diff --git a/lib/private/App/AppManager.php b/lib/private/App/AppManager.php
index ef5d3d92ad44..0138a51e7aad 100644
--- a/lib/private/App/AppManager.php
+++ b/lib/private/App/AppManager.php
@@ -58,25 +58,18 @@ class AppManager implements IAppManager {
 
 	/** @var \OCP\IUserSession */
 	private $userSession;
-
 	/** @var \OCP\IAppConfig */
 	private $appConfig;
-
 	/** @var \OCP\IGroupManager */
 	private $groupManager;
-
 	/** @var \OCP\ICacheFactory */
 	private $memCacheFactory;
-
 	/** @var string[] $appId => $enabled */
 	private $installedAppsCache;
-
 	/** @var string[] */
 	private $shippedApps;
-
 	/** @var string[] */
 	private $alwaysEnabled;
-
 	/** @var EventDispatcherInterface */
 	private $dispatcher;
 
@@ -212,6 +205,7 @@ public function isInstalled($appId) {
 	 * Enable an app for every user
 	 *
 	 * @param string $appId
+	 * @throws \Exception
 	 */
 	public function enableApp($appId) {
 		if(OC_App::getAppPath($appId) === false) {
@@ -430,4 +424,18 @@ public function readAppPackage($path) {
 		Files::rmdirr($appCodeDir);
 		return $appInfo;
 	}
+
+	/**
+	 * Indicates if app installation is supported. Usually it is but in certain
+	 * environments it is disallowed because of hardening. In a clustered setup
+	 * apps need to be installed on each cluster node which is out of scope of
+	 * ownCloud itself.
+	 *
+	 * @return bool
+	 * @since 10.0.3
+	 */
+	public function canInstall() {
+		$appsFolder = OC_App::getInstallPath();
+		return $appsFolder !== null && is_writable($appsFolder) && is_readable($appsFolder);
+	}
 }
diff --git a/lib/private/Installer.php b/lib/private/Installer.php
index 368025a59ad5..c804d33ac3c2 100644
--- a/lib/private/Installer.php
+++ b/lib/private/Installer.php
@@ -91,7 +91,12 @@ public static function installApp( $data = []) {
 
 		$info = self::checkAppsIntegrity($data, $extractDir, $path);
 		$appId = OC_App::cleanAppId($info['id']);
-		$basedir = OC_App::getInstallPath().'/'.$appId;
+		$appsFolder = OC_App::getInstallPath();
+
+		if ($appsFolder === null || !is_writable($appsFolder)) {
+			throw new \Exception('Apps folder is not writable');
+		}
+		$basedir = "$appsFolder/$appId";
 		//check if the destination directory already exists
 		if(is_dir($basedir)) {
 			OC_Helper::rmdirr($extractDir);
diff --git a/lib/private/legacy/app.php b/lib/private/legacy/app.php
index 0fc76439fcab..2f4493e4e3e3 100644
--- a/lib/private/legacy/app.php
+++ b/lib/private/legacy/app.php
@@ -1001,7 +1001,7 @@ private static function adjustVersionParts($version1, $version2) {
 	 * This means that it's possible to specify "requiremin" => 6
 	 * and "requiremax" => 6 and it will still match ownCloud 6.0.3.
 	 *
-	 * @param string $ocVersion ownCloud version to check against
+	 * @param string|array $ocVersion ownCloud version to check against
 	 * @param array $appInfo app info (from xml)
 	 *
 	 * @return boolean true if compatible, otherwise false
diff --git a/lib/public/App/IAppManager.php b/lib/public/App/IAppManager.php
index b6d64aa4d920..dbe20308ccbd 100644
--- a/lib/public/App/IAppManager.php
+++ b/lib/public/App/IAppManager.php
@@ -156,4 +156,14 @@ public function getAllApps();
 	 */
 	public function readAppPackage($path);
 
+	/**
+	 * Indicates if app installation is supported. Usually it is but in certain
+	 * environments it is disallowed because of hardening. In a clustered setup
+	 * apps need to be installed on each cluster node which is out of scope of
+	 * ownCloud itself.
+	 *
+	 * @return bool
+	 * @since 10.0.3
+	 */
+	public function canInstall();
 }