SetupController#run(): prevent admin auto-login after autoconfig-only setup

[Al2Klimov]

No description provided.

[Al2Klimov]

Tests

Before

I

create a complete autoconfig.php.

Random FSB guy

opens my site first.

Congrats, the Russians are coming.. errm, admin.

After

[Al2Klimov]

Allowed edit by maintainers. Shall I resolve the conflicts as well? Does anybody care for this?

[come-nc]

Pointer: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/automatic_configuration.html#automatic-setup (I never heard of autoconfig.php before 🙊 )

Isn’t the autologin on purpose? Where/when is the admin password defined in the autoconfig process?

[come-nc]

Pointer: https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/automatic_configuration.html#automatic-setup (I never heard of autoconfig.php before speak_no_evil )

Isn’t the autologin on purpose? Where/when is the admin password defined in the autoconfig process?

Doc says «Any unspecified parameters appear on the “Finish setup” screen when you first launch Nextcloud.», isn’t the autologin for this finish setup step?

[Al2Klimov]

For an incomplete autoconfig – yes.

In case of a complete autoconfig no more user input is needed, so NC -see OP 2nd GIF- doesn’t even show a finish setup page, but proceeds. So I'm done with setup once I've created a complete autoconfig and closed VIm. As I'm done I may take a coffee break. If during this coffee break someone opens my NC before me, they're admin. That's not fair.

Where/when is the admin password defined in the autoconfig process?

If e.g. I say so e.g. via Ansible, it has a password generator btw.. See OP 1st GIF.

[come-nc]

In case of a complete autoconfig no more user input is needed, so NC -see OP 2nd GIF- doesn’t even show a finish setup page, but proceeds. So I'm done with setup once I've created a complete autoconfig and closed VIm. As I'm done I may take a coffee break. If during this coffee break someone opens my NC before me, they're admin. That's not fair.

Well you actually did not setup anything until Nextcloud is opened, no? This is when the autoconfig is applied. I would take the coffee after checking Nextcloud loads 😛

But yeah I understand the idea, if no more data is needed end the session and force the admin to log in with the configured password from autoconfig.

[Al2Klimov]

Well you actually did not setup anything until Nextcloud is opened, no? This is when the autoconfig is applied. I would take the coffee after checking Nextcloud loads 😛

In my Ansible I actually worked this around via curl after autoconfig placement.

[skjnldsv]

As this sounds like a nice feature, the requests for this are quite low. Currently there a no plans to implement such a feature. Thus I will close this ticket for now. This does not mean we don't want this feature, but it is simply not on our roadmap for the near future. If somebody wants to implement this feature nevertheless we are happy to assist and help out.

[Al2Klimov]

But I already implemented it(?)