From afa4eb79f3c00e1f82220c8a198b05f9471d3ab6 Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Fri, 23 Oct 2026 19:32:46 +0530
Subject: [PATCH 01/14] fix(restore): keep session upload progress off after
 restoring an older backup

A restore copies custom.ini and php.ini from the backup over the site's files. A backup taken before v4.13.3 has neither the session.upload_progress.enabled = Off line that v4.13.3 added to custom.ini nor a php.ini that sets it, so the restored site ran with upload progress back On, PHP's default.

After restoring the PHP config, add the line again at the top of custom.ini unless the restored file already sets the directive outside a [PATH=] or [HOST=] section, so an explicit On or Off is kept, as in the v4.13.3 migrations. The site reload at the end of the restore applies it.

The check that finds those sections now lets PHP's ini parser decide what each header line is. Before, a header was only recognised when it was unquoted and LF-terminated, so in a CRLF file, or with a quoted name like ["PATH=/x"], a setting inside the section was taken as a global one and the line was not added.
---
 src/helper/Site_Backup_Restore.php | 48 ++++++++++++++++
 src/helper/site-utils.php          | 89 ++++++++++++++++++++++++++++++
 2 files changed, 137 insertions(+)

diff --git a/src/helper/Site_Backup_Restore.php b/src/helper/Site_Backup_Restore.php
index d2620cc4..f4de8bc4 100644
--- a/src/helper/Site_Backup_Restore.php
+++ b/src/helper/Site_Backup_Restore.php
@@ -1693,6 +1693,54 @@ private function restore_php_conf( $backup_dir ) {
 			$restore_command = sprintf( 'rsync -a %s/php/php/conf.d/custom.ini %s/config/php/php/conf.d/custom.ini', $backup_dir, EE_ROOT_DIR . '/sites/' . $this->site_data['site_url'] );
 			EE::exec( $restore_command );
 		}
+
+		$this->keep_session_upload_progress_off();
+	}
+
+	/**
+	 * A backup taken before v4.13.3 brings back a custom.ini without `session.upload_progress.enabled = Off`, so add it
+	 * again unless the restored file sets the directive itself. The site reload at the end of the restore applies it.
+	 */
+	private function keep_session_upload_progress_off() {
+		$site_url = $this->site_data['site_url'];
+		$conf_dir = EE_ROOT_DIR . '/sites/' . $site_url . '/config/php/php/conf.d';
+		$file     = $conf_dir . '/custom.ini';
+		$manual   = "Add 'session.upload_progress.enabled = Off' to $file and run: ee site reload $site_url";
+
+		$created = ! file_exists( $file ) && ! is_link( $file );
+		if ( is_link( $file ) || ( ! $created && ! is_file( $file ) ) || ( $created && ! is_dir( $conf_dir ) ) ) {
+			EE::warning( "Could not check session.upload_progress in the restored custom.ini: it is not a regular file or its directory is missing. $manual" );
+
+			return;
+		}
+
+		$content = $created ? '' : @file_get_contents( $file );
+		if ( false === $content ) {
+			EE::warning( "Could not read the restored custom.ini to check session.upload_progress. $manual" );
+
+			return;
+		}
+
+		$new_content = \EE\Site\Utils\add_session_upload_progress_off( $content );
+		if ( null === $new_content ) {
+			return;
+		}
+
+		// Written in place: keeps owner, mode and inode (macOS bind-mounts this single file).
+		$written = @file_put_contents( $file, $new_content );
+		clearstatcache( true, $file );
+		if ( strlen( $new_content ) !== $written ) {
+			EE::warning( "Could not turn off session.upload_progress in the restored custom.ini. $manual" );
+
+			return;
+		}
+		if ( $created ) {
+			@chmod( $file, 0644 );
+			@chown( $file, fileowner( $conf_dir ) );
+			@chgrp( $file, filegroup( $conf_dir ) );
+		}
+
+		EE::log( 'The restored custom.ini did not set session.upload_progress.enabled, so it was set to Off again. Set it to On there only if your app needs it.' );
 	}
 
 	/**
diff --git a/src/helper/site-utils.php b/src/helper/site-utils.php
index a4766b19..09d0fb40 100644
--- a/src/helper/site-utils.php
+++ b/src/helper/site-utils.php
@@ -1623,3 +1623,92 @@ function get_wp_core_download_command( string $path, array $args = [] ) {
 	// docker_compose_exec() wraps the command in bash -c "...".
 	return addcslashes( $script, '"$`\\' );
 }
+
+/**
+ * Add `session.upload_progress.enabled = Off` to a site's custom.ini content, unless the content already sets it globally.
+ *
+ * Same rule as the v4.13.3 upload-progress migrations: an effective global line, On or Off, is the user's choice and is kept.
+ *
+ * @param string $content custom.ini content.
+ *
+ * @return string|null The new content, or null when it already sets the directive.
+ */
+function add_session_upload_progress_off( string $content ) {
+
+	$bom = '';
+	if ( 0 === strpos( $content, "\xEF\xBB\xBF" ) ) {
+		$bom     = "\xEF\xBB\xBF";
+		$content = substr( $content, 3 );
+	}
+
+	if ( ini_sets_globally( $content, 'session.upload_progress.enabled' ) ) {
+		return null;
+	}
+
+	$eol   = false !== strpos( $content, "\r\n" ) ? "\r\n" : "\n";
+	$lines = '; Session upload progress is off for security; set it to On only if your app needs it.' . $eol . 'session.upload_progress.enabled = Off' . $eol;
+
+	if ( '' === trim( $content ) ) {
+		return $bom . $lines;
+	}
+
+	// At the very top, so neither a [PATH=]/[HOST=] section nor a multi-line quoted value can capture it.
+	return $bom . $lines . $eol . $content;
+}
+
+/**
+ * Whether ini content sets a directive outside any [PATH=]/[HOST=] section, read the way PHP reads php.ini.
+ *
+ * @param string $content ini content without BOM.
+ * @param string $key     Directive name (case-sensitive, like PHP).
+ *
+ * @return bool
+ */
+function ini_sets_globally( string $content, string $key ) {
+
+	$global = ini_global_part( $content );
+	$ini    = @parse_ini_string( $global, true, INI_SCANNER_NORMAL );
+	// PHP applies the lines above a syntax error, so only that part counts.
+	for ( $lines = preg_split( '/(?<=\n)/', $global ), $n = count( $lines ) - 1; false === $ini && $n > 0; $n-- ) {
+		$ini = @parse_ini_string( implode( '', array_slice( $lines, 0, $n ) ), true, INI_SCANNER_NORMAL );
+	}
+	if ( false === $ini ) {
+		return false;
+	}
+
+	foreach ( $ini as $name => $value ) {
+		if ( is_array( $value ) ? array_key_exists( $key, $value ) : $key === $name ) {
+			return true;
+		}
+	}
+
+	return false;
+}
+
+/**
+ * The part of ini content before the first section whose name starts with PATH or HOST.
+ *
+ * PHP scopes every entry after such a header to it, even under later ordinary headers. The parser decides what a header's
+ * name is, so CRLF line endings and quoted names like ["PATH=/x"] are handled the way PHP handles them.
+ *
+ * @param string $content ini content without BOM.
+ *
+ * @return string
+ */
+function ini_global_part( string $content ) {
+
+	if ( ! preg_match_all( '/^[ \t]*\[/m', $content, $matches, PREG_OFFSET_CAPTURE ) ) {
+		return $content;
+	}
+
+	foreach ( $matches[0] as $match ) {
+		$eol = strpos( $content, "\n", $match[1] );
+		// Text inside a multi-line quoted value doesn't parse as the last section.
+		$ini = @parse_ini_string( false === $eol ? $content : substr( $content, 0, $eol ), true, INI_SCANNER_NORMAL );
+		if ( false !== $ini && is_array( end( $ini ) ) && preg_match( '/^(PATH|HOST)/i', (string) key( $ini ) ) ) {
+			return substr( $content, 0, $match[1] );
+		}
+	}
+
+	return $content;
+}

From 671cf81fe6a1ea29e26c8764871f6509bb1583a4 Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Fri, 23 Oct 2026 20:15:35 +0530
Subject: [PATCH 02/14] fix(restore): find PATH and HOST sections with any
 header layout

Find the start of a [PATH=]/[HOST=] section by letting PHP's ini parser read up to every '[' and ']' instead of only at the start of an LF-separated line. A header after a CR-only line ending, a second header on the same line as in [PATH=/x][Session], and a quoted name that contains a newline or ']' are now found, so a setting inside such a section no longer counts as global.

