Moved initialization from CMS_DEFAULT_SETUP to CMS_SETUP.initialize.

Rely on setup  "admin.installation_access" to determine who has access to /admin/install .

src/configuration/cms_default_setup.e

@@ -10,6 +10,9 @@ class
 
 inherit
 	CMS_SETUP
+		redefine
+			initialize
+		end
 
 	REFACTORING_HELPER
 
@@ -29,7 +32,7 @@ feature {NONE} -- Initialization
 	initialize
 			-- Initialize various cms components.
 		do
-			configure
+			Precursor
 			create modules.make (3)
 			create storage_drivers.make (2)
 
@@ -38,63 +41,6 @@ feature {NONE} -- Initialization
 			initialize_modules
 		end
 
-	configure
-		local
-			l_url: like site_url
-		do
-			site_location := environment.path
-
-				--| Site id, used to identified a site, this could be set to a uuid, or else
-			site_id := text_item_or_default ("site.id", "_EWF_CMS_NO_ID_")
-
-				-- Site url: optional, but ending with a slash
-			l_url := string_8_item ("site_url")
-			if l_url /= Void and then not l_url.is_empty then
-				if l_url [l_url.count] /= '/' then
-					l_url := l_url + "/"
-				end
-			end
-			site_url := l_url
-
-				-- Site name
-			site_name := text_item_or_default ("site.name", "EWF::CMS")
-
-				-- Site email for any internal notification
-				-- Can be also used to precise the "From:" value for email.
-			site_email := text_item_or_default ("site.email", "webmaster")
-
-
-				-- Location for public files
-			if attached text_item ("files-dir") as s then
-				create files_location.make_from_string (s)
-			else
-				files_location := site_location.extended ("files")
-			end
-
-				-- Location for modules folders.
-			if attached text_item ("modules-dir") as s then
-				create modules_location.make_from_string (s)
-			else
-				modules_location := environment.modules_path
-			end
-
-				-- Location for themes folders.
-			if attached text_item ("themes-dir") as s then
-				create themes_location.make_from_string (s)
-			else
-				themes_location := environment.themes_path
-			end
-
-				-- Selected theme's name
-			theme_name := text_item_or_default ("theme", "default")
-
-			debug ("refactor_fixme")
-				fixme ("Review export clause for configuration and environment")
-			end
-
-			compute_theme_location
-		end
-
 	initialize_storages
 			-- Initialize storages
 		do
@@ -205,12 +151,6 @@ feature -- Element change
 			modules.extend (m)
 		end
 
-feature -- Theme: Compute location
-
-	compute_theme_location
-		do
-			theme_location := themes_location.extended (theme_name)
-		end
 
 note
 	copyright: "2011-2015, Jocelyn Fiat, Javier Velilla, Eiffel Software and others"

src/configuration/cms_setup.e

@@ -11,6 +11,65 @@ deferred class
 inherit
 	REFACTORING_HELPER
 
+feature {NONE} -- Initialization	
+
+	initialize
+		local
+			l_url: like site_url
+		do
+			site_location := environment.path
+
+				--| Site id, used to identified a site, this could be set to a uuid, or else
+			site_id := text_item_or_default ("site.id", "_EWF_CMS_NO_ID_")
+
+				-- Site url: optional, but ending with a slash
+			l_url := string_8_item ("site_url")
+			if l_url /= Void and then not l_url.is_empty then
+				if l_url [l_url.count] /= '/' then
+					l_url := l_url + "/"
+				end
+			end
+			site_url := l_url
+
+				-- Site name
+			site_name := text_item_or_default ("site.name", "EWF::CMS")
+
+				-- Site email for any internal notification
+				-- Can be also used to precise the "From:" value for email.
+			site_email := text_item_or_default ("site.email", "webmaster")
+
+
+				-- Location for public files
+			if attached text_item ("files-dir") as s then
+				create files_location.make_from_string (s)
+			else
+				files_location := site_location.extended ("files")
+			end
+
+				-- Location for modules folders.
+			if attached text_item ("modules-dir") as s then
+				create modules_location.make_from_string (s)
+			else
+				modules_location := environment.modules_path
+			end
+
+				-- Location for themes folders.
+			if attached text_item ("themes-dir") as s then
+				create themes_location.make_from_string (s)
+			else
+				themes_location := environment.themes_path
+			end
+
+				-- Selected theme's name
+			theme_name := text_item_or_default ("theme", "default")
+
+			debug ("refactor_fixme")
+				fixme ("Review export clause for configuration and environment")
+			end
+
+			theme_location := themes_location.extended (theme_name)
+		end
+
 feature -- Access
 
 	environment: CMS_ENVIRONMENT

src/service/handler/cms_admin_install_handler.e

@@ -43,34 +43,49 @@ feature -- HTTP Methods
 			l_module: CMS_MODULE
 			s: STRING
 			lst: ARRAYED_LIST [CMS_MODULE]
+			l_denied: BOOLEAN
 		do
 			create {GENERIC_VIEW_CMS_RESPONSE} r.make (req, res, api)
+			if attached api.setup.string_8_item ("admin.installation_access") as l_access then
+				if l_access.is_case_insensitive_equal ("none") then
+					l_denied := True
+				elseif l_access.is_case_insensitive_equal ("permission") then
+					l_denied := not r.has_permission ("install modules")
+				end
+			else
+				l_denied := True
+			end
+			if l_denied then
+				create {FORBIDDEN_ERROR_CMS_RESPONSE} r.make (req, res, api)
+				r.set_main_content ("You do not have permission to access CMS installation procedure!")
+			else
+				create s.make_from_string ("<h1>Modules</h1><ul>")
+				create lst.make (1)
+				across
+					api.setup.modules as ic
+				loop
+					l_module := ic.item
+					if api.is_module_installed (l_module) then
+						s.append ("<li>" + l_module.name + " is already installed.</li>%N")
+					else
+						lst.force (l_module)
+					end
+				end
+				api.install
+				across
+					lst as ic
+				loop
+					l_module := ic.item
+					if api.is_module_installed (l_module) then
+						s.append ("<li>" + l_module.name + " was successfully installed.</li>%N")
+					else
+						s.append ("<li>" + l_module.name + " could not be installed!</li>%N")
+					end
+				end
+				s.append ("</ul>")
+				r.set_main_content (s)
+			end
 			r.set_title (r.translation ("CMS Installation ...", Void))
-			create s.make_from_string ("<h1>Modules</h1><ul>")
-			create lst.make (1)
-			across
-				api.setup.modules as ic
-			loop
-				l_module := ic.item
-				if api.is_module_installed (l_module) then
-					s.append ("<li>" + l_module.name + " is already installed.</li>%N")
-				else
-					lst.force (l_module)
-				end
-			end
-			api.install
-			across
-				lst as ic
-			loop
-				l_module := ic.item
-				if api.is_module_installed (l_module) then
-					s.append ("<li>" + l_module.name + " was successfully installed.</li>%N")
-				else
-					s.append ("<li>" + l_module.name + " could not be installed!</li>%N")
-				end
-			end
-			s.append ("</ul>")
-			r.set_main_content (s)
 			r.execute
 		end