Bug #73099 [Opn]: if php.ini is incorrect, php-fpm starts with default values
Edit report at https://bugs.php.net/bug.php?id=73099&edit=1
ID: 73099
User updated by: selivan5 at yandex dot ru
Reported by: selivan5 at yandex dot ru
Summary: if php.ini is incorrect, php-fpm starts with default
values
Status: Open
Type: Bug
Package: *Configuration Issues
Operating System: Ubuntu 14.04 trusty
PHP Version: 7.0.11
Block user comment: N
Private report: N
New Comment:
Also I reported this bug in Ubuntu: https://bugs.launchpad.net/ubuntu/+source/php7.0/+bug/1623540
Ubuntu guys confirmed it (status: Triaged).
Previous Comments:
------------------------------------------------------------------------
[2016-09-16 10:58:27] selivan5 at yandex dot ru
Description:
------------
If php.ini syntax is incorrect and it can not be loaded, php-fpm starts with default values.
This can lead to functional and security problems. For example, "post_max_size" becomes
8m, breaking uploading of large files. "disable_functions", used to restrict potentially
dangerous functions, becomes empty. "display_errors" is 1 and visitors will see a full
stacktrace on error pages.
Test script:
---------------
php-fpm.conf:
[global]
pid = /run/php/php7.0-fpm.pid
error_log = /var/log/php7.0-fpm.log
include=/etc/php/7.0/fpm/pool.d/*.conf
pool.d/www.conf:
[www]
php_admin_value[error_reporting] = E_ALL & ~E_NOTICE
user = www-data
group = www-data
listen = /run/php/php7.0-fpm.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660
php.ini:
# This comment breaks ini file (it starts with hash and parenthsis are used)
expose_php = Off
Now start it:
root@xenial:~# /usr/sbin/php-fpm7.0 --fpm-config /etc/php/7.0/fpm/php-fpm.conf --php-ini
/etc/php/7.0/fpm/php.ini
PHP: syntax error, unexpected '(' in /etc/php/7.0/fpm/php.ini on line 6
[14-Sep-2016 14:24:46] NOTICE: configuration file /etc/php/7.0/fpm/php-fpm.conf test is successful
It noticed an error, but started anyway. Run phpinfo() - you will see, that expose_php is
"ON"
Expected result:
----------------
If php.ini is incorrect, php-fpm should fail with error.
Actual result:
--------------
If php.ini is incorrect, php-fpm starts using default values.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=73099&edit=1
Thread (3 messages)