Restrict access to `?action=WCFSetup` after successful installation

This action only exists to complete WCFSetup. It should be guarded by a check
an unfinished installation (`!PACKAGE_ID`) to prevent accesses in live
installation.

diff --git a/wcfsetup/install/files/lib/acp/page/IndexPage.class.php b/wcfsetup/install/files/lib/acp/page/IndexPage.class.php
index c0eed71c51894f975fe63f161f1825b865736869..3eb1547bbd1550d336777dcfd49761b191219492 100755 (executable)
--- a/wcfsetup/install/files/lib/acp/page/IndexPage.class.php
+++ b/wcfsetup/install/files/lib/acp/page/IndexPage.class.php
@@ -206,7 +206,7 @@ class IndexPage extends AbstractPage
     public function show()
     {
         // check package installation queue
-        if ($this->action == 'WCFSetup') {
+        if (!\PACKAGE_ID && $this->action == 'WCFSetup') {
             $queueID = PackageInstallationDispatcher::checkPackageInstallationQueue();
 
             if ($queueID) {