Repository navigation
Conversation
…8.4 and 8.5 configs session.sid_length and session.sid_bits_per_character are deprecated as of PHP 8.4: setting either one raises an E_DEPRECATED at startup whenever error_reporting includes E_DEPRECATED. PHP's own php.ini-production for 8.4 and later no longer sets them. Remove both directives and their quick-reference entries from php/php.ini in php84.zip and php85.zip. These archives are what `ee site update --php=<version>` installs, so a site switched to 8.4 or 8.5 no longer gets the deprecated settings. Only that entry changes; every other entry is byte-identical. Newly created session IDs fall back to PHP's defaults, 32 characters of 0-9a-f instead of 26 characters of 0-9a-v. IDs issued before the change are still accepted.
Contributor
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.
…d 8.5 sites A site's php.ini is copied from the PHP image when the site is created and from the version's archive when its PHP version is switched, so existing PHP 8.4 and 8.5 sites keep session.sid_length and session.sid_bits_per_character even with the fixed images and archives. This container migration gives them the same php.ini a new site gets. It handles php and wp sites on PHP 8.4, 8.5 or `latest` (which runs the php8.4 image), enabled or not. In config/php/php/php.ini it removes every active session.sid_length and session.sid_bits_per_character line, plus the comments shipped right above them and the matching quick reference entry, but only where those comments match the shipped text. Every other line, custom.ini and the other config files stay as they are. A php.ini EasyEngine shipped ends up byte-identical to the one in the archives, and a file that has neither directive is left alone, so running it again changes nothing. Values other than the shipped 26 and 5 are removed too, with a warning naming the site, the removed line and the backup. Both settings are deprecated as of PHP 8.4 and go away in PHP 9, and php.ini is replaced wholesale on every PHP version switch anyway, so custom.ini is the only place where overrides survive. Keeping an edited value would leave the site with the deprecation and out of step with a switched site. The previous file is saved as .backup/<site>/php.ini.with-session-sid-settings, and the new file keeps its mode and owner and only replaces the old one once fully written. PHP-FPM reads php.ini only when it starts, so the php container of an enabled site gets the same graceful reload `ee site reload --php` uses (USR2 to FPM) if it's running; stopped or disabled sites pick the file up when they start, and no container is recreated. down() puts the saved files back and reloads FPM again, so a failure later in the upgrade restores the old state. A site that can't be migrated only gets a warning, so it doesn't block the upgrade of the others.
The PHP config archive is picked by the version a site is switched to (`php<version without dots>.zip`), and `ee site update --php` only accepts 5.6 to 8.5, so `latest` never selects it. A site created with `--php=latest` runs the php8.4 image and gets its config from that image, and switching such a site to another version uses the target version's archive. Nothing else in site-command, core, site-type-wp or site-type-php refers to it. It also still carried the session ID settings deprecated as of PHP 8.4.
The site's php container can write to the directory that holds php.ini (www-data owns it after a PHP version switch), so it could plant a symlink at the predictable php.ini.ee-tmp path and have the upgrade write, chmod and chown a host file through it. The file is now opened once, checked through the open handle to be the same regular, singly linked file as the path (no symlink swapped in after the check, no hard link to another file), and read, written and truncated through that handle. No other path is created or followed, and mode and owner stay as they are. The removal only shortens the file, so writing over it needs no new space; if the write fails anyway, the old content is written back. The backup is written from the content that was read, and down() restores through the same checks.
The directory that holds php.ini is root-owned by default: a PHP version switch makes only conf.d owned by www-data, not the php directory itself. It is still mounted into the site's php container, which is why the rewrite trusts no path in it.
…5 configs Add `session.upload_progress.enabled = Off` to php/php.ini in php81.zip through php85.zip, right after the commented-out default, the same two lines EasyEngine/dockerfiles#374 adds to the 8.1 to 8.5 images. These archives are what `ee site update --php=<version>` installs, so a site switched to one of these versions gets the same php.ini as a site created on it. A site's custom.ini is read after php.ini and still wins, so `session.upload_progress.enabled = On` there turns it back on. The 5.6 to 8.0 archives stay as they are: their images are not rebuilt and keep PHP's default, and the archives mirror the image's php.ini. Every site's custom.ini already sets Off since v4.13.3. Only the php/php.ini entry changes; every other entry is byte-identical.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
session.sid_lengthandsession.sid_bits_per_character(and their quick-reference entries) fromphp/php.iniinsidetemplates/config/php-fpm/php84.zipandphp85.zip. Companion to fix(php): drop deprecated session ID ini settings from 8.4 and 8.5 dockerfiles#372, which makes the same change in the php8.4 and php8.5 images.templates/config/php-fpm/phplatest.zip, which nothing can select.session.upload_progress.enabled = Offtophp/php.iniinphp81.zipthroughphp85.zip, at the same spot fix(php): turn off session upload progress by default dockerfiles#374 adds it to the 8.1 to 8.5 images.Why
Both settings are deprecated as of PHP 8.4 and raise an
