From 416a8d9a94b103afe4f0de761b579f18250a520f Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Mon, 6 Oct 2025 14:19:49 -0400
Subject: [PATCH] Fix to properly redirect to the setup page if
 config_enable_setup is not set or is 1

---
 index.php | 25 +++++++++++++++++--------
 login.php | 12 +++++++++++-
 2 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/index.php b/index.php
index dac0e37c..79aa2303 100644
--- a/index.php
+++ b/index.php
@@ -1,28 +1,37 @@
 <?php
 
-
-// App setup is complete?
+// Check if the app is set up
 if (file_exists("config.php")) {
     require_once "config.php";
+
+    // Check if setup is enabled (not completed)
+    if (!isset($config_enable_setup) || $config_enable_setup == 1) {
+        header("Location: /setup");
+        exit();
+    }
+
+    // Start the session
     require_once "includes/session_init.php";
 
-    // If they are an app user, send them to their start page
+    // If user is an agent
     if (isset($_SESSION['logged'])) {
         require_once "includes/load_global_settings.php";
         header("Location: /agent/$config_start_page");
+        exit();
 
-    // If they're a client, send them to the client area
+    // If user is a client
     } elseif (isset($_SESSION['client_logged_in'])) {
         header("Location: /client/");
+        exit();
 
-    // Else, require login
+    // Not logged in
     } else {
         header("Location: /login.php");
+        exit();
     }
 
-
-// Installation needs to be completed
 } else {
-	header("Location: /setup");
+    // If config.php doesn't exist, redirect to setup
+    header("Location: /setup");
     exit();
 }
diff --git a/login.php b/login.php
index b40c0ea3..2db04167 100644
--- a/login.php
+++ b/login.php
@@ -3,12 +3,22 @@
 // Enforce a Content Security Policy for security against cross-site scripting
 header("Content-Security-Policy: default-src 'self'");
 
+// Check if the config.php file exists
 if (!file_exists('config.php')) {
-    header("Location: /setup"); //must use header instead of redirect as functions isnt included yet.
+    // Redirect to the setup page if config.php doesn't exist
+    header("Location: /setup"); // Must use header as functions aren't included yet
+    exit();
 }
 
 require_once "config.php";
 
+// Check if setup mode is enabled or the variable is missing
+if (!isset($config_enable_setup) || $config_enable_setup == 1) {
+    // Redirect to the setup page
+    header("Location: /setup");
+    exit();
+}
+
 // Set Timezone
 require_once "includes/inc_set_timezone.php";