admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4579 - Windows installers: program folder no longer writable by all users

Browse Source 
Both installers drop users-modify from the program folder (and local-postgres
in the single-user installer) and run icacls to remove the Users group's own
grants (by SID) from the program folder after copying files, so upgrades over
8.2.4 lose them too. The data folder keeps users-modify and config.json stays
readable by local users (the running account is not known at install time);
both documented in the single-user and LAN install pages. Changelog updated.
F2 fixed (write access), the rest accepted. Deferred: report on a missing
record fails with a generic error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-25 14:39:00 -07:00
parent c04de33af2
commit e9b79242fd
7 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
dist/install/windows/x64/lan.iss vendored
View File

@@ -43,7 +43,6 @@ Source: "C:\data\code\raven\dist\assets\open-ayanova-app.bat"; DestDir: "{app}";
[Dirs]
Name: "{app}";Permissions: users-modify;
Name: "{commonappdata}\ayanova";Permissions: users-modify;
Name: "{commonappdata}\ayanova\logs";Permissions: users-modify;
@@ -52,6 +51,12 @@ Name: "{commonappdata}\ayanova\logs";Permissions: users-modify;
Type: filesandordirs; Name: "{app}\Chrome"
Type: filesandordirs; Name: "{app}\ChromeHeadlessShell"
[Run]
; case 4579: the program folder is no longer writable by all local users (nothing writes there, data is under
; {commonappdata}\ayanova). Upgrades over 8.2.4 or older still carry the old grant, so remove the Users group's own
; rights (by SID, the group name is translated) from the program folder and everything in it; inherited read rights stay
Filename: "{sys}\icacls.exe"; Parameters: """{app}"" /remove:g *S-1-5-32-545 /T /C /Q"; Flags: runhidden waituntilterminated
[Icons]
Name: "{autoprograms}\AyaNova server\{#MyAppName}"; Filename: "{app}\AyaNova.exe";IconFilename: "{app}\AyaNova.exe";
Name: "{autodesktop}\{#MyAppName}"; Filename: "{app}\AyaNova.exe";IconFilename: "{app}\AyaNova.exe";

7
dist/install/windows/x64/standalone.iss vendored
View File

@@ -45,12 +45,11 @@ Source: "C:\data\code\raven\dist\win-x64\ayanova\standalone\AyaNova.exe"; DestDi
Source: "C:\data\code\raven\dist\win-x64\ayanova\standalone\*"; DestDir: "{app}"; Flags: ignoreversion recursesubdirs createallsubdirs
Source: "C:\data\code\raven\dist\win-x64\launcher\config.json"; DestDir: "{app}"; Flags: ignoreversion confirmoverwrite
Source: "C:\data\code\raven\dist\win-x64\launcher\*"; DestDir: "{app}\launcher"; Flags: ignoreversion recursesubdirs createallsubdirs
Source: "C:\data\code\raven\dist\win-x64\postgres-standalone\*"; DestDir: "{app}\local-postgres"; Permissions: users-modify;Flags: ignoreversion recursesubdirs createallsubdirs
Source: "C:\data\code\raven\dist\win-x64\postgres-standalone\*"; DestDir: "{app}\local-postgres"; Flags: ignoreversion recursesubdirs createallsubdirs
Source: "C:\data\code\raven\dist\win-x64\postgres-empty-database\*"; DestDir: "{commonappdata}\ayanova\database"; Permissions: users-modify; Flags: ignoreversion recursesubdirs createallsubdirs onlyifdoesntexist uninsneveruninstall
[Dirs]
;Name: "{app}\.local-chromium";Permissions: users-modify;Flags: uninsalwaysuninstall
Name: "{app}";Permissions: users-modify;
Name: "{commonappdata}\ayanova";Permissions: users-modify;Flags: uninsneveruninstall
Name: "{commonappdata}\ayanova\logs";Permissions: users-modify;Flags: uninsneveruninstall
; Empty folders PostgreSQL 14 needs in a new database. Git does not keep empty folders, so dist\win-x64\postgres-empty-database
@@ -81,6 +80,10 @@ Name: "{autodesktop}\{#MyAppName}"; Filename: "{app}\launcher\ayanova-launcher.e
;removed this from above line to force desktop icon Tasks: desktopicon
[Run]
; case 4579: the program folder is no longer writable by all local users (nothing writes there, data is under
; {commonappdata}\ayanova). Upgrades over 8.2.4 or older still carry the old grant, so remove the Users group's own
; rights (by SID, the group name is translated) from the program folder and everything in it; inherited read rights stay
Filename: "{sys}\icacls.exe"; Parameters: """{app}"" /remove:g *S-1-5-32-545 /T /C /Q"; Flags: runhidden waituntilterminated
Filename: "{app}\launcher\ayanova-launcher.exe"; Description: "{cm:LaunchProgram,{#StringChange(MyAppName, '&', '&&')}}"; Flags: nowait postinstall skipifsilent
[Code]