auto_prepend_file value changing by itself, so post values sometimes appear on the page

[imcagri]

Description

Hello,
I'm using PHP Version 8.3.13 with Docker(php:8.3.13-fpm)
First I thought problem was coming from alpine linux(php:8.3.13-fpm-alpine). Then i deleted it used debian based image. But result is same.

auto_prepend_file sometimes no-value sometimes php://input

When i want to login to my website, sometimes submit values showing on top of the page. Not only login. Every post forms.

Dockerfile
`FROM php:8.3.13-fpm

RUN apt-get update && apt-get install -y --no-install-recommends
libintl-perl
libicu-dev
libzip-dev
libonig-dev
libpng-dev
zip
unzip
libwebp-dev
libjpeg-dev
libfreetype6-dev
curl
autoconf
g++
imagemagick
libmagickwand-dev
libtool
make
libpcre3-dev
file
pkg-config
git &&
docker-php-ext-install pdo_mysql exif bcmath mysqli zip &&
docker-php-ext-install -j$(nproc) intl mbstring &&
docker-php-ext-configure gd --with-freetype --with-jpeg &&
docker-php-ext-install gd

RUN git clone https://github.com/Imagick/imagick.git /usr/src/php/ext/imagick &&
cd /usr/src/php/ext/imagick &&
phpize &&
./configure &&
make &&
make install &&
docker-php-ext-enable imagick

RUN apt-get purge -y --auto-remove
autoconf
g++
libtool
make
libpcre3-dev
git

COPY --from=composer:latest /usr/bin/composer /usr/local/bin/composer

COPY ./certs/elasticsearch/elastic/elastic.crt /etc/ssl/certs
RUN echo "cacert = /etc/ssl/certs/elastic.crt" >> ~/.curlrc

CMD ["php-fpm"]`

The following code:

<?php

Resulted in this output:

But I expected this output instead:

PHP Version

PHP 8.3.13

Operating System

Debian

[damianwadley]

Is the php-fpm port exposed to the internet?

[imcagri]

services:
nginx:
container_name: nginx
restart: always
build:
context: .
dockerfile: ./config/nginx/Dockerfile
ports:
- 80:80
- 443:443
volumes:
- ./www/x.com:/var/www
- ./config/nginx/ssl:/etc/ssl
- ./config/nginx/default.conf:/etc/nginx/conf.d/default.conf
- ./logs/nginx:/var/log/nginx
networks:
- cargo_network

php:
container_name: php
restart: always
build:
context: .
dockerfile: ./config/php/Dockerfile
ports:
- 9000:9000
volumes:
- ./www/x.com:/var/www
- ./config/php/php.ini:/usr/local/etc/php/php.ini
- ./config/php/www.conf:/usr/local/etc/php-fpm.d/www.conf
- ./certs/elasticsearch/ca/ca.crt:/etc/ssl/certs/elastic.crt
networks:
- cargo_network

[damianwadley]

Okay. Is the php-fpm port exposed to the internet?

[imcagri]

Actually now, yes exposed to internet. But apparently no need to internet. Only nginx must access it.

[damianwadley]

Not only is there no need, it's actually very bad if it is accessible. In fact, you should assume that your site has been compromised, so take whatever steps are necessary to respond to that.

After you rebuild your server, don't expose php-fpm's ports. There's no need for a ports: configuration as that's only for host-to-container port mappings; nginx will be able to talk to php-fpm just fine with the php:9000 name because they're on the same Docker network.

[imcagri]

Ok. you're right. Thanks for suggestion. I've commented them.
After I restarted docker container.
But my problem still continues

php:
container_name: php
restart: always
build:
context: .
dockerfile: ./config/php/Dockerfile
#ports:
#- 9000:9000
volumes:

• ./www/x.com:/var/www
• ./config/php/php.ini:/usr/local/etc/php/php.ini
• ./config/php/www.conf:/usr/local/etc/php-fpm.d/www.conf
• ./certs/elasticsearch/ca/ca.crt:/etc/ssl/certs/elastic.crt
  networks:
• cargo_network

[damianwadley]

That was quick. Did you check your website and/or configuration files for tampering?

The safest thing you can do is wipe everything and set the server up again from scratch.