N°9654 - Reduce surface attack on config file rights during setup

[Lenaick]

N°9654 - Reduce surface attack on config file rights during setup

[greptile-apps]

Greptile Summary

This PR changes setup authorization and config-file permission handling during installation. The main changes are:

• Setup AJAX calls now rely on the session setup token instead of an authent request parameter.
• Wizard pages no longer render hidden setup-token inputs.
• wizard.php now hardens an existing writable config file before creating the setup token.
• The data feature removal bridge now uses the session token when returning to setup.
• The final setup page no longer posts admin credentials to enter iTop.

Confidence Score: 3/5

These issues should be fixed before merging.

• The cleanup bridge can create a setup token while deletion is still pending.

• The setup token can stay valid across the cleanup workflow.

• Config permission hardening can fail silently while setup continues.

• DataFeatureRemovalController.php needs the token and deletion-state logic corrected.

• setup/wizard.php needs explicit handling when config hardening fails.

Important Files Changed

Filename	Overview
datamodels/2.x/combodo-data-feature-removal/src/Controller/DataFeatureRemovalController.php	Moves cleanup bridge authorization to the session token but leaves the token alive and checks the wrong deletion flag.
setup/wizard.php	Adds early config permission hardening before setup-token creation but does not handle chmod failure.

_{Reviews (1): Last reviewed commit: "N°9654 - Reduce surface attack on config..." | Re-trigger Greptile}

[greptile-apps]

Use the right flag

This branch checks bHasDeletionNeeded, but the code only sets bDeletionNeeded a few lines above. The missing key is treated as null, so this condition is always true and PHP can emit a warning. When the analysis still has deletion work to do, this still creates a fresh setup token even though the cleanup flow has not completed.

Suggested change

	if (!$aParams['bHasDeletionNeeded']) {
	SetupUtils::CreateSetupToken();
	}
	if (!$aParams['bDeletionNeeded']) {
	SetupUtils::CreateSetupToken();
	}