Encourage users to remove/protect install.php

Problem/Motivation

On multi-site it is common to not have the default website installed.
If someone can access the Drupal instance via a domain that does not correspond to any installed site, they will be able to run install.php and install the default site.
This is a known problem and we have a PSA that advises site admins to protect against this: https://www.drupal.org/PSA-2015-001

It is also quite common these days to install sites with Drush. If you do this, you don't need install.php at all and it just becomes a liability.

There are several ways to harden this :

• Restrict access to install.php in your server config
• Configure file permissions so that the web server user can't create a settings.php file
• Remove install.php (with core-vendor-hardening : https://www.drupal.org/node/3424527)

But none of these are provided or suggested by Drupal and they require site admins to actively think about fixing this.

Steps to reproduce

1. Have a wildcard domain (*.example.com) that points to your server.
2. Install a site named foo on foo.example.com.
   With something like this in sites.php:

   $sites['foo.example.com'] = 'foo';
   

3. If someone browses to bar.example.com, they are able to install the default site.

Proposed resolution

Maybe a solution could be :

1. Provide an easy and reversible way to disable install.php.
2. Add a warning to status report if install.php is not disabled.
3. Instruct users to re-enable it if they need to install a new site, then disable it afterwards.

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet