Обсуждение: Windows installation requires admin rights

Hi

On Fri, May 21, 2021 at 9:25 PM Antoine Aumjaud <antoine_dev@aumjaud.fr> wrote:

Hi,

 

The actual configuration of Inno Setup for the installation of pgAdmin4 requires admin privileges on the computer :

https://github.com/postgres/pgadmin4/blob/master/pkg/win32/installer.iss.in#L31

                                PrivilegesRequired=admin

 

I have read the whole configuration, and I think that this constrain could be remove if HKCU (HKEY_CURENT_USER of Windows registry) is used instead of HKLM (HKEY_LOCAL_MACHINE).

 

The pgAdmin package provided by entreprisedb can be installed without admin rights, but it is an old version of pgAdmin.

 

Do you think that this modification is possible?

I think it's a little more complex than that, but here's a patch that I think does everything required. The only part I'm not sure about is the VC++ runtime installation, and ensuring that will work for non-admins. Fahar; can you test that on a *completely* clean installation of Windows please? You must run the "install only for me" option before anything else (don't even install VMware tools). 

There's a test build at https://developer.pgadmin.org/~dpage/non-admin-install/pgadmin4-5.3-x64.exe. Note that it is not signed, so you will get a warning, but that can be ignored for the purposes of this test.

--

Dave Page
Blog: https://pgsnake.blogspot.com
Twitter: @pgsnake

EDB: https://www.enterprisedb.com

Hi

On Fri, May 21, 2021 at 9:25 PM Antoine Aumjaud <antoine_dev@aumjaud.fr> wrote:

Hi,

 

The actual configuration of Inno Setup for the installation of pgAdmin4 requires admin privileges on the computer :

https://github.com/postgres/pgadmin4/blob/master/pkg/win32/installer.iss.in#L31

                                PrivilegesRequired=admin

 

I have read the whole configuration, and I think that this constrain could be remove if HKCU (HKEY_CURENT_USER of Windows registry) is used instead of HKLM (HKEY_LOCAL_MACHINE).

 

The pgAdmin package provided by entreprisedb can be installed without admin rights, but it is an old version of pgAdmin.

 

Do you think that this modification is possible?

I think it's a little more complex than that, but here's a patch that I think does everything required. The only part I'm not sure about is the VC++ runtime installation, and ensuring that will work for non-admins. Fahar; can you test that on a *completely* clean installation of Windows please? You must run the "install only for me" option before anything else (don't even install VMware tools). 

There's a test build at https://developer.pgadmin.org/~dpage/non-admin-install/pgadmin4-5.3-x64.exe. Note that it is not signed, so you will get a warning, but that can be ignored for the purposes of this test.

--

Dave Page
Blog: https://pgsnake.blogspot.com
Twitter: @pgsnake

EDB: https://www.enterprisedb.com

Hi,

What is the next step for this request?

Thanks a lot,

Antoine

 

From: Dave Page <dpage@pgadmin.org>
Sent: jeudi 27 mai 2021 10:24
To: Fahar Abbas <fahar.abbas@enterprisedb.com>
Cc: Antoine Aumjaud <antoine_dev@aumjaud.fr>; pgAdmin Support <pgadmin-support@postgresql.org>
Subject: Re: Windows installation requires admin rights

 

[EMETTEUR EXTERNE] / [EXTERNAL SENDER]
Soyez vigilant avant d'ouvrir les pièces jointes ou de cliquer sur les liens. En cas de doute, signalez le message via le bouton "Message suspect" ou consultez go/secu.
Be cautious before opening attachments or clicking on any links. If in doubt, use "Suspicious email" button or visit go/secu.

 

Hi

 

On Thu, May 27, 2021 at 8:43 AM Fahar Abbas <fahar.abbas@enterprisedb.com> wrote:

Hi Dave,

 

1. Installer is not signed in yet and you have  already mentioned it.

2.   Findings in Install for me only(recommended) option in case of Admin User:

 

Pgadmin4 installing in the following location:

C:\Users\Administrator\AppData\Local\Programs\pgAdmin 4\v5

 

No issue found  so far with this scenario

 

OK.