Read the part before such a section without sections, so an array entry like custom_flags[session.upload_progress.enabled] = Off isn't taken for the directive. A CR-only file gets CR line endings for the added lines.
---
 src/helper/site-utils.php | 49 ++++++++++++++++++---------------------
 1 file changed, 23 insertions(+), 26 deletions(-)

diff --git a/src/helper/site-utils.php b/src/helper/site-utils.php
index 09d0fb40..a23f13a9 100644
--- a/src/helper/site-utils.php
+++ b/src/helper/site-utils.php
@@ -1645,7 +1645,7 @@ function add_session_upload_progress_off( string $content ) {
 		return null;
 	}
 
-	$eol   = false !== strpos( $content, "\r\n" ) ? "\r\n" : "\n";
+	$eol = false !== strpos( $content, "\r\n" ) ? "\r\n" : ( false === strpos( $content, "\n" ) && false !== strpos( $content, "\r" ) ? "\r" : "\n" );
 	$lines = '; Session upload progress is off for security; set it to On only if your app needs it.' . $eol . 'session.upload_progress.enabled = Off' . $eol;
 
 	if ( '' === trim( $content ) ) {
@@ -1667,29 +1667,21 @@ function add_session_upload_progress_off( string $content ) {
 function ini_sets_globally( string $content, string $key ) {
 
 	$global = ini_global_part( $content );
-	$ini    = @parse_ini_string( $global, true, INI_SCANNER_NORMAL );
+	// Without sections, entries of ordinary sections are global and `foo[key] = x` stays an array, so it can't match.
+	$ini = @parse_ini_string( $global, false, INI_SCANNER_NORMAL );
 	// PHP applies the lines above a syntax error, so only that part counts.
-	for ( $lines = preg_split( '/(?<=\n)/', $global ), $n = count( $lines ) - 1; false === $ini && $n > 0; $n-- ) {
-		$ini = @parse_ini_string( implode( '', array_slice( $lines, 0, $n ) ), true, INI_SCANNER_NORMAL );
-	}
-	if ( false === $ini ) {
-		return false;
+	for ( $lines = preg_split( '/(?<=\n)|(?<=\r)(?!\n)/', $global ), $n = count( $lines ) - 1; false === $ini && $n > 0; $n-- ) {
+		$ini = @parse_ini_string( implode( '', array_slice( $lines, 0, $n ) ), false, INI_SCANNER_NORMAL );
 	}
 
-	foreach ( $ini as $name => $value ) {
-		if ( is_array( $value ) ? array_key_exists( $key, $value ) : $key === $name ) {
-			return true;
-		}
-	}
-
-	return false;
+	return false !== $ini && array_key_exists( $key, $ini ) && ! is_array( $ini[ $key ] );
 }
 
 /**
  * The part of ini content before the first section whose name starts with PATH or HOST.
  *
- * PHP scopes every entry after such a header to it, even under later ordinary headers. The parser decides what a header's
- * name is, so CRLF line endings and quoted names like ["PATH=/x"] are handled the way PHP handles them.
+ * PHP scopes every entry after such a header to it, even under later ordinary headers. The parser decides where each
+ * header ends and what it is called, so any line ending, quoted names and several headers on one line are handled.
  *
  * @param string $content ini content without BOM.
  *
@@ -1697,16 +1689,21 @@ function ini_sets_globally( string $content, string $key ) {
  */
 function ini_global_part( string $content ) {
 
-	if ( ! preg_match_all( '/^[ \t]*\[/m', $content, $matches, PREG_OFFSET_CAPTURE ) ) {
-		return $content;
-	}
-
-	foreach ( $matches[0] as $match ) {
-		$eol = strpos( $content, "\n", $match[1] );
-		// Text inside a multi-line quoted value doesn't parse as the last section.
-		$ini = @parse_ini_string( false === $eol ? $content : substr( $content, 0, $eol ), true, INI_SCANNER_NORMAL );
-		if ( false !== $ini && is_array( end( $ini ) ) && preg_match( '/^(PATH|HOST)/i', (string) key( $ini ) ) ) {
-			return substr( $content, 0, $match[1] );
+	for ( $open = strpos( $content, '[' ); false !== $open; $open = strpos( $content, '[', $open + 1 ) ) {
+		// A '[' inside a quoted value (or after a syntax error, where PHP stops anyway) starts no header.
+		if ( false === @parse_ini_string( substr( $content, 0, $open ), true, INI_SCANNER_NORMAL ) ) {
+			continue;
+		}
+		// A quoted name may contain ']', so try each one until the text up to it parses.
+		for ( $close = strpos( $content, ']', $open ); false !== $close; $close = strpos( $content, ']', $close + 1 ) ) {
+			$ini = @parse_ini_string( substr( $content, 0, $close + 1 ), true, INI_SCANNER_NORMAL );
+			if ( false === $ini ) {
+				continue;
+			}
+			if ( is_array( end( $ini ) ) && preg_match( '/^(PATH|HOST)/i', (string) key( $ini ) ) ) {
+				return substr( $content, 0, $open );
+			}
+			break;
 		}
 	}
 

From b1792c36661ae30e5c8c155961f6cf44e8dd3317 Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Fri, 23 Oct 2026 20:31:57 +0530
Subject: [PATCH 03/14] fix(restore): name each section header from the header
 itself

A section that reuses the name of an earlier global key replaces that key in place, so the last entry of the parsed array isn't the header just read. Name the header by parsing it alone, and count it only when it adds that section, which still leaves header-like text in a comment alone.
---
 src/helper/site-utils.php | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/helper/site-utils.php b/src/helper/site-utils.php
index a23f13a9..e90fe01e 100644
--- a/src/helper/site-utils.php
+++ b/src/helper/site-utils.php
@@ -1691,7 +1691,8 @@ function ini_global_part( string $content ) {
 
 	for ( $open = strpos( $content, '[' ); false !== $open; $open = strpos( $content, '[', $open + 1 ) ) {
 		// A '[' inside a quoted value (or after a syntax error, where PHP stops anyway) starts no header.
-		if ( false === @parse_ini_string( substr( $content, 0, $open ), true, INI_SCANNER_NORMAL ) ) {
+		$before = @parse_ini_string( substr( $content, 0, $open ), true, INI_SCANNER_NORMAL );
+		if ( false === $before ) {
 			continue;
 		}
 		// A quoted name may contain ']', so try each one until the text up to it parses.
@@ -1700,7 +1701,11 @@ function ini_global_part( string $content ) {
 			if ( false === $ini ) {
 				continue;
 			}
-			if ( is_array( end( $ini ) ) && preg_match( '/^(PATH|HOST)/i', (string) key( $ini ) ) ) {
+			// Named from the header alone: a section replacing an earlier key of the same name keeps that key's position.
+			$header = @parse_ini_string( substr( $content, $open, $close - $open + 1 ), true, INI_SCANNER_NORMAL );
+			$name   = is_array( $header ) && 1 === count( $header ) ? (string) key( $header ) : '';
+			// In a comment the text parses as a header alone but adds no section.
+			if ( preg_match( '/^(PATH|HOST)/i', $name ) && is_array( $ini[ $name ] ?? null ) && ! is_array( $before[ $name ] ?? null ) ) {
 				return substr( $content, 0, $open );
 			}
 			break;

From 5e0b969821ffceca0581dd8ba461ad7586cd8a35 Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Fri, 23 Oct 2026 20:44:46 +0530
Subject: [PATCH 04/14] fix(restore): detect section headers where the parser
 expects an entry

Decide whether a '[' starts a section header by checking that the ini parser takes an entry at that point, instead of comparing the parsed array before and after the header. An earlier global array or key with the same name as a [PATH=] section no longer hides it, and header-like text in a comment, a value or an array key still doesn't count.
---
 src/helper/site-utils.php | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/src/helper/site-utils.php b/src/helper/site-utils.php
index e90fe01e..c16a7383 100644
--- a/src/helper/site-utils.php
+++ b/src/helper/site-utils.php
@@ -1689,23 +1689,22 @@ function ini_sets_globally( string $content, string $key ) {
  */
 function ini_global_part( string $content ) {
 
