is already ON DISK in a form the + // installer can read: .env from a previous install, or the ACL'd .dbpass + // handoff stage 0 leaves when it created the database itself. Stage 2 + // consumes .dbpass on its own, so demanding the password here blocked the + // operator on something the installer already had - and sent them looking + // for a generated secret they were never meant to handle. else if (DbCredsPage.Values[1] = '') and - (not FileExists(InstalledDir + '.env')) then + (not FileExists(InstalledDir + '.env')) and + (not FileExists(InstalledDir + '.dbpass')) then begin // Only required on a FRESH install. On an upgrade, blank means "keep the // password already in .env", so the operator never has to know it. @@ -933,6 +940,13 @@ begin if (CurPageID = DbDetailsPage.ID) and (not DbPageReady) then begin DbPageReady := True; + // A stage-0 handoff means the database was created by a previous run of this + // installer and the password is already on disk. Nobody should be asked to + // find or retype a secret the installer generated. + if FileExists(InstalledDir + '.dbpass') then + DbCredsPage.SubCaptionLabel.Caption := + 'This server already has a database created by this installer. Leave the ' + + 'password blank and it will be used automatically.'; if LoadStringsFromFile(InstalledDir + '.env', Lines) then for I := 0 to GetArrayLength(Lines) - 1 do if Pos('DATABASE_URL=', Lines[I]) = 1 then