 

 

3. Findings in Install for all users option with Admin user:

 

Pgadmin4 installing in the following location:

C:\Program Files\pgAdmin 4\v5

 

No issue found so far with this scenario

 

OK.

 

 

4. Findings in Install for me only(recommended) option in case of non Admin User with double:

 

Pgadmin4 installing in the following location:

C:\Users\Administrator\AppData\Local\Programs\pgAdmin 4\v5

 

No issue found  so far with this scenario

 

If you were logged in as a non-admin user, there's no way it could have installed that way under C:\Users\Administrator\ unless your system is seriously broken. You would not have had sufficient privileges to install into the Administrator's home directory, and the only way the installer could have worked around that is if privileges were elevated for which you would have had to enter a username/password of the Administrator - which wouldn't have been an option with "Install only for me".

 

 

5. Findings in Install for all users option with Non admin user:

 

Pgadmin4 installing in the following location:

C:\Program Files\pgAdmin 4\v5

 

No issue found so far with this scenario

 

OK.

 

 

6. Findings in Install for me only(recommended) option, in case user change the installation directory with non admin user:

 

Login to admin user

 

Pgadmin4 installing in the following location:

C:\Users\Administrator\AppData\Local\Programs\pgAdmin 4\v5

 

But I changed the installation directory before the installation:

C:\Users\rayyan\AppData\Local\Programs\pgAdmin 4\v5

 

Menu item of pgadmin created under Administrator account while the installation is available in C:\Users\rayyan\AppData\Local\Programs\pgAdmin 4\v5

 

I can launch the pgadmin4 under an admin account successfully and in case a non-admin menu item of pgadmin is not present, but I can launch with the pgadmin4 script successfully.

 

Yes, that's what I would expect to happen. The Administrator can install anywhere, including under another user's home directory. The shortcut will always be under the user account of the user that's performing the installation though because you chose "Install for me only".

 

 

 

7. I tested pgadmin on clean machine and no issue found

 

OK.

 

 

8. I also tested pgadmin4 if existing vcredist and vm tool is already available, no issue found

 

Yeah, I'm not worried about that case. The reason I mentioned vcredist and VMware Tools was to ensure we were testing without them being there already.

 

 

On Tue, May 25, 2021 at 1:29 PM Dave Page <dpage@pgadmin.org> wrote:

Hi

 

On Fri, May 21, 2021 at 9:25 PM Antoine Aumjaud <antoine_dev@aumjaud.fr> wrote:

Hi,

 

The actual configuration of Inno Setup for the installation of pgAdmin4 requires admin privileges on the computer :

https://github.com/postgres/pgadmin4/blob/master/pkg/win32/installer.iss.in#L31

                                PrivilegesRequired=admin

 

I have read the whole configuration, and I think that this constrain could be remove if HKCU (HKEY_CURENT_USER of Windows registry) is used instead of HKLM (HKEY_LOCAL_MACHINE).

 

The pgAdmin package provided by entreprisedb can be installed without admin rights, but it is an old version of pgAdmin.

 

Do you think that this modification is possible?

I think it's a little more complex than that, but here's a patch that I think does everything required. The only part I'm not sure about is the VC++ runtime installation, and ensuring that will work for non-admins. Fahar; can you test that on a *completely* clean installation of Windows please? You must run the "install only for me" option before anything else (don't even install VMware tools). 

 

There's a test build at https://developer.pgadmin.org/~dpage/non-admin-install/pgadmin4-5.3-x64.exe. Note that it is not signed, so you will get a warning, but that can be ignored for the purposes of this test.

