diff --git a/admin/win/msi/CMakeLists.txt b/admin/win/msi/CMakeLists.txt
index 933037dac1..26385a88b3 100644
--- a/admin/win/msi/CMakeLists.txt
+++ b/admin/win/msi/CMakeLists.txt
@@ -25,6 +25,7 @@ install(FILES
${CMAKE_CURRENT_BINARY_DIR}/OEM.wxi
${CMAKE_CURRENT_BINARY_DIR}/collect-transform.xsl
${CMAKE_CURRENT_BINARY_DIR}/make-msi.bat
+ EnsureACL.js
Platform.wxi
Nextcloud.wxs
${CMAKE_CURRENT_BINARY_DIR}/RegistryCleanup.vbs
diff --git a/admin/win/msi/EnsureACL.js b/admin/win/msi/EnsureACL.js
new file mode 100644
index 0000000000..f6929e7413
--- /dev/null
+++ b/admin/win/msi/EnsureACL.js
@@ -0,0 +1,44 @@
+// writes a message to the MSI logs
+function logInfo(message) {
+ var record = Session.Installer.CreateRecord(0);
+ record.stringData(0) = message
+ // 0x40000000 = msiMessageTypeUser -- see https://learn.microsoft.com/en-gb/windows/win32/msi/session-message#parameters
+ Session.Message(0x04000000, record)
+}
+
+function EnsureACL() {
+ var shell = new ActiveXObject("WScript.Shell");
+ var fs = new ActiveXObject("Scripting.FileSystemObject");
+
+ var programFilesPath = fs.GetAbsolutePathName(shell.ExpandEnvironmentStrings("%PROGRAMFILES%"));
+ var installPath = fs.GetAbsolutePathName(Session.Property("CustomActionData"));
+
+ logInfo("programFilesPath: " + programFilesPath + "\r\n" + "installPath: " + installPath);
+
+ if (installPath.toLowerCase().indexOf(programFilesPath.toLowerCase()) == 0) {
+ // no need to adapt ACLs when installing to C:/Program Files
+ return 0;
+ }
+
+ // using SIDs here (prefixed by *) to avoid potential issues with non-English installs
+ // see also: https://learn.microsoft.com/en-us/windows/win32/secauthz/well-known-sids
+ var grants = [
+ "*S-1-5-32-544:(OI)(CI)F", // DOMAIN_ALIAS_RID_ADMINS => full access
+ "*S-1-5-18:(OI)(CI)F", // SECURITY_LOCAL_SYSTEM_RID => full access
+ "*S-1-5-32-545:(OI)(CI)RX" // DOMAIN_ALIAS_RID_USERS => read, execute
+ ];
+ var grantsOptions = "";
+ for (var i = 0; i < grants.length; i++) {
+ grantsOptions += ' /grant "' + grants[i] + '" ';
+ }
+
+ var icaclsCommand = 'icacls.exe "' + installPath + '" /inheritance:r ' + grantsOptions;
+ logInfo("Command: " + icaclsCommand);
+ var retval = shell.Run(icaclsCommand, 0, true);
+ if (retval != 0) {
+ logInfo("Return code: " + retval);
+ return 1603; // fatal error
+ }
+
+ return 0;
+}
diff --git a/admin/win/msi/Nextcloud.wxs b/admin/win/msi/Nextcloud.wxs
index c14cbe0306..38ea1632a0 100644
--- a/admin/win/msi/Nextcloud.wxs
+++ b/admin/win/msi/Nextcloud.wxs
@@ -57,8 +57,8 @@
-
-
+
+
@@ -71,22 +71,30 @@
+
+
+
+
+
NSIS_UNINSTALLEXE AND NOT Installed
+
+ NOT Installed
+
(NOT UPGRADINGPRODUCTCODE) AND (REMOVE="ALL")
-
-
- (NOT UPGRADINGPRODUCTCODE) AND (REMOVE="ALL")
+
+
+ (NOT UPGRADINGPRODUCTCODE) AND (REMOVE="ALL")
(SCHEDULE_REBOOT=1) OR NOT (UILevel=2)
- $(var.AppName)
+ $(var.AppName)
$(var.AppIcon)
$(var.AppHelpLink)
$(var.AppInfoLink)
@@ -192,11 +200,11 @@
-
+
-
+
@@ -214,7 +222,7 @@
-
+