Bug #66763 [Sus]: always_populate_raw_post_data=0 BC issue with in-built web server

Edit report at https://bugs.php.net/bug.php?id=66763&edit=1 ID: 66763 Updated by: tyrael@php.net Reported by: sixd@php.net Summary: always_populate_raw_post_data=0 BC issue with in-built web server Status: Suspended Type: Bug Package: Built-in web server Operating System: Linux PHP Version: 5.6Git-2014-02-24 (Git) Assigned To: tyrael Block user comment: N Private report: N New Comment: and ofc. feel free to escalate this issue (drop a mail to internals@) if you think that it would require a bigger audience than those following this bugreport. Previous Comments: ------------------------------------------------------------------------ [2014-10-21 12:56:49] tyrael@php.net "The message only mentions $HTTP_RAW_POST_DATA and does not mention MIME type. Maybe the error message could explain that the MIME type used is relevant to the warning being raised if applicable?" I disagree. The current error message tells you the problem ($HTTP_RAW_POST_DATA is deprecated, and will be gone in a future version), and how to remove the warning (always_populate_raw_post_data=-1) and what should you use instead of $HTTP_RAW_POST_DATA(php://input). I don't think it would be a good idea to start documenting the various ways which can trigger the population of the $HTTP_RAW_POST_DATA variable in the error message, you can check out the online documentation for that. I do agree, that the current way for triggering the deprecated message is a bit sub-optimal (we don't show you the message when you try to access the $HTTP_RAW_POST_DATA variable, but when $HTTP_RAW_POST_DATA is populated. This is a technical limitation which we can't really help ($HTTP_RAW_POST_DATA is not a super global, but a normal global variable, so adding a check which emits the warning when a global variable accessed with this name would slow down every access to any global variable), "Likely from my experience even more people will be surprised when the BC is broken in PHP 5.6 because of un-documented MIME types (and possibly other codepaths) that throw a "headers already sent" error. Breaking BC with a not so useful error message that mentions a feature that is not used and not found in most codebases." I disagree. 1, We don't consider adding new warnings/notices/deprecated messages BC breaks, because those shouldn't affect your production code (running with display_errors=On in production is a bad practice). 2, Having a clear error message which also tells you how to fix the problem is a much better thing than changing the default behavior causing some random error in your app about $HTTP_RAW_POST_DATA being undefined. "Ideally PHP should not break BC in this way, because PHP should not require users to have access to their php.ini to fix default PHP 5.6 config. As a popular PHP app maker we would still kindly request to consider setting this to -1. " As I mentioned we don't consider deprecated error messages as BC breaks (even thought that it is a sad truth that some/many people do use display_errors=On in production). I'm hesitant to change the default value to -1 in a micro version, as it would change the default behavior and we would start getting the complaints about $HTTP_RAW_POST_DATA not getting populated, because many/most people depending on this variable does not explicitly specified always_populate_raw_post_data in their php.ini either. "dozens of people online with this issue and already 4-5 hours on our end spent understanding this. We are PHP experts.... imagine what normal PHP users will go through. Thanks for considering :-)" imo a normal user would just either change this in the php.ini or complain to their hoster/developer to fix the issue after upgrading their php installation. I think that most of the confusion will be cleared after the documentation gets updated to exmplain the situation. ------------------------------------------------------------------------ [2014-10-21 04:01:58] matt at piwik dot org > always_populate_raw_post_data=0 does not mean, that $HTTP_RAW_POST_DATA won't be > populated, it only means, that it will be only populated when a supported MIME type is present. The message only mentions $HTTP_RAW_POST_DATA and does not mention MIME type. Maybe the error message could explain that the MIME type used is relevant to the warning being raised if applicable? > won't be surprised when the support for it is dropped in a future version. Likely from my experience even more people will be surprised when the BC is broken in PHP 5.6 because of un-documented MIME types (and possibly other codepaths) that throw a "headers already sent" error. Breaking BC with a not so useful error message that mentions a feature that is not used and not found in most codebases. Asking confirmation: maybe the error is also thrown because we use 'php://input' ? if that's the case could the error message be updated to mention that both HTTP_RAW_POST_DATA and php://input and MIME types cause the warning to be raised? Ideally PHP should not break BC in this way, because PHP should not require users to have access to their php.ini to fix default PHP 5.6 config. As a popular PHP app maker we would still kindly request to consider setting this to -1. PS: dozens of people online with this issue and already 4-5 hours on our end spent understanding this. We are PHP experts.... imagine what normal PHP users will go through. Thanks for considering :-) ------------------------------------------------------------------------ [2014-10-20 12:56:30] tyrael@php.net "Currently the message implies that we are using $HTTP_RAW_POST_DATA but actually it's not used." you are potentially using the $HTTP_RAW_POST_DATA if you have anything but always_populate_raw_post_data=-1 in your config. always_populate_raw_post_data=0 does not mean, that $HTTP_RAW_POST_DATA won't be populated, it only means, that it will be only populated when a supported MIME type is present. as I've stated in my recent email(http://news.php.net/php.internals/78156) unfortunatelly it isn't possible (in an acceptable manner) to detect if your code actually touches the $HTTP_RAW_POST_DATA variable, but we still wanted to add a deprecated notice so people can start moving away from $HTTP_RAW_POST_DATA and won't be surprised when the support for it is dropped in a future version. As I mentioned in my email, I'm planning to better explain the situation in the online documentation/migration guide. ------------------------------------------------------------------------ [2014-10-19 22:40:15] matt at piwik dot org Currently the message implies that we are using $HTTP_RAW_POST_DATA but actually it's not used. Maybe it would be worth updating the error message to explain that the setting should be set to -1 even in cases where $HTTP_RAW_POST_DATA is not used? Or maybe you could only show the Warning when $HTTP_RAW_POST_DATA is used? Looking online a lot of people have a problem that this warning is output by default in 5.6 configuration and this seems to confuse many users including advanced PHP users. Also we noticed that always_populate_raw_post_data cannot be set with ini_set(), it must be set in php.ini which requires admin access to the server. Reference: issue on Piwik project https://github.com/piwik/piwik/issues/6465 ------------------------------------------------------------------------ [2014-04-18 16:57:41] mike@php.net Sorry, no offense intended! :) I doubt it classifies as a *real* BC break because a production server should probably not output any warning, I agree though, that it might pop up in development, and that, as far as I am concerned, is a very good thing. I really appreciate that Ferenc made it possible to bring this enhancement into 5.6 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=66763 -- Edit this bug report at https://bugs.php.net/bug.php?id=66763&edit=1