Bug: Setup wizard permanently locks out after creating first user, before company/localization steps are done

[arwicked]

Bug: Setup wizard permanently locks out after creating first user, before company/localization steps are done

Summary

Immediately after the "create first user" step in setup/index.php, the wizard closes itself
($config_enable_setup = 0) even though the company and localization steps have not been
completed yet. This leaves the install in a broken state: /setup refuses to continue, and
/login.php cannot fully log the user in because companies/settings data doesn't exist yet.
The two pages redirect back and forth indefinitely (ERR_TOO_MANY_REDIRECTS /
"page isn't redirecting properly").

Reproduced on a completely fresh Debian install using the official install script
(itflow_install.sh), with selfsigned SSL, PHP 8.4, Apache 2.4.68, MariaDB.

Steps to reproduce

1. Fresh install via itflow_install.sh (any SSL option).
2. Go to /setup, complete the DB step (already pre-filled by installer).
3. Fill in "Create first user" and submit.
4. Browser is redirected in an infinite loop between /setup and /login.php, before ever
   reaching the "create company" step.

Root cause

In setup/index.php (top of file, before the add_user/add_company handlers):

if (file_exists("../config.php") && $mysqli_available) {
    $table_result = mysqli_query($mysqli, "SHOW TABLES LIKE 'users'");
    if ($table_result && mysqli_num_rows($table_result) > 0) {
        $should_skip_to_user = true;
        $user_count_result = mysqli_query($mysqli, "SELECT COUNT(*) AS user_count FROM users");
        if ($user_count_result) {
            $user_count_row = mysqli_fetch_assoc($user_count_result);
            if (intval($user_count_row['user_count']) > 0) {
                $install_is_live = true;   // <-- fires as soon as ANY user exists
            }
        }
        ...
    }
}

if (!isset($config_enable_setup)) {
    $config_enable_setup = $install_is_live ? 0 : 1;   // <-- setup closes here
}

$install_is_live is set to true based only on the existence of a user row — it does not
check whether companies has been populated yet. As soon as the first user is created, the
very next request to /setup sees $install_is_live = true and appends
$config_enable_setup = 0 to config.php, permanently disabling the wizard for that install.
Since the company step never runs, login.php also can't complete a normal login (missing
company/settings data), and the two pages end up redirecting to each other.

Secondary bug (same file, add_user handler)

$user_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT COUNT(*) FROM users"));
if ($user_count < 0) {

SELECT COUNT(*) always returns exactly one row (containing the count value), so
mysqli_num_rows() on it is always 1, never the actual number of users. The condition
$user_count < 0 can never be true — this check is dead code and never actually prevents a
duplicate user-creation submission. (A duplicate submission separately causes an uncaught
mysqli_sql_exception: Duplicate entry '1' for key 'PRIMARY' fatal error, since the first
user is hardcoded to user_id = 1 rather than relying on auto-increment.)

Expected behavior

The wizard should only consider the install "live" (and close setup) once all required
setup steps — user, company, and localization — have completed successfully, not just the
first one.

Suggested fix

Gate $install_is_live on the existence of a companies row (or a proper "setup complete"
flag written only at the very end of the wizard), not just on users having rows. Also fix
the add_user duplicate-submission check to use the actual row count
($user_count_row['user_count']) rather than mysqli_num_rows() on a COUNT(*) query.

Workaround used

Manually inserted the company/localization/seed data directly via a PHP CLI script that reuses
the app's own functions.php / seed_data.php logic, after the user step had already silently
closed setup. Not something a typical user could be expected to do.

[github-actions]

Hello & Welcome! :)

Thanks for taking the time to get in touch.

We ask that all bugs/feature/support requests are raised via the forum. We'll be in touch shortly to confirm.

[johnnyq]

Hey @arwicked thanks for reporting this, this was missed during release since we mainly use the setup_cli but we pushed out a fix to our develop branch here 656aa95
Could you please test again thanks

[arwicked]

Hey @arwicked thanks for reporting this, this was missed during release since we mainly use the setup_cli but we pushed out a fix to our develop branch here 656aa95 Could you please test again thanks

Hey, just to confirm, I have just tested the develop branch and it worked like a charm

[johnnyq]

@arwicked thats fantastic thanks for being the second eyes on this. We will more than likely release another patch today to fix this. thanks again