+	$probe = '__ee_ini_probe_' . md5( $content );
 	for ( $open = strpos( $content, '[' ); false !== $open; $open = strpos( $content, '[', $open + 1 ) ) {
-		// A '[' inside a quoted value (or after a syntax error, where PHP stops anyway) starts no header.
-		$before = @parse_ini_string( substr( $content, 0, $open ), true, INI_SCANNER_NORMAL );
-		if ( false === $before ) {
+		// Only where the parser expects a new entry can '[' start a header: not in a quoted value, a comment or a value.
+		$probed = @parse_ini_string( substr( $content, 0, $open ) . $probe . ' = 1', true, INI_SCANNER_NORMAL );
+		if ( false === $probed || ! array_key_exists( $probe, $probed ) && ! array_filter( $probed, function ( $entry ) use ( $probe ) {
+			return is_array( $entry ) && array_key_exists( $probe, $entry );
+		} ) ) {
 			continue;
 		}
 		// A quoted name may contain ']', so try each one until the text up to it parses.
 		for ( $close = strpos( $content, ']', $open ); false !== $close; $close = strpos( $content, ']', $close + 1 ) ) {
-			$ini = @parse_ini_string( substr( $content, 0, $close + 1 ), true, INI_SCANNER_NORMAL );
-			if ( false === $ini ) {
+			if ( false === @parse_ini_string( substr( $content, 0, $close + 1 ), true, INI_SCANNER_NORMAL ) ) {
 				continue;
 			}
-			// Named from the header alone: a section replacing an earlier key of the same name keeps that key's position.
 			$header = @parse_ini_string( substr( $content, $open, $close - $open + 1 ), true, INI_SCANNER_NORMAL );
-			$name   = is_array( $header ) && 1 === count( $header ) ? (string) key( $header ) : '';
-			// In a comment the text parses as a header alone but adds no section.
-			if ( preg_match( '/^(PATH|HOST)/i', $name ) && is_array( $ini[ $name ] ?? null ) && ! is_array( $before[ $name ] ?? null ) ) {
+			if ( is_array( $header ) && 1 === count( $header ) && preg_match( '/^(PATH|HOST)/i', (string) key( $header ) ) ) {
 				return substr( $content, 0, $open );
 			}
 			break;

From 987a58f058fe8a4919f92a5432ab99b53ba193d4 Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Fri, 23 Oct 2026 23:19:28 +0530
Subject: [PATCH 05/14] fix(migrations): turn off session upload progress where
 the v4.13.3 check missed it

The v4.13.3 migrations of site-type-wp and site-type-php added `session.upload_progress.enabled = Off` to every custom.ini that didn't already set it globally, but their check took a setting inside a [PATH=] or [HOST=] section for a global one when the section header was quoted, shared its line with another header, was named like an earlier key, or ended with CRLF or CR, and it also counted an array entry keyed by the directive. Those sites still run with PHP's default On.

Add a container migration, ordered after those, that checks the custom.ini of every WordPress and PHP site again with the parser from the restore fix and adds the same lines at the top where the directive still isn't set globally, creating the file when it is missing. A global On or Off is kept; a global On is logged. A site that already has the line is left alone, so a second run changes nothing.

Each changed file is backed up under .backup/session-upload-progress-recheck-<time>/ and written in place, keeping owner, mode and inode. down() restores the files byte for byte. Running php containers of enabled sites get the same graceful FPM reload as in the v4.13.3 migrations, after the image migration and only when the container wasn't recreated. A failure on one site is a warning and its file is restored; the other sites go on.

ini_global_value() returns the value next to ini_sets_globally(), so the migration can tell an explicit On from an Off.
---
 ...ommand_recheck_session_upload_progress.php | 358 ++++++++++++++++++
 src/helper/site-utils.php                     |  15 +-
 2 files changed, 372 insertions(+), 1 deletion(-)
 create mode 100644 migrations/container/20261023233000_site-command_recheck_session_upload_progress.php

diff --git a/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php b/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
new file mode 100644
index 00000000..c63b8d73
--- /dev/null
+++ b/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
@@ -0,0 +1,358 @@
+<?php
+
+namespace EE\Migration;
+
+use EE;
+use EE\Model\Site;
+use function EE\Site\Utils\add_session_upload_progress_off;
+use function EE\Site\Utils\ini_global_value;
+use function EE\Site\Utils\ini_sets_globally;
+
+/**
+ * Checks the custom.ini of every WordPress and PHP site again and turns off session.upload_progress where it is still not set globally.
+ *
+ * The v4.13.3 migrations took a setting inside a [PATH=]/[HOST=] section for a global one when the section header was quoted, shared its
+ * line with another header, or ended with CRLF or CR, and an array entry keyed by the directive too, so those sites kept PHP's default On.
+ * A global On or Off is the user's choice and is kept. Disabled sites pick it up on their next start.
+ */
+class RecheckSessionUploadProgress extends Base {
+
+	const SITE_TYPES = [ 'wp', 'php' ];
+
+	const DIRECTIVE = 'session.upload_progress.enabled';
+
+	/** @var Site[] */
+	private $sites = [];
+
+	/** @var array site_url => [ 'site' => Site, 'file' => string, 'backup' => string|null ] for every custom.ini changed by up(). */
+	private $changed = [];
+
+	/** @var array site_url => php container ID seen by up(), for running sites. */
+	private $containers = [];
+
+	/** @var string|null */
+	private $backup_root;
+
+	public function __construct() {
+
+		parent::__construct();
+		if ( $this->is_first_execution ) {
+			$this->skip_this_migration = true;
+
+			return;
+		}
+
+		$this->sites = array_filter(
+			Site::all() ?: [],
+			function ( $site ) {
+				return in_array( $site->site_type, self::SITE_TYPES, true );
+			}
+		);
+		if ( empty( $this->sites ) ) {
+			$this->skip_this_migration = true;
+		}
+	}
+
+	/**
+	 * Add the setting to every custom.ini that doesn't set it globally.
+	 */
+	public function up() {
+
+		if ( $this->skip_this_migration ) {
+			EE::debug( 'Skipping recheck-session-upload-progress migration as it is not needed.' );
+
+			return;
+		}
+
+		$this->backup_root = EE_BACKUP_DIR . '/session-upload-progress-recheck-' . date( 'Ymd-His' );
+		if ( file_exists( $this->backup_root ) ) {
+			$this->backup_root .= '-' . getmypid();
+		}
+
+		foreach ( $this->sites as $site ) {
+			// One broken site must not block the upgrade of the others.
+			try {
+				$this->update_site( $site );
+			} catch ( \Throwable $e ) {
+				if ( isset( $this->changed[ $site->site_url ] ) ) {
+					$this->restore_file( $site->site_url );
+				}
+				unset( $this->containers[ $site->site_url ] );
+				EE::warning( "Could not check session.upload_progress in the custom.ini of $site->site_url: {$e->getMessage()}" );
+			}
+		}
+
+		if ( empty( $this->changed ) ) {
+			$this->remove_empty_backup_root();
+
+			return;
+		}
+
+		EE::log( 'Disabled session.upload_progress in custom.ini of ' . count( $this->changed ) . ' more site(s) where it was not set globally. The original files are in ' . $this->backup_root );
+
+		// The image migration may recreate php containers, which then read the new file anyway; reload only the others, once it is done.
+		if ( method_exists( '\EE\Migration\CustomContainerMigrations', 'keep_executed_migrations' ) ) {
+			EE::add_hook( 'after_docker_image_migration', [ $this, 'reload_unchanged_containers' ] );
+		} else {
+			$this->reload_unchanged_containers();
+		}
+	}
+
+	/**
+	 * Restore the original custom.ini files and reload the running sites.
+	 */
+	public function down() {
+
+		if ( empty( $this->changed ) ) {
+			return;
+		}
+
+		$sites = array_column( $this->changed, 'site' );
+		$this->restore_files();
+
+		// A rolled-back image migration may have restarted them on the new file.
+		foreach ( $sites as $site ) {
+			if ( $site->site_enabled ) {
+				$id = $this->get_php_container( $site );
+				if ( null !== $id && '' !== $id ) {
+					$this->reload_php( $site->site_url, $id );
+				}
+			}
+		}
+	}
+
+	/**
+	 * Gracefully reload php-fpm of the sites whose php container is still the one up() saw.
+	 */
+	public function reload_unchanged_containers() {
+
+		foreach ( $this->containers as $site_url => $id ) {
+			if ( ! isset( $this->changed[ $site_url ] ) ) {
+				continue;
+			}
+			$now = $this->get_php_container( $this->changed[ $site_url ]['site'] );
+			if ( $now !== $id ) {
+				if ( null !== $now ) {
+					EE::debug( "$site_url: php container was recreated or stopped, no reload needed." );
+				}
+				continue;
+			}
+			$this->reload_php( $site_url, $id );
+		}
+		$this->containers = [];
+	}
+
+	/**
+	 * Whether PHP reads an ini value as true, like zend_ini_parse_bool().
+	 *
+	 * @param string $value Value as the ini scanner gives it.
+	 *
+	 * @return bool
+	 */
+	public static function is_on( string $value ) {
+
+		return in_array( strtolower( $value ), [ 'true', 'yes', 'on' ], true ) || 0 !== (int) $value;
+	}
+
+	/**
+	 * Add the setting to one site's custom.ini. Problems with one site are warnings, so they don't block the upgrade.
+	 *
+	 * @param Site $site Site to check.
+	 */
+	private function update_site( $site ) {
+
+		$conf_dir = $site->site_fs_path . '/config/php/php/conf.d';
+		$file     = $conf_dir . '/custom.ini';
+		$manual   = "Add 'session.upload_progress.enabled = Off' to the top of $file and run: ee site reload $site->site_url";
+
+		if ( is_link( $file ) || ( file_exists( $file ) && ! is_file( $file ) ) ) {
+			EE::warning( "Skipped disabling session.upload_progress for $site->site_url: custom.ini is not a regular file. $manual" );
+
+			return;
+		}
+
+		$created = ! file_exists( $file );
+		if ( $created && ! is_dir( $conf_dir ) ) {
+			EE::warning( "Skipped disabling session.upload_progress for $site->site_url: $conf_dir is missing. $manual" );
+
+			return;
+		}
+
+		$content = $created ? '' : @file_get_contents( $file );
+		if ( false === $content ) {
+			EE::warning( "Skipped disabling session.upload_progress for $site->site_url: could not read custom.ini. $manual" );
+
+			return;
+		}
+
+		$new_content = add_session_upload_progress_off( $content );
+		if ( null === $new_content ) {
+			$value = ini_global_value( preg_replace( '/^\xEF\xBB\xBF/', '', $content ), self::DIRECTIVE );
+			if ( null !== $value && self::is_on( $value ) ) {
+				EE::log( "Kept session.upload_progress On for $site->site_url: its custom.ini turns it on. Set it to Off there unless your app needs it." );
+			} else {
+				EE::debug( "$site->site_url: custom.ini already turns off session.upload_progress." );
+			}
+
+			return;
+		}
+
+		if ( ! ini_sets_globally( preg_replace( '/^\xEF\xBB\xBF/', '', $new_content ), self::DIRECTIVE ) ) {
+			EE::warning( "Skipped disabling session.upload_progress for $site->site_url: could not add it to custom.ini safely. $manual" );
+
+			return;
+		}
+
+		$backup = null;
+		if ( ! $created ) {
+			$backup = $this->backup_root . '/' . $site->site_url . '/custom.ini';
+			try {
+				$this->fs->mkdir( dirname( $backup ), 0700 );
+				$this->fs->copy( $file, $backup, true );
+				$this->fs->chmod( $backup, fileperms( $file ) & 0777 );
+				$this->fs->touch( $backup, filemtime( $file ) );
+			} catch ( \Throwable $e ) {
+				EE::warning( "Skipped disabling session.upload_progress for $site->site_url: could not back up custom.ini ({$e->getMessage()}). $manual" );
+
+				return;
+			}
+		}
+
+		$this->changed[ $site->site_url ] = [
+			'site'   => $site,
+			'file'   => $file,
+			'backup' => $backup,
+		];
+
+		// Written in place: keeps owner, mode and inode (macOS bind-mounts this single file).
+		if ( ! $this->write_in_place( $file, $new_content ) ) {
+			$this->restore_file( $site->site_url );
+			EE::warning( "Could not disable session.upload_progress for $site->site_url: could not write custom.ini. $manual" );
+
+			return;
+		}
+
+		if ( $created ) {
+			$this->match_owner( $file, $conf_dir );
+		}
+
+		$id = $site->site_enabled ? $this->get_php_container( $site ) : '';
+		if ( null !== $id && '' !== $id ) {
+			$this->containers[ $site->site_url ] = $id;
+		}
+		EE::debug( "$site->site_url: disabled session.upload_progress in custom.ini." );
+	}
+
+	/**
+	 * Restore every file changed by up().
+	 */
+	private function restore_files() {
+
+		foreach ( array_keys( $this->changed ) as $site_url ) {
+			$this->restore_file( $site_url );
+		}
+		$this->containers = [];
+		$this->remove_empty_backup_root();
+	}
+
+	/**
+	 * Restore one file changed by up(); its backup is removed once restored.
+	 *
+	 * @param string $site_url Site.
+	 */
+	private function restore_file( string $site_url ) {
+
+		$entry = $this->changed[ $site_url ];
+		unset( $this->changed[ $site_url ] );
+
+		if ( null === $entry['backup'] ) {
+			if ( ! @unlink( $entry['file'] ) && file_exists( $entry['file'] ) ) {
+				EE::warning( "Could not remove {$entry['file']} added by the session.upload_progress migration." );
+			}
+
+			return;
+		}
+
+		$content = @file_get_contents( $entry['backup'] );
+		// Skip the write when it never happened, e.g. on an immutable file.
+		if ( false === $content || ( @file_get_contents( $entry['file'] ) !== $content && ! $this->write_in_place( $entry['file'], $content ) ) ) {
+			EE::warning( "Could not restore {$entry['file']}; its original is {$entry['backup']}" );
+
+			return;
+		}
+		$this->fs->remove( dirname( $entry['backup'] ) );
+		EE::debug( "$site_url: restored custom.ini." );
+	}
+
+	private function remove_empty_backup_root() {
+
+		if ( ! empty( $this->backup_root ) && is_dir( $this->backup_root ) && ! ( new \FilesystemIterator( $this->backup_root ) )->valid() ) {
+			$this->fs->remove( $this->backup_root );
+		}
+	}
+
+	/**
+	 * @param string $file    File to overwrite without replacing it.
+	 * @param string $content New content.
+	 *
+	 * @return bool Whether the file now holds exactly $content.
+	 */
+	private function write_in_place( string $file, string $content ) {
+
+		$written = @file_put_contents( $file, $content );
+		clearstatcache( true, $file );
+
+		return strlen( $content ) === $written && @file_get_contents( $file ) === $content;
+	}
+
+	/**
+	 * Give a new file the owner and group of its directory.
+	 *
+	 * @param string $file File.
+	 * @param string $dir  Directory.
+	 */
+	private function match_owner( string $file, string $dir ) {
+
+		@chmod( $file, 0644 );
+		@chown( $file, fileowner( $dir ) );
+		@chgrp( $file, filegroup( $dir ) );
+	}
+
+	/**
+	 * @param Site $site Site.
+	 *
+	 * @return string|null ID of the site's running php container, '' when none runs, null when the lookup failed (already warned).
+	 */
+	private function get_php_container( $site ) {
+
+		$cwd    = getcwd();
+		$result = @chdir( $site->site_fs_path ) ? EE::launch( \EE_DOCKER::docker_compose_with_custom() . ' ps -q php' ) : null;
+		if ( false !== $cwd ) {
+			chdir( $cwd );
+		}
+
+		if ( null === $result || 0 !== $result->return_code ) {
+			EE::warning( "Could not check the php container of $site->site_url, so php-fpm may still run with the old session.upload_progress setting. Fix the error, then run: ee site reload $site->site_url" );
+
+			return null;
+		}
+
+		return trim( $result->stdout );
+	}
+
+	/**
+	 * Same graceful reload as `ee site reload`: php-fpm re-reads its ini files.
+	 *
+	 * @param string $site_url Site.
+	 * @param string $id       php container ID.
+	 */
+	private function reload_php( string $site_url, string $id ) {
+
+		$result = EE::launch( 'docker exec --user root ' . escapeshellarg( $id ) . " sh -c 'kill -USR2 1'" );
+		if ( 0 === $result->return_code ) {
+			EE::debug( "$site_url: reloaded php-fpm." );
+		} else {
+			EE::warning( "Could not reload php-fpm of $site_url. Run: ee site reload $site_url" );
+		}
+	}
+}
diff --git a/src/helper/site-utils.php b/src/helper/site-utils.php
index c16a7383..62425a6e 100644
--- a/src/helper/site-utils.php
+++ b/src/helper/site-utils.php
@@ -1666,6 +1666,19 @@ function add_session_upload_progress_off( string $content ) {
  */
 function ini_sets_globally( string $content, string $key ) {
 
