From 88cc11ab134d39f19e7ebf32db4641071e7607ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Wed, 21 Dec 2016 11:36:32 +0100
Subject: [PATCH] Disable setup if configuration already exists
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The setup allows to figure out quite a lot about system and network, so
it's safer to block access to it once phpMyAdmin has been configured.

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 setup/index.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/setup/index.php b/setup/index.php
index 910216d3e0..56d2f7b4fb 100644
--- a/setup/index.php
+++ b/setup/index.php
@@ -12,6 +12,10 @@
  */
 require './lib/common.inc.php';
 
+if (file_exists(CONFIG_FILE)) {
+    PMA_fatalError(__('Configuration already exists, setup is disabled!'));
+}
+
 $page = PMA_isValid($_GET['page'], 'scalar') ? $_GET['page'] : null;
 $page = preg_replace('/[^a-z]/', '', $page);
 if ($page === '') {