 

--

Dave Page
Blog: https://pgsnake.blogspot.com
Twitter: @pgsnake

EDB: https://www.enterprisedb.com

--

Fahar Abbas

EnterpriseDB Corporation

Phone Office: +92-51-835-8874
Phone Direct: +92-51-8466803
Mobile: +92-333-5409707
Skype ID: live:fahar.abbas
Website: www.enterprisedb.com

 

--

Dave Page
Blog: https://pgsnake.blogspot.com
Twitter: @pgsnake

EDB: https://www.enterprisedb.com

=========================================================

Ce message et toutes les pieces jointes (ci-apres le "message")
sont confidentiels et susceptibles de contenir des informations
couvertes par le secret professionnel. Ce message est etabli
a l'intention exclusive de ses destinataires. Toute utilisation
ou diffusion non autorisee interdite.
Tout message electronique est susceptible d'alteration. La SOCIETE GENERALE
et ses filiales declinent toute responsabilite au titre de ce message
s'il a ete altere, deforme falsifie.

=========================================================

This message and any attachments (the "message") are confidential,
intended solely for the addresses, and may contain legally privileged
information. Any unauthorized use or dissemination is prohibited.
E-mails are susceptible to alteration. Neither SOCIETE GENERALE nor any
of its subsidiaries or affiliates shall be liable for the message
if altered, changed or falsified.

=========================================================

Hi Dave,

On Wed, Jun 9, 2021 at 1:09 PM Dave Page <dpage@pgadmin.org> wrote:

Hi

I'm waiting for Fahar to respond to my previous comments.

I don't see any other issue on Windows new installers. And I agree with all your points.

It would certainly help if you could test the build as well: https://developer.pgadmin.org/~dpage/non-admin-install/pgadmin4-5.3-x64.exe

It would be great  if users also verify the same  installers and users can raise issues accordingly.

On Wed, Jun 9, 2021 at 7:57 AM AUMJAUD Antoine <antoine.aumjaud@socgen.com> wrote:

Hi,

What is the next step for this request?

Thanks a lot,

Antoine

 

From: Dave Page <dpage@pgadmin.org>
Sent: jeudi 27 mai 2021 10:24
To: Fahar Abbas <fahar.abbas@enterprisedb.com>
Cc: Antoine Aumjaud <antoine_dev@aumjaud.fr>; pgAdmin Support <pgadmin-support@postgresql.org>
Subject: Re: Windows installation requires admin rights

 

[EMETTEUR EXTERNE] / [EXTERNAL SENDER]
Soyez vigilant avant d'ouvrir les pièces jointes ou de cliquer sur les liens. En cas de doute, signalez le message via le bouton "Message suspect" ou consultez go/secu.
Be cautious before opening attachments or clicking on any links. If in doubt, use "Suspicious email" button or visit go/secu.

 

Hi

 

On Thu, May 27, 2021 at 8:43 AM Fahar Abbas <fahar.abbas@enterprisedb.com> wrote:

Hi Dave,

 

1. Installer is not signed in yet and you have  already mentioned it.

2.   Findings in Install for me only(recommended) option in case of Admin User:

 

Pgadmin4 installing in the following location:

C:\Users\Administrator\AppData\Local\Programs\pgAdmin 4\v5

 

No issue found  so far with this scenario

 

OK.

 

 

3. Findings in Install for all users option with Admin user:

 

Pgadmin4 installing in the following location:

C:\Program Files\pgAdmin 4\v5

 

No issue found so far with this scenario

 

OK.

 

 

4. Findings in Install for me only(recommended) option in case of non Admin User with double:

 

Pgadmin4 installing in the following location:

C:\Users\Administrator\AppData\Local\Programs\pgAdmin 4\v5

 

No issue found  so far with this scenario

 

If you were logged in as a non-admin user, there's no way it could have installed that way under C:\Users\Administrator\ unless your system is seriously broken. You would not have had sufficient privileges to install into the Administrator's home directory, and the only way the installer could have worked around that is if privileges were elevated for which you would have had to enter a username/password of the Administrator - which wouldn't have been an option with "Install only for me".

 

 

5. Findings in Install for all users option with Non admin user:

 

Pgadmin4 installing in the following location:

C:\Program Files\pgAdmin 4\v5

 

No issue found so far with this scenario

 

OK.