E_DEPRECATEDat startup (PHP Startup: session.sid_length INI setting is deprecated), visible inphp -i,php-fpm -tand the FPM log whenevererror_reportingincludesE_DEPRECATEDat the ini level. PHP's ownphp.ini-productionfor 8.4 and later no longer sets them.These archives are what
ee site update --php=<version>extracts into the site's PHP config, so today a site switched to 8.4 or 8.5 gets the deprecated settings back even once the images are fixed. A site's PHP config is copied from its image only when the site is created, and from the archive only on a PHP version switch, so existing sites keep the settings without a migration.Migration for existing sites
migrations/container/20261023193000_site-command_drop_deprecated_session_sid_settings.php:latest(which runs the php8.4 image), enabled or disabled. Other versions are not touched: the settings are valid there and their archives keep them.config/php/php/php.iniit removes every activesession.sid_length/session.sid_bits_per_characterline, plus the comments shipped right above them and the quick-reference entry, but only where those comments match the shipped text. Every other line,custom.iniand the rest of the config stay as they are. A php.ini as EasyEngine shipped it becomes byte-identical to the one in the new archives apart from the twosession.upload_progress.enabledlines below, which come with the images from fix(php): turn off session upload progress by default dockerfiles#374 (every site'scustom.inialready sets Off since v4.13.3); a file without the directives is left alone, so it is idempotent.26/5is removed too, with a warning naming the site, the removed line and the backup. The settings are deprecated and go away in PHP 9, and php.ini is replaced wholesale on every PHP version switch anyway, so overrides only last incustom.ini..backup/<site>/php.ini.with-session-sid-settings. php.ini is rewritten in place through one handle, checked to be the regular, singly linked file at that path, because the site's php container can write to that directory after a PHP switch: no temp file or other path is created or followed, and mode, owner and inode stay.ee site reload --phpuses (USR2). No container is recreated or restarted; stopped and disabled sites pick the file up when they start.down()restores the saved files and reloads FPM, so core reverts it when a later upgrade step fails. A site that can't be migrated only gets a warning, so it does not block the others.Behaviour change
For PHP 8.4 and 8.5 sites (switched, or migrated), new session IDs fall back to PHP's defaults: 32 characters of
0-9a-f(128 bits) instead of 26 characters of0-9a-v(130 bits). IDs issued before are still accepted.Session upload progress Off in the 8.1 to 8.5 archives
EasyEngine/dockerfiles#374 turns
session.upload_progress.enabledOff by default in the 8.1 to 8.5 images'php.ini, right after the commented-out default, with the comment; Off by default for security; a site's custom.ini can set it to On.The archives get the same two lines at the same spot, so a site switched withee site update --phpgets the php.ini a site created on that version gets.custom.iniis read afterphp.iniand is copied back on a switch, sosession.upload_progress.enabled = Onthere still wins.The 5.6 to 8.0 archives stay as they are: the archives mirror the images'
php.ini, and those images are not rebuilt and keep PHP's default. Their sites get Off fromcustom.ini, as every site has since v4.13.3.Archive contents
Only the
php/php.inientry changes in each archive; every other entry (data, timestamps, permissions, extra fields, order) is byte-identical, checked on the raw local headers and data. Before/after diff of the extracted trees: one file per archive.php84.zip,php85.zip: the 26 session ID lines removed and the two upload-progress lines added; the newphp/php.iniis byte-identical to the 8.4/8.5 one from fix(php): drop deprecated session ID ini settings from 8.4 and 8.5 dockerfiles#372 plus Make the code compatible with PHP 7.4 #374.php81.ziptophp83.zip: the two upload-progress lines added; the newphp/php.iniis byte-identical to the one from fix(php): turn off session upload progress by default dockerfiles#374.The rebuilt entry has a fixed timestamp and the same attributes and extra fields as before, so rebuilding gives the same bytes.
phplatest.zip
The archive is picked by the version a site is switched to (
php<version without dots>.zip), andee site update --phponly accepts 5.6 to 8.5, so--php=latestis rejected before anything changes. A site created with--php=latestruns the php8.4 image and gets its config from the image; switching it to another version uses that version's archive. Nothing in site-command, core, site-type-wp or site-type-php refers tophplatest.zip.Testing
On fresh runners with core
develop:ee site update --php, with the line removed fromcustom.iniso FPM shows whatphp.inisets: a site created on 8.3, and one switch to 8.2 with thedeveloparchive, report On; switches to 8.1, 8.2, 8.4, 8.5 and back to 8.3 with this branch's archives each have the line inphp.iniand FPM reports Off, with no startup warning or deprecation and no session ID lines on 8.4/8.5; withsession.upload_progress.enabled = Onadded tocustom.ini, FPM reports On, also after another switchee site update --phpwith this branch's archives: 8.3 → 8.4 with thedeveloparchive shows both deprecations and 26-character IDs; → 8.5 → 8.4 with the new archives gives no sid lines, no deprecation, 32-character hex IDs from FPM, andcustom.inipreserveddevelopon 8.4 (php), 8.5 (wp), 8.3 (control),latest, 8.4 disabled, 8.4 with a user-editedsession.sid_length = 48, and 8.3 switched to 8.4 with thedeveloparchive; then this branch with the version bumped:latestphp.ini byte-identical to the new archive's, mode, owner and inode kept, backup present, and aphp.ini.ee-tmpsymlink planted by the site's php container (as www-data) doesn't touch its target; the 8.3 site untouched;custom.iniunchanged everywhere (itsmax_input_varsstill effective)StartedAt),php-fpm -tshows no deprecation, the disabled site does once enabledee site update --php=latestis rejected and leaves the site unchangeddown()