Direct upgrade from 2.9.2 to 2.9.3 is not available

[pvasilevich]

Describe the bug

The following MSI error appeared when trying to upgrade one version of ModSecurity to another:
"Another version of this product is already installed. Installation of this version cannot continue. To configure or remove the existing version of this product, use Add/Remove Programs on the Control Panel."
Looks like ModSecurity need to be uninstalled, server rebooted and then new version of ModSecurity installed again. This looks unacceptable for production server.

Logs and dumps

Attached verbose MSI log prepared by execution of the following command line:
msiexec /i ModSecurityIIS_2.9.3-64b.msi /l*v c:\modsecurity-2.9.3-install.log ADDLOCAL=ALL ALLUSERS=1 REBOOT=R

modsecurity-2.9.3-install.log

To Reproduce

Steps to reproduce the behavior:

1. Install ModSecurity 2.9.2 64b IIS. Installed OK.
2. Download installer for version 2.9.3, trying to install new version by launching new downloaded MSI file.

Expected behavior

ModSecurity upgraded to 2.9.3 version.

Server (please complete the following information):

• ModSecurity version: 2.9.2 to 2.9.3
• WebServer: IIS
• OS (and distro): Windows 2012R2

Rule Set (please complete the following information):
n/a

Additional context

[pvasilevich]

Looks like the issue cause by this line:
https://github.com/SpiderLabs/ModSecurity/blob/v2/master/iis/installer.wxs#L10

<Product Id="22B04FDB-9BAB-46B0-87B8-A39544ECECD3" Name="ModSecurity IIS" Language="1033" Version="2.9.1" Manufacturer="ModSecurity" UpgradeCode="82F09489-1678-4C38-ADCB-08C3757653DB">

You have hardcoded UpgradeCode here, this is good, it shouldn't be changed in a whole line of product. However, hardcoding Product ID means that in fact ModSecurity 2.9.3 technically is the same product as 2.9.2 and 2.9.1.

In general it can be handled by dynamically generated product code (just remove this attribute), and then implement RemoveExistingProducts action during upgrade (to perform removal of previous product having the same upgrade code).

p.s. old version number 2.9.1 hardcoded here. This shouldn't be critical, however it is visible in log file.

[victorhora]

Thanks for your report @pvasilevich :)

https://github.com/SpiderLabs/ModSecurity/blob/v2/master/iis/installer.wxs#L10

Your input here makes sense to me. I can regenerate a test version of the installer to check that the issue doesn't happen anymore with this changeset.

But I would suggest that you can submit a pull request to fix this issue and have your name as contributor. How does that sound? :)

[martinhsv]

This was indeed an issue with v2.9.2 and v2.9.3 where the version update in that file was omitted (it still said 2.9.1 in both of those later versions).

However, it has been properly updated since then (in both v2.9.4 and v2.9.5), so I don't think there's value in keeping this item open any longer.