[BUGFIX] Adjust config file path in Install Tool password hint

The file `settings.php`, which stores the value of
$GLOBALS['TYPO3_CONF_VARS']['BE']['installToolPassword'] is
located under `config/system/` in Composer-mode. If a project
is not set up with composer it is `typo3conf/system/`.

The hint next to the Install Tool's login mask spells the wrong
path, which is corrected with this patch. Also the difference
between legacy and composer setups is taken into account, without
exposing information about the projects file structure.

Resolves: #102166
Releases: main, 12.4
Change-Id: I5b2313516c1af9623a9c8de8f1dca7bb46fb8ce0
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81425


Reviewed-by: Jan Greth <jan@greth.me>
Tested-by: core-ci <typo3@b13.com>
Reviewed-by: Nikita Hovratov <nikita.h@live.de>
Tested-by: Garvin Hicking <gh@faktor-e.de>
Reviewed-by: Garvin Hicking <gh@faktor-e.de>
Tested-by: Jan Greth <jan@greth.me>
Reviewed-by: Markus Klein <markus.klein@typo3.org>
Tested-by: Nikita Hovratov <nikita.h@live.de>

typo3/sysext/install/Classes/Controller/LoginController.php

@@ -19,6 +19,7 @@ namespace TYPO3\CMS\Install\Controller;
 
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
+use TYPO3\CMS\Core\Configuration\ConfigurationManager;
 use TYPO3\CMS\Core\Core\Environment;
 use TYPO3\CMS\Core\FormProtection\FormProtectionFactory;
 use TYPO3\CMS\Core\Http\JsonResponse;
@@ -31,7 +32,8 @@ use TYPO3\CMS\Install\Service\EnableFileService;
 class LoginController extends AbstractController
 {
     public function __construct(
-        private readonly FormProtectionFactory $formProtectionFactory
+        private readonly FormProtectionFactory $formProtectionFactory,
+        private readonly ConfigurationManager $configurationManager,
     ) {
     }
 
@@ -60,6 +62,7 @@ class LoginController extends AbstractController
             'siteName' => $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'],
             'loginToken' => $formProtection->generateToken('installTool', 'login'),
             'installToolEnableFilePermanent' => EnableFileService::isInstallToolEnableFilePermanent(),
+            'configFile' => $this->configurationManager->getSystemConfigurationFileLocation(true),
         ]);
         return new JsonResponse([
             'success' => true,

typo3/sysext/install/Classes/ServiceProvider.php

@@ -292,7 +292,8 @@ class ServiceProvider extends AbstractServiceProvider
     public static function getLoginController(ContainerInterface $container): Controller\LoginController
     {
         return new Controller\LoginController(
-            $container->get(FormProtectionFactory::class)
+            $container->get(FormProtectionFactory::class),
+            $container->get(ConfigurationManager::class),
         );
     }
 

typo3/sysext/install/Resources/Private/Templates/Login/ShowLogin.html

@@ -52,7 +52,7 @@
                 <div class="callout-title">Important</div>
                 <div class="callout-body">
                     If you don't know the current password, you can set a new one by setting the value of
-                    <code>$GLOBALS['TYPO3_CONF_VARS']['BE']['installToolPassword']</code> in <code>typo3conf/system/settings.php</code> to
+                    <code>$GLOBALS['TYPO3_CONF_VARS']['BE']['installToolPassword']</code> in <code>{configFile}</code> to
                     the hash value of the password you desire, which will be shown if you enter the desired password
                     in this form and submit it.
                     <br /><br />