+	return null !== ini_global_value( $content, $key );
+}
+
+/**
+ * The value a directive gets outside any [PATH=]/[HOST=] section, read the way PHP reads php.ini.
+ *
+ * @param string $content ini content without BOM.
+ * @param string $key     Directive name (case-sensitive, like PHP).
+ *
+ * @return string|null The value as PHP's ini scanner gives it (On is "1", Off is ""), or null when it isn't set there.
+ */
+function ini_global_value( string $content, string $key ) {
+
 	$global = ini_global_part( $content );
 	// Without sections, entries of ordinary sections are global and `foo[key] = x` stays an array, so it can't match.
 	$ini = @parse_ini_string( $global, false, INI_SCANNER_NORMAL );
@@ -1674,7 +1687,7 @@ function ini_sets_globally( string $content, string $key ) {
 		$ini = @parse_ini_string( implode( '', array_slice( $lines, 0, $n ) ), false, INI_SCANNER_NORMAL );
 	}
 
-	return false !== $ini && array_key_exists( $key, $ini ) && ! is_array( $ini[ $key ] );
+	return false !== $ini && array_key_exists( $key, $ini ) && ! is_array( $ini[ $key ] ) ? (string) $ini[ $key ] : null;
 }
 
 /**

From fff88801de60798f6c2ceb874dbb1b4f2cf09758 Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Fri, 23 Oct 2026 23:38:26 +0530
Subject: [PATCH 06/14] fix(restore): count entries under a bare [PATH] or
 [HOST] header as global

PHP scopes entries only to a section whose name has something after PATH or HOST. Under a header named just [PATH] or [HOST], in any case, php-fpm applies them globally, but ini_global_part() cut the global part there, so a global On under such a header was taken as unset and the Off line was added in front of it for nothing.
---
 src/helper/site-utils.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/helper/site-utils.php b/src/helper/site-utils.php
index 62425a6e..eb364532 100644
--- a/src/helper/site-utils.php
+++ b/src/helper/site-utils.php
@@ -1691,7 +1691,7 @@ function ini_global_value( string $content, string $key ) {
 }
 
 /**
- * The part of ini content before the first section whose name starts with PATH or HOST.
+ * The part of ini content before the first section named PATH or HOST plus at least one more character.
  *
  * PHP scopes every entry after such a header to it, even under later ordinary headers. The parser decides where each
  * header ends and what it is called, so any line ending, quoted names and several headers on one line are handled.
@@ -1717,7 +1717,8 @@ function ini_global_part( string $content ) {
 				continue;
 			}
 			$header = @parse_ini_string( substr( $content, $open, $close - $open + 1 ), true, INI_SCANNER_NORMAL );
-			if ( is_array( $header ) && 1 === count( $header ) && preg_match( '/^(PATH|HOST)/i', (string) key( $header ) ) ) {
+			// PHP scopes only a name with something after PATH or HOST; entries under a bare [PATH] stay global.
+			if ( is_array( $header ) && 1 === count( $header ) && preg_match( '/^(PATH|HOST)./is', (string) key( $header ) ) ) {
 				return substr( $content, 0, $open );
 			}
 			break;

From 463ac65ff0deadea1d694ead9fe0a6b93465d56b Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Fri, 23 Oct 2026 23:42:52 +0530
Subject: [PATCH 07/14] fix(migrations): never follow a swapped custom.ini in
 the recheck migration

custom.ini lives in a directory the site's php container can write to, so a symlink or hard link can appear there between the checks and the write, and the migration runs as root on the host. Read, back up, rewrite and restore the file through one handle, checked after opening to be the regular, singly linked file at that path, the same way the session ID migration handles php.ini. A missing custom.ini is created under an unguessable name and hard-linked into place, because fopen() follows a dangling symlink even in 'x' mode; its owner is set with lchown().

A failed restore inside the per-site error path now only warns instead of aborting the upgrade, the log names the backup directory only when a file was backed up, and the explicit-On check follows PHP's atoi() fallback for values like "1e-5".
---
 ...ommand_recheck_session_upload_progress.php | 211 +++++++++++++-----
 1 file changed, 151 insertions(+), 60 deletions(-)

diff --git a/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php b/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
index c63b8d73..95eb993b 100644
--- a/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
+++ b/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
@@ -11,9 +11,9 @@
 /**
  * Checks the custom.ini of every WordPress and PHP site again and turns off session.upload_progress where it is still not set globally.
  *
- * The v4.13.3 migrations took a setting inside a [PATH=]/[HOST=] section for a global one when the section header was quoted, shared its
- * line with another header, or ended with CRLF or CR, and an array entry keyed by the directive too, so those sites kept PHP's default On.
- * A global On or Off is the user's choice and is kept. Disabled sites pick it up on their next start.
+ * The v4.13.3 migrations took a setting inside a [PATH=]/[HOST=] section for a global one when the section header was quoted, shared its line with another header, was named like an earlier key, or ended with CRLF or CR, and they counted an array entry keyed by the directive too, so those sites kept PHP's default On.
+ *
+ * A global On or Off is the user's choice and is kept. Disabled sites pick the change up on their next start.
  */
 class RecheckSessionUploadProgress extends Base {
 
@@ -88,7 +88,8 @@ public function up() {
 			return;
 		}
 
-		EE::log( 'Disabled session.upload_progress in custom.ini of ' . count( $this->changed ) . ' more site(s) where it was not set globally. The original files are in ' . $this->backup_root );
+		$backed_up = array_filter( array_column( $this->changed, 'backup' ) );
+		EE::log( 'Disabled session.upload_progress in custom.ini of ' . count( $this->changed ) . ' more site(s) where it was not set globally.' . ( $backed_up ? ' The original files are in ' . $this->backup_root : '' ) );
 
 		// The image migration may recreate php containers, which then read the new file anyway; reload only the others, once it is done.
 		if ( method_exists( '\EE\Migration\CustomContainerMigrations', 'keep_executed_migrations' ) ) {
@@ -143,7 +144,7 @@ public function reload_unchanged_containers() {
 	}
 
 	/**
-	 * Whether PHP reads an ini value as true, like zend_ini_parse_bool().
+	 * Whether PHP reads an ini value as true, like zend_ini_parse_bool(), which falls back to atoi().
 	 *
 	 * @param string $value Value as the ini scanner gives it.
 	 *
@@ -151,13 +152,15 @@ public function reload_unchanged_containers() {
 	 */
 	public static function is_on( string $value ) {
 
-		return in_array( strtolower( $value ), [ 'true', 'yes', 'on' ], true ) || 0 !== (int) $value;
+		return in_array( strtolower( $value ), [ 'true', 'yes', 'on' ], true ) || 1 === preg_match( '/^\s*[+-]?0*[1-9]/', $value );
 	}
 
 	/**
 	 * Add the setting to one site's custom.ini. Problems with one site are warnings, so they don't block the upgrade.
 	 *
 	 * @param Site $site Site to check.
+	 *
+	 * @throws \Exception
 	 */
 	private function update_site( $site ) {
 
@@ -178,13 +181,51 @@ private function update_site( $site ) {
 			return;
 		}
 
-		$content = $created ? '' : @file_get_contents( $file );
-		if ( false === $content ) {
-			EE::warning( "Skipped disabling session.upload_progress for $site->site_url: could not read custom.ini. $manual" );
+		$handle = self::open_ini( $file, $created );
+		try {
+			$this->update_open_file( $site, $handle, $file, $created, $manual );
+		} finally {
+			fclose( $handle );
+		}
 
