shadowdaoandClaude Opus 5
da16faaff5
A site moved from cac-fpm to cac-lsphp must see byte-identical $_SERVER['DOCUMENT_ROOT'] and ['SCRIPT_FILENAME'] (/home/<user>/...). The auto_prepend_file normaliser that did this was PHP_INI_PERDIR, so any site with its own .user.ini auto_prepend_file silently displaced it — the state 7 live shared_ols sites (Wordfence, cPanel imports) are actually in. Hardening the hook was not an option either: making our prepend win would have disabled those Wordfence WAFs. Replace it with cac_path_parity, a small PHP extension that rewrites the filesystem-path $_SERVER keys from RINIT. RINIT cannot be displaced by .user.ini, and it occupies no userland hook, so the customer's own auto_prepend_file stays the only prepend in play and keeps working. The mapping lives in two PHP_INI_SYSTEM settings, which .user.ini (PERDIR / USER only) and ini_set() cannot reach. Mechanism is a path-component-bounded string prefix swap, not realpath(): byte-identical to cac-fpm by construction (realpath would resolve a customer's own symlinked public_html to some third path), no syscall, and no failure path. Every guard fails open and leaves $_SERVER untouched; nothing here can warn, throw or 500 a site. Unconfigured it is fully inert, so cac-fpm and cac-litespeed are unaffected. Built in a separate Dockerfile stage keyed off the existing ARG PHPVER — gcc/phpize/headers never reach the shipped image (verified absent; the image grows ~155kB), and a base-image PHP bump recompiles with no human step. A `lsphp -i | grep` assertion fails the build if the .so does not load, so an image can never ship having silently lost parity. The entrypoint selects the extension when present and removes any stale prepend ini left by an older image; if the extension is somehow not loadable it falls back to the old normaliser and logs a WARNING rather than losing normalisation entirely. It also now logs the active parity mode, and warns when lsphp reports no ini scan dir (previously silent). Probe lsphp with `-i` only: it is the LSAPI SAPI, not the CLI, and answers `-m`/`-r` by printing usage and exiting 0 — a `lsphp -m | grep` check never matches and never errors, which is the exact class of silent always-false assertion this change exists to remove. Verified: 6 .phpt tests; tests/fpm-parity-check.sh proves under the FPM SAPI that with a customer .user.ini auto_prepend_file present both keys are still corrected AND the customer's prepend still runs, and that the old mechanism does not; and in a real built cac-lsphp:php83 container that SCRIPT_FILENAME is rewritten, the customer prepend still fires, and another tenant's path is left untouched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
21 lines
633 B
PHP
21 lines
633 B
PHP
--TEST--
|
|
cac_path_parity: works with auto_globals_jit=On (lazy $_SERVER, the default)
|
|
--EXTENSIONS--
|
|
cac_path_parity
|
|
--INI--
|
|
auto_globals_jit=1
|
|
cac_path_parity.from=/mnt/users/bob/site.com
|
|
cac_path_parity.to=/home/bob
|
|
variables_order=EGPCS
|
|
--ENV--
|
|
CONTEXT_DOCUMENT_ROOT=/mnt/users/bob/site.com/public_html
|
|
--FILE--
|
|
<?php
|
|
// With auto_globals_jit=On, $_SERVER does not exist yet when extension RINIT
|
|
// runs. The extension forces the auto-global so there is something to rewrite;
|
|
// drop that call and this test prints the /mnt/users path.
|
|
var_dump($_SERVER['CONTEXT_DOCUMENT_ROOT']);
|
|
?>
|
|
--EXPECT--
|
|
string(21) "/home/bob/public_html"
|