 

 

6. Findings in Install for me only(recommended) option, in case user change the installation directory with non admin user:

 

Login to admin user

 

Pgadmin4 installing in the following location:

C:\Users\Administrator\AppData\Local\Programs\pgAdmin 4\v5

 

But I changed the installation directory before the installation:

C:\Users\rayyan\AppData\Local\Programs\pgAdmin 4\v5

 

Menu item of pgadmin created under Administrator account while the installation is available in C:\Users\rayyan\AppData\Local\Programs\pgAdmin 4\v5

 

I can launch the pgadmin4 under an admin account successfully and in case a non-admin menu item of pgadmin is not present, but I can launch with the pgadmin4 script successfully.

 

Yes, that's what I would expect to happen. The Administrator can install anywhere, including under another user's home directory. The shortcut will always be under the user account of the user that's performing the installation though because you chose "Install for me only".

 

 

 

7. I tested pgadmin on clean machine and no issue found

 

OK.

 

 

8. I also tested pgadmin4 if existing vcredist and vm tool is already available, no issue found

 

Yeah, I'm not worried about that case. The reason I mentioned vcredist and VMware Tools was to ensure we were testing without them being there already.

 

 

On Tue, May 25, 2021 at 1:29 PM Dave Page <dpage@pgadmin.org> wrote:

Hi

 

On Fri, May 21, 2021 at 9:25 PM Antoine Aumjaud <antoine_dev@aumjaud.fr> wrote:

Hi,

 

The actual configuration of Inno Setup for the installation of pgAdmin4 requires admin privileges on the computer :

https://github.com/postgres/pgadmin4/blob/master/pkg/win32/installer.iss.in#L31

                                PrivilegesRequired=admin

 

I have read the whole configuration, and I think that this constrain could be remove if HKCU (HKEY_CURENT_USER of Windows registry) is used instead of HKLM (HKEY_LOCAL_MACHINE).

 

The pgAdmin package provided by entreprisedb can be installed without admin rights, but it is an old version of pgAdmin.

 

Do you think that this modification is possible?

I think it's a little more complex than that, but here's a patch that I think does everything required. The only part I'm not sure about is the VC++ runtime installation, and ensuring that will work for non-admins. Fahar; can you test that on a *completely* clean installation of Windows please? You must run the "install only for me" option before anything else (don't even install VMware tools). 

 

There's a test build at https://developer.pgadmin.org/~dpage/non-admin-install/pgadmin4-5.3-x64.exe. Note that it is not signed, so you will get a warning, but that can be ignored for the purposes of this test.

 

--

Dave Page
Blog: https://pgsnake.blogspot.com
Twitter: @pgsnake

EDB: https://www.enterprisedb.com

--

Fahar Abbas

EnterpriseDB Corporation

Phone Office: +92-51-835-8874
Phone Direct: +92-51-8466803
Mobile: +92-333-5409707
Skype ID: live:fahar.abbas
Website: www.enterprisedb.com

 

--

Dave Page
Blog: https://pgsnake.blogspot.com
Twitter: @pgsnake

EDB: https://www.enterprisedb.com

=========================================================

Ce message et toutes les pieces jointes (ci-apres le "message")
sont confidentiels et susceptibles de contenir des informations
couvertes par le secret professionnel. Ce message est etabli
a l'intention exclusive de ses destinataires. Toute utilisation
ou diffusion non autorisee interdite.
Tout message electronique est susceptible d'alteration. La SOCIETE GENERALE
et ses filiales declinent toute responsabilite au titre de ce message
s'il a ete altere, deforme falsifie.

=========================================================

This message and any attachments (the "message") are confidential,
intended solely for the addresses, and may contain legally privileged
information. Any unauthorized use or dissemination is prohibited.
E-mails are susceptible to alteration. Neither SOCIETE GENERALE nor any
of its subsidiaries or affiliates shall be liable for the message
if altered, changed or falsified.

=========================================================

--

Dave Page
Blog: https://pgsnake.blogspot.com
Twitter: @pgsnake

EDB: https://www.enterprisedb.com

--

Fahar Abbas

EnterpriseDB Corporation

Phone Office: +92-51-835-8874
Phone Direct: +92-51-8466803
Mobile: +92-333-5409707
Skype ID: live:fahar.abbas
Website: www.enterprisedb.com