security: bind install form to a SameSite cookie nonce

modules/Install/Config/InstallConfig.php exempts install/* from the
session-bound CSRF check because the installer runs before any session
or encryption key exists. Bulgu 3 already prevents the installer from
being reached after .env exists; this commit closes the remaining
window during initial install where an attacker page in another tab
could POST to /install cross-origin and seed a malicious .env / admin.

Mechanism (independent of CI4's session + encryption stack so it works
on a fresh, pre-install machine):

* GET /install: read or generate a 32-hex install_nonce cookie. Cookie
  attributes are HttpOnly + SameSite=Lax + Secure-when-HTTPS, so the
  browser refuses to send it on cross-origin form POSTs. The view
  echoes the value into a hidden input.

* POST /install: read the cookie AND the hidden field, fail closed with
  a flash error if either is missing or they don't match (hash_equals
  for timing safety). Validation runs only after the nonce match.

Multi-tab / page-reload UX is preserved: the same cookie value is
returned to the view until it expires after 1h, so refreshing or
opening in a second tab keeps working.

If the user submits with an expired or missing nonce, they get a clear
"reload and resubmit" flash error rather than a silent failure.

Adds one translation key (Install.invalidNonce) for en + tr.

Refs: ci4ms-security-audit Finding 16 (Low, residual after Finding 3).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: bertugfahriozer

modules/Install/Controllers/Install.php

@@ -7,9 +7,24 @@
 
 class Install extends Controller
 {
+    /** Cookie name carrying the per-installer-session nonce. */
+    private const INSTALL_NONCE_COOKIE = 'install_nonce';
+
     public function index()
     {
         if ($this->request->is('post')) {
+            // Pre-validate the install nonce. The shipped CSRF middleware is
+            // disabled on install/* in InstallConfig (no session exists yet to
+            // bind the standard token to), so we bind the form to a cookie
+            // value the browser only sends back when the POST is same-site.
+            // Combined with the SameSite=Lax default this neutralises the
+            // pre-install CSRF window described in audit Finding 16.
+            $cookieNonce = (string) ($this->request->getCookie(self::INSTALL_NONCE_COOKIE) ?? '');
+            $postNonce   = (string) ($this->request->getPost(self::INSTALL_NONCE_COOKIE) ?? '');
+            if ($cookieNonce === '' || $postNonce === '' || !hash_equals($cookieNonce, $postNonce)) {
+                return redirect()->back()->withInput()->with('errors', ['install' => lang('Install.invalidNonce')]);
+            }
+
             $valData = [
                 'baseUrl' => ['label' => lang('Install.baseUrl'), 'rules' => 'required|valid_url'],
                 'host' => ['label' => lang('Install.databaseHost'), 'rules' => 'required|max_length[255]|regex_match[/^[a-zA-Z0-9._-]+$/]'],
@@ -94,7 +109,30 @@ public function index()
 
             return $this->dbsetup($installData);
         }
-        return view('Modules\Install\Views\install');
+
+        // GET: ensure the browser holds an install_nonce cookie, generate one
+        // if missing, and pass the value to the view so the form can echo it
+        // back as a hidden field. Reusing an existing cookie avoids breaking
+        // multi-tab / reload UX during the install flow.
+        helper('cookie');
+        $nonce = (string) ($this->request->getCookie(self::INSTALL_NONCE_COOKIE) ?? '');
+        if ($nonce === '' || !preg_match('/^[a-f0-9]{32}$/', $nonce)) {
+            $nonce = bin2hex(random_bytes(16));
+            // Lax SameSite (CI4 default) and httpOnly: cross-origin POSTs
+            // won't carry this cookie, so the hash_equals() above will fail
+            // for any attacker-driven form submission.
+            set_cookie([
+                'name'     => self::INSTALL_NONCE_COOKIE,
+                'value'    => $nonce,
+                'expire'   => 3600,
+                'path'     => '/',
+                'secure'   => $this->request->isSecure(),
+                'httponly' => true,
+                'samesite' => 'Lax',
+            ]);
+        }
+
+        return view('Modules\Install\Views\install', ['installNonce' => $nonce]);
     }
 
     private function updateEnvSettings(array $updates)

modules/Install/Language/en/Install.php

@@ -43,4 +43,5 @@
     'lastName' => 'Last Name',
     'password' => 'Password',
     'foldersWithSameNameListItem' => 'Folders With Same Name List Item',
+    'invalidNonce' => 'The install session is missing or expired. Reload this page and submit the form again.',
 ];

modules/Install/Language/tr/Install.php

@@ -43,4 +43,5 @@
     'lastName' => 'Soyadınız',
     'password' => 'Şifreniz',
     'foldersWithSameNameListItem' => 'Aynı İsimli Klasörler',
+    'invalidNonce' => 'Yükleme oturumu eksik veya süresi dolmuş. Lütfen sayfayı yenileyip formu tekrar gönderin.',
 ];

modules/Install/Views/install.php

@@ -13,6 +13,7 @@
         <?php echo view('Modules\Auth\Views\_message_block') ?>
         <form action="<?php echo route_to('install') ?>" method="post">
           <?php echo csrf_field() ?>
+          <input type="hidden" name="install_nonce" value="<?php echo esc($installNonce ?? '', 'attr') ?>">
           <div class="bs-stepper">
             <div class="bs-stepper-header" role="tablist">
               <!-- your steps here -->