locomotivecms/engine — Issue #294: Information leak on /admin/installation
Author: andreacampi
Created: 2012-01-30 21:50:34+00:00
State: open

Accessing that URL after installation renders step_1, which leaks name and email address of the first user.

The easiest fix would seem to be swapping the is_step_already_done? and allow_installation? filters: if the latter is evaluated first, it will redirect if installation has been completed.

I can send a pull request, but I haven't written specs, since this controller doesn't have any.
It should, but I feel this bug should be patched ASAP :)