Skip to content

Fix GH-8157: post_max_size evaluates .user.ini too late in php-fpm #19333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Fix GH-8157: post_max_size evaluates .user.ini too late in php-fpm #19333

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions main/SAPI.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -458,6 +458,10 @@ SAPI_API void sapi_activate(void)
SG(request_parse_body_context).throw_exceptions = false;
memset(&SG(request_parse_body_context).options_cache, 0, sizeof(SG(request_parse_body_context).options_cache));

if (sapi_module.pre_request_init) {
sapi_module.pre_request_init();
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Return value not checked?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is same as activate - also not checked and always return SUCCESS. I think it still makes sense to keep the return codes in case we decided to change the meaning and somehow fail but it's not necessary atm.

}

/* Handle request method */
if (SG(server_context)) {
if (PG(enable_post_data_reading)
Expand Down
5 changes: 4 additions & 1 deletion main/SAPI.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,6 +290,8 @@ struct _sapi_module_struct {
const char *ini_entries;
const zend_function_entry *additional_functions;
unsigned int (*input_filter_init)(void);

int (*pre_request_init)(void); /* called before activate and before the post data read - used for .user.ini */
};

struct _sapi_post_entry {
Expand Down Expand Up @@ -340,6 +342,7 @@ END_EXTERN_C()
0, /* phpinfo_as_text; */ \
NULL, /* ini_entries; */ \
NULL, /* additional_functions */ \
NULL /* input_filter_init */
NULL, /* input_filter_init */ \
NULL /* pre_request_init */

#endif /* SAPI_H */
8 changes: 7 additions & 1 deletion sapi/fpm/fpm/fpm_main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -702,7 +702,7 @@ static void php_cgi_ini_activate_user_config(char *path, int path_len, const cha
}
/* }}} */

static int sapi_cgi_activate(void) /* {{{ */
static int sapi_cgi_pre_request_init(void)
{
fcgi_request *request = (fcgi_request*) SG(server_context);
char *path, *doc_root, *server_name;
Expand Down Expand Up @@ -766,6 +766,11 @@ static int sapi_cgi_activate(void) /* {{{ */

return SUCCESS;
}

static int sapi_cgi_activate(void) /* {{{ */
{
return SUCCESS;
}
/* }}} */

static int sapi_cgi_deactivate(void) /* {{{ */
Expand Down Expand Up @@ -1600,6 +1605,7 @@ int main(int argc, char *argv[])
sapi_startup(&cgi_sapi_module);
cgi_sapi_module.php_ini_path_override = NULL;
cgi_sapi_module.php_ini_ignore_cwd = 1;
cgi_sapi_module.pre_request_init = sapi_cgi_pre_request_init;

#ifndef HAVE_ATTRIBUTE_WEAK
fcgi_set_logger(fpm_fcgi_log);
Expand Down
58 changes: 58 additions & 0 deletions sapi/fpm/tests/gh8157-user-ini-post.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
--TEST--
FPM: gh8157 - post related INI settings not applied for .user.ini
--SKIPIF--
<?php include "skipif.inc"; ?>
--FILE--
<?php

require_once "tester.inc";

$cfg = <<<EOT
[global]
error_log = {{FILE:LOG}}
[unconfined]
listen = {{ADDR}}
pm = dynamic
pm.max_children = 5
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 3
EOT;

$code = <<<EOT
<?php
var_dump(\$_POST);
EOT;

$ini = <<<EOT
post_max_size=10K
html_errors=off
EOT;

$tester = new FPM\Tester($cfg, $code);
$tester->setUserIni($ini);
$tester->start();
$tester->expectLogStartNotices();
$tester
->request(
headers: [ 'CONTENT_TYPE' => 'application/x-www-form-urlencoded'],
stdin: 'foo=' . str_repeat('a', 20000),
method: 'POST',
)
->expectBody([
'Warning: PHP Request Startup: POST Content-Length of 20004 bytes exceeds the limit of 10240 bytes in Unknown on line 0',
'array(0) {',
'}',
], skipHeadersCheck: true);
$tester->terminate();
$tester->close();

?>
Done
--EXPECT--
Done
--CLEAN--
<?php
require_once "tester.inc";
FPM\Tester::clean();
?>
5 changes: 3 additions & 2 deletions sapi/fpm/tests/response.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,18 +119,19 @@ class Response extends BaseResponse
/**
* @param mixed $body
* @param string $contentType
* @param bool $skipHeadersCheck
*
* @return Response
*/
public function expectBody($body, $contentType = 'text/html')
public function expectBody($body, $contentType = 'text/html', bool $skipHeadersCheck = false)
{
if ($multiLine = is_array($body)) {
$body = implode("\n", $body);
}

if ( ! $this->checkIfValid()) {
$this->error('Response is invalid');
} elseif ( ! $this->checkDefaultHeaders($contentType)) {
} elseif ( ! $skipHeadersCheck && ! $this->checkDefaultHeaders($contentType)) {
$this->error('Response default headers not found');
} elseif ($body !== $this->rawBody) {
if ($multiLine) {
Expand Down