+		if ( $created && ! isset( $this->changed[ $site->site_url ] ) ) {
+			@unlink( $file );
+		}
+		if ( ! isset( $this->changed[ $site->site_url ] ) ) {
 			return;
 		}
 
+		if ( $created ) {
+			// lchown: never follows a symlink swapped in by the container.
+			@lchown( $file, fileowner( $conf_dir ) );
+			@lchgrp( $file, filegroup( $conf_dir ) );
+		}
+
+		$id = $site->site_enabled ? $this->get_php_container( $site ) : '';
+		if ( null !== $id && '' !== $id ) {
+			$this->containers[ $site->site_url ] = $id;
+		}
+		EE::debug( "$site->site_url: disabled session.upload_progress in custom.ini." );
+	}
+
+	/**
+	 * Read, back up and rewrite custom.ini, all through the handle from open_ini().
+	 *
+	 * @param Site     $site    Site.
+	 * @param resource $handle  custom.ini handle.
+	 * @param string   $file    custom.ini path.
+	 * @param bool     $created Whether this migration created the file.
+	 * @param string   $manual  Manual fix, for warnings.
+	 *
+	 * @throws \Exception
+	 */
+	private function update_open_file( $site, $handle, string $file, bool $created, string $manual ) {
+
+		$content = stream_get_contents( $handle );
+		if ( false === $content ) {
+			throw new \Exception( 'could not read it' );
+		}
+
 		$new_content = add_session_upload_progress_off( $content );
 		if ( null === $new_content ) {
 			$value = ini_global_value( preg_replace( '/^\xEF\xBB\xBF/', '', $content ), self::DIRECTIVE );
@@ -206,11 +247,12 @@ private function update_site( $site ) {
 		$backup = null;
 		if ( ! $created ) {
 			$backup = $this->backup_root . '/' . $site->site_url . '/custom.ini';
+			$stat   = fstat( $handle );
 			try {
 				$this->fs->mkdir( dirname( $backup ), 0700 );
-				$this->fs->copy( $file, $backup, true );
-				$this->fs->chmod( $backup, fileperms( $file ) & 0777 );
-				$this->fs->touch( $backup, filemtime( $file ) );
+				$this->fs->dumpFile( $backup, $content );
+				$this->fs->chmod( $backup, $stat['mode'] & 0777 );
+				$this->fs->touch( $backup, $stat['mtime'] );
 			} catch ( \Throwable $e ) {
 				EE::warning( "Skipped disabling session.upload_progress for $site->site_url: could not back up custom.ini ({$e->getMessage()}). $manual" );
 
@@ -218,29 +260,31 @@ private function update_site( $site ) {
 			}
 		}
 
+		try {
+			self::rewrite( $handle, $new_content );
+		} catch ( \Exception $e ) {
+			$restored = $created;
+			if ( ! $created ) {
+				try {
+					self::rewrite( $handle, $content );
+					$restored = true;
+					$this->fs->remove( dirname( $backup ) );
+				} catch ( \Throwable $e2 ) {
+					EE::warning( "Could not restore $file; its original is $backup" );
+				}
+			}
+			EE::warning( "Could not disable session.upload_progress for $site->site_url: could not write custom.ini. $manual" );
+			if ( $restored ) {
+				return;
+			}
+		}
+
+		// Recorded only now, so a failed write that was undone above leaves nothing for down().
 		$this->changed[ $site->site_url ] = [
 			'site'   => $site,
 			'file'   => $file,
 			'backup' => $backup,
 		];
-
-		// Written in place: keeps owner, mode and inode (macOS bind-mounts this single file).
-		if ( ! $this->write_in_place( $file, $new_content ) ) {
-			$this->restore_file( $site->site_url );
-			EE::warning( "Could not disable session.upload_progress for $site->site_url: could not write custom.ini. $manual" );
-
-			return;
-		}
-
-		if ( $created ) {
-			$this->match_owner( $file, $conf_dir );
-		}
-
-		$id = $site->site_enabled ? $this->get_php_container( $site ) : '';
-		if ( null !== $id && '' !== $id ) {
-			$this->containers[ $site->site_url ] = $id;
-		}
-		EE::debug( "$site->site_url: disabled session.upload_progress in custom.ini." );
 	}
 
 	/**
@@ -256,7 +300,7 @@ private function restore_files() {
 	}
 
 	/**
-	 * Restore one file changed by up(); its backup is removed once restored.
+	 * Restore one file changed by up(); its backup is removed once restored. Never throws.
 	 *
 	 * @param string $site_url Site.
 	 */
@@ -265,57 +309,104 @@ private function restore_file( string $site_url ) {
 		$entry = $this->changed[ $site_url ];
 		unset( $this->changed[ $site_url ] );
 
-		if ( null === $entry['backup'] ) {
-			if ( ! @unlink( $entry['file'] ) && file_exists( $entry['file'] ) ) {
-				EE::warning( "Could not remove {$entry['file']} added by the session.upload_progress migration." );
-			}
-
-			return;
-		}
+		try {
+			if ( null === $entry['backup'] ) {
+				if ( ! @unlink( $entry['file'] ) && file_exists( $entry['file'] ) ) {
+					throw new \Exception( 'could not remove it' );
+				}
 
-		$content = @file_get_contents( $entry['backup'] );
-		// Skip the write when it never happened, e.g. on an immutable file.
-		if ( false === $content || ( @file_get_contents( $entry['file'] ) !== $content && ! $this->write_in_place( $entry['file'], $content ) ) ) {
-			EE::warning( "Could not restore {$entry['file']}; its original is {$entry['backup']}" );
+				return;
+			}
 
-			return;
+			$content = @file_get_contents( $entry['backup'] );
+			if ( false === $content ) {
+				throw new \Exception( 'could not read the backup' );
+			}
+			$handle = self::open_ini( $entry['file'], false );
+			try {
+				// Skip the write when it never happened.
+				if ( stream_get_contents( $handle ) !== $content ) {
+					self::rewrite( $handle, $content );
+				}
+			} finally {
+				fclose( $handle );
+			}
+			$this->fs->remove( dirname( $entry['backup'] ) );
+			EE::debug( "$site_url: restored custom.ini." );
+		} catch ( \Throwable $e ) {
+			EE::warning( "Could not restore {$entry['file']} ({$e->getMessage()}). " . ( null === $entry['backup'] ? 'The session.upload_progress migration created it.' : "Its original is {$entry['backup']}" ) );
 		}
-		$this->fs->remove( dirname( $entry['backup'] ) );
-		EE::debug( "$site_url: restored custom.ini." );
 	}
 
 	private function remove_empty_backup_root() {
 
-		if ( ! empty( $this->backup_root ) && is_dir( $this->backup_root ) && ! ( new \FilesystemIterator( $this->backup_root ) )->valid() ) {
-			$this->fs->remove( $this->backup_root );
+		try {
+			if ( ! empty( $this->backup_root ) && is_dir( $this->backup_root ) && ! ( new \FilesystemIterator( $this->backup_root ) )->valid() ) {
+				$this->fs->remove( $this->backup_root );
+			}
+		} catch ( \Throwable $e ) {
+			EE::debug( "Could not remove the empty $this->backup_root: {$e->getMessage()}" );
 		}
 	}
 
 	/**
-	 * @param string $file    File to overwrite without replacing it.
-	 * @param string $content New content.
+	 * Opens custom.ini through one handle that every later read and write uses, so nothing swapped in at that path afterwards is followed.
+	 * The directory is mounted into the site's php container, so nothing in it is trusted.
+	 *
+	 * @param string $file   custom.ini path.
+	 * @param bool   $create Create it; fails when anything, even a dangling symlink, is there.
 	 *
-	 * @return bool Whether the file now holds exactly $content.
+	 * @return resource
+	 * @throws \Exception When the path is not a regular, singly linked file.
 	 */
-	private function write_in_place( string $file, string $content ) {
+	private static function open_ini( string $file, bool $create ) {
+
+		if ( $create ) {
+			// fopen() follows a dangling symlink even with 'x', so create an unguessable name and link it into place: link() neither follows nor replaces anything there.
+			$tmp    = dirname( $file ) . '/.custom.ini.ee-' . bin2hex( random_bytes( 8 ) );
+			$umask  = umask( 022 );
+			$handle = @fopen( $tmp, 'x+' );
+			umask( $umask );
+			if ( false !== $handle ) {
+				$linked = @link( $tmp, $file );
+				@unlink( $tmp );
+				if ( ! $linked ) {
+					fclose( $handle );
+					$handle = false;
+				}
+			}
+		} else {
+			$handle = @fopen( $file, 'r+' );
+		}
+		if ( false === $handle ) {
+			throw new \Exception( $create ? 'could not create custom.ini' : 'could not open custom.ini' );
+		}
 
-		$written = @file_put_contents( $file, $content );
+		// Swapped for a symlink around the open, or a hard link to another file.
+		$opened = fstat( $handle );
 		clearstatcache( true, $file );
+		$linked = @lstat( $file );
+		if ( ! $opened || ! $linked || $opened['dev'] !== $linked['dev'] || $opened['ino'] !== $linked['ino'] || 0100000 !== ( $linked['mode'] & 0170000 ) || 1 !== $opened['nlink'] ) {
+			fclose( $handle );
+			throw new \Exception( 'custom.ini is not a regular file' );
+		}
 
-		return strlen( $content ) === $written && @file_get_contents( $file ) === $content;
+		return $handle;
 	}
 
 	/**
-	 * Give a new file the owner and group of its directory.
+	 * Overwrite the file through its handle: owner, mode and inode stay (macOS bind-mounts this single file).
 	 *
-	 * @param string $file File.
-	 * @param string $dir  Directory.
+	 * @param resource $handle  Handle from open_ini().
+	 * @param string   $content New content.
+	 *
+	 * @throws \Exception When the file doesn't hold exactly $content afterwards.
 	 */
-	private function match_owner( string $file, string $dir ) {
+	private static function rewrite( $handle, string $content ) {
 
-		@chmod( $file, 0644 );
-		@chown( $file, fileowner( $dir ) );
-		@chgrp( $file, filegroup( $dir ) );
+		if ( ! rewind( $handle ) || strlen( $content ) !== fwrite( $handle, $content ) || ! fflush( $handle ) || ! ftruncate( $handle, strlen( $content ) ) || ! rewind( $handle ) || stream_get_contents( $handle ) !== $content ) {
+			throw new \Exception( 'could not write custom.ini' );
+		}
 	}
 
 	/**

From 50432dcfbaf6c7552e180763bf441dcc28545522 Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Fri, 23 Oct 2026 23:58:59 +0530
Subject: [PATCH 08/14] fix(migrations): check the directories above custom.ini
 in the recheck migration

Only config/php is EasyEngine's own link to the site's config volume; php/ and conf.d below it belong to the container, which can swap either for a symlink to a host directory. Resolve conf.d before and after each open and refuse anything outside the site's config volume, so the migration never creates, rewrites, restores or removes a custom.ini elsewhere on the host. A created file is removed on rollback only while it is still the same file in that directory.

Read custom.ini read-only first and reopen it for writing only when the line has to be added, so a read-only or hard-linked file that already sets the directive is left alone without a warning; a file with other hard links is still never written. Skip files over 64 KB with a warning, since the check re-parses the text before every '['. A write that fails and can't be undone is left for down() but no longer counted or reloaded as done, and a failed backup cleanup no longer reads as a failed restore.
---
 ...ommand_recheck_session_upload_progress.php | 286 +++++++++++++-----
 1 file changed, 204 insertions(+), 82 deletions(-)

diff --git a/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php b/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
index 95eb993b..af53908c 100644
--- a/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
+++ b/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
@@ -21,10 +21,13 @@ class RecheckSessionUploadProgress extends Base {
 
 	const DIRECTIVE = 'session.upload_progress.enabled';
 
+	/** Larger files are skipped: the check re-parses the text before every '[', and the file is the container's to fill. */
+	const MAX_SIZE = 65536;
+
 	/** @var Site[] */
 	private $sites = [];
 
-	/** @var array site_url => [ 'site' => Site, 'file' => string, 'backup' => string|null ] for every custom.ini changed by up(). */
+	/** @var array site_url => [ 'site' => Site, 'file' => string, 'dir' => string, 'ino' => int, 'dev' => int, 'backup' => string|null, 'written' => bool ] for every custom.ini changed by up(). */
 	private $changed = [];
 
 	/** @var array site_url => php container ID seen by up(), for running sites. */
@@ -88,8 +91,12 @@ public function up() {
 			return;
 		}
 
+		$written = array_filter( array_column( $this->changed, 'written' ) );
+		if ( ! $written ) {
+			return;
+		}
 		$backed_up = array_filter( array_column( $this->changed, 'backup' ) );
-		EE::log( 'Disabled session.upload_progress in custom.ini of ' . count( $this->changed ) . ' more site(s) where it was not set globally.' . ( $backed_up ? ' The original files are in ' . $this->backup_root : '' ) );
+		EE::log( 'Disabled session.upload_progress in custom.ini of ' . count( $written ) . ' more site(s) where it was not set globally.' . ( $backed_up ? ' The original files are in ' . $this->backup_root : '' ) );
 
 		// The image migration may recreate php containers, which then read the new file anyway; reload only the others, once it is done.
 		if ( method_exists( '\EE\Migration\CustomContainerMigrations', 'keep_executed_migrations' ) ) {
@@ -181,49 +188,24 @@ private function update_site( $site ) {
 			return;
 		}
 
-		$handle = self::open_ini( $file, $created );
-		try {
-			$this->update_open_file( $site, $handle, $file, $created, $manual );
-		} finally {
-			fclose( $handle );
-		}
-
-		if ( $created && ! isset( $this->changed[ $site->site_url ] ) ) {
-			@unlink( $file );
-		}
-		if ( ! isset( $this->changed[ $site->site_url ] ) ) {
-			return;
-		}
-
-		if ( $created ) {
-			// lchown: never follows a symlink swapped in by the container.
-			@lchown( $file, fileowner( $conf_dir ) );
-			@lchgrp( $file, filegroup( $conf_dir ) );
-		}
-
-		$id = $site->site_enabled ? $this->get_php_container( $site ) : '';
-		if ( null !== $id && '' !== $id ) {
-			$this->containers[ $site->site_url ] = $id;
-		}
-		EE::debug( "$site->site_url: disabled session.upload_progress in custom.ini." );
-	}
-
-	/**
-	 * Read, back up and rewrite custom.ini, all through the handle from open_ini().
-	 *
-	 * @param Site     $site    Site.
-	 * @param resource $handle  custom.ini handle.
-	 * @param string   $file    custom.ini path.
-	 * @param bool     $created Whether this migration created the file.
-	 * @param string   $manual  Manual fix, for warnings.
-	 *
-	 * @throws \Exception
-	 */
-	private function update_open_file( $site, $handle, string $file, bool $created, string $manual ) {
+		$dir     = self::conf_dir( $site );
+		$content = '';
+		if ( ! $created ) {
+			// Read-only first: a file that needs no change may be read-only or hard-linked.
+			$handle = self::open_ini( $file, 'r', $dir );
+			try {
+				if ( fstat( $handle )['size'] > self::MAX_SIZE ) {
+					EE::warning( "Skipped disabling session.upload_progress for $site->site_url: custom.ini is larger than " . self::MAX_SIZE . " bytes. $manual" );
 
-		$content = stream_get_contents( $handle );
-		if ( false === $content ) {
-			throw new \Exception( 'could not read it' );
+					return;
+				}
+				$content = stream_get_contents( $handle );
+			} finally {
+				fclose( $handle );
+			}
+			if ( false === $content ) {
+				throw new \Exception( 'could not read custom.ini' );
+			}
 		}
 
 		$new_content = add_session_upload_progress_off( $content );
@@ -244,10 +226,66 @@ private function update_open_file( $site, $handle, string $file, bool $created,
 			return;
 		}
 
+		$handle = self::open_ini( $file, $created ? 'create' : 'r+', $dir );
+		try {
+			$stat = fstat( $handle );
+			if ( stream_get_contents( $handle ) !== $content ) {
+				throw new \Exception( 'custom.ini changed while it was checked' );
+			}
+			$written = $this->write_ini( $site, $handle, $stat, $file, $dir, $created, $content, $new_content, $manual );
+			if ( $written && $created ) {
+				clearstatcache( true, $file );
+				$now = @lstat( $file );
+				// lchown never follows a symlink; the inode check skips anything swapped in since.
+				if ( $now && $now['ino'] === $stat['ino'] && $now['dev'] === $stat['dev'] ) {
+					@lchown( $file, fileowner( $conf_dir ) );
+					@lchgrp( $file, filegroup( $conf_dir ) );
+				}
+			}
+		} catch ( \Throwable $e ) {
+			if ( $created && ! isset( $this->changed[ $site->site_url ] ) ) {
+				try {
+					self::unlink_own( $file, $dir, $stat ?? fstat( $handle ) );
+				} catch ( \Throwable $e2 ) {
+					EE::debug( "Could not remove $file: {$e2->getMessage()}" );
+				}
+			}
+			throw $e;
+		} finally {
+			fclose( $handle );
+		}
+
+		if ( ! $written ) {
+			return;
+		}
+
+		$id = $site->site_enabled ? $this->get_php_container( $site ) : '';
+		if ( null !== $id && '' !== $id ) {
+			$this->containers[ $site->site_url ] = $id;
+		}
+		EE::debug( "$site->site_url: disabled session.upload_progress in custom.ini." );
+	}
+
+	/**
+	 * Back up and rewrite custom.ini through the handle from open_ini().
+	 *
+	 * @param Site     $site        Site.
+	 * @param resource $handle      custom.ini handle.
+	 * @param array    $stat        fstat() of the handle.
+	 * @param string   $file        custom.ini path.
+	 * @param string   $dir         Real path of conf.d.
+	 * @param bool     $created     Whether this migration created the file.
+	 * @param string   $content     Current content.
+	 * @param string   $new_content New content.
+	 * @param string   $manual      Manual fix, for warnings.
+	 *
+	 * @return bool Whether the file now holds the new content.
+	 */
+	private function write_ini( $site, $handle, array $stat, string $file, string $dir, bool $created, string $content, string $new_content, string $manual ) {
+
 		$backup = null;
 		if ( ! $created ) {
 			$backup = $this->backup_root . '/' . $site->site_url . '/custom.ini';
-			$stat   = fstat( $handle );
 			try {
 				$this->fs->mkdir( dirname( $backup ), 0700 );
 				$this->fs->dumpFile( $backup, $content );
@@ -256,35 +294,45 @@ private function update_open_file( $site, $handle, string $file, bool $created,
 			} catch ( \Throwable $e ) {
 				EE::warning( "Skipped disabling session.upload_progress for $site->site_url: could not back up custom.ini ({$e->getMessage()}). $manual" );
 
-				return;
+				return false;
 			}
 		}
 
+		$entry = [
+			'site'    => $site,
+			'file'    => $file,
+			'dir'     => $dir,
+			'ino'     => $stat['ino'],
+			'dev'     => $stat['dev'],
+			'backup'  => $backup,
+			'written' => true,
+		];
+
 		try {
 			self::rewrite( $handle, $new_content );
 		} catch ( \Exception $e ) {
-			$restored = $created;
-			if ( ! $created ) {
-				try {
-					self::rewrite( $handle, $content );
-					$restored = true;
-					$this->fs->remove( dirname( $backup ) );
-				} catch ( \Throwable $e2 ) {
-					EE::warning( "Could not restore $file; its original is $backup" );
-				}
-			}
 			EE::warning( "Could not disable session.upload_progress for $site->site_url: could not write custom.ini. $manual" );
-			if ( $restored ) {
-				return;
+			if ( $created ) {
+				return false;
 			}
+			try {
+				self::rewrite( $handle, $content );
+			} catch ( \Exception $e2 ) {
+				// Left for down() to retry from the backup.
+				$entry['written']                 = false;
+				$this->changed[ $site->site_url ] = $entry;
+				EE::warning( "Could not restore $file; its original is $backup" );
+
+				return false;
+			}
+			$this->remove_backup( $backup );
+
+			return false;
 		}
 
-		// Recorded only now, so a failed write that was undone above leaves nothing for down().
-		$this->changed[ $site->site_url ] = [
-			'site'   => $site,
-			'file'   => $file,
-			'backup' => $backup,
-		];
+		$this->changed[ $site->site_url ] = $entry;
+
+		return true;
 	}
 
 	/**
@@ -311,9 +359,7 @@ private function restore_file( string $site_url ) {
 
 		try {
 			if ( null === $entry['backup'] ) {
-				if ( ! @unlink( $entry['file'] ) && file_exists( $entry['file'] ) ) {
-					throw new \Exception( 'could not remove it' );
-				}
+				self::unlink_own( $entry['file'], $entry['dir'], $entry );
 
 				return;
 			}
@@ -322,7 +368,7 @@ private function restore_file( string $site_url ) {
 			if ( false === $content ) {
 				throw new \Exception( 'could not read the backup' );
 			}
-			$handle = self::open_ini( $entry['file'], false );
+			$handle = self::open_ini( $entry['file'], 'r+', $entry['dir'] );
 			try {
 				// Skip the write when it never happened.
 				if ( stream_get_contents( $handle ) !== $content ) {
@@ -331,10 +377,27 @@ private function restore_file( string $site_url ) {
 			} finally {
 				fclose( $handle );
 			}
-			$this->fs->remove( dirname( $entry['backup'] ) );
-			EE::debug( "$site_url: restored custom.ini." );
 		} catch ( \Throwable $e ) {
 			EE::warning( "Could not restore {$entry['file']} ({$e->getMessage()}). " . ( null === $entry['backup'] ? 'The session.upload_progress migration created it.' : "Its original is {$entry['backup']}" ) );
+
+			return;
+		}
+		$this->remove_backup( $entry['backup'] );
+		EE::debug( "$site_url: restored custom.ini." );
+	}
+
+	/**
+	 * @param string|null $backup Backup file; its directory is removed.
+	 */
+	private function remove_backup( $backup ) {
+
+		if ( null === $backup ) {
+			return;
+		}
+		try {
+			$this->fs->remove( dirname( $backup ) );
+		} catch ( \Throwable $e ) {
+			EE::debug( "Could not remove $backup: {$e->getMessage()}" );
 		}
 	}
 
@@ -349,19 +412,43 @@ private function remove_empty_backup_root() {
 		}
 	}
 
+	/**
+	 * Real path that conf.d must resolve to. config/php is EasyEngine's own link to the site's config volume; everything below it is the container's.
+	 *
+	 * @param Site $site Site.
+	 *
+	 * @return string
+	 * @throws \Exception
+	 */
+	private static function conf_dir( $site ) {
+
+		$base = realpath( $site->site_fs_path . '/config/php' );
+		if ( false === $base ) {
+			throw new \Exception( 'could not resolve config/php' );
+		}
+
+		return $base . '/php/conf.d';
+	}
+
 	/**
 	 * Opens custom.ini through one handle that every later read and write uses, so nothing swapped in at that path afterwards is followed.
-	 * The directory is mounted into the site's php container, so nothing in it is trusted.
+	 * The directory is mounted into the site's php container, so nothing in it is trusted: the file and every directory above it up to config/php are checked before and after opening.
 	 *
-	 * @param string $file   custom.ini path.
-	 * @param bool   $create Create it; fails when anything, even a dangling symlink, is there.
+	 * @param string $file custom.ini path.
+	 * @param string $mode 'r', 'r+', or 'create', which fails when anything, even a dangling symlink, is there.
+	 * @param string $dir  Real path conf.d must resolve to.
 	 *
 	 * @return resource
-	 * @throws \Exception When the path is not a regular, singly linked file.
+	 * @throws \Exception When the path is not the regular file in the site's conf.d, or for writing, has other hard links.
 	 */
-	private static function open_ini( string $file, bool $create ) {
+	private static function open_ini( string $file, string $mode, string $dir ) {
 
-		if ( $create ) {
+		clearstatcache();
+		if ( realpath( dirname( $file ) ) !== $dir ) {
+			throw new \Exception( 'a directory above custom.ini is a symlink' );
+		}
+
+		if ( 'create' === $mode ) {
 			// fopen() follows a dangling symlink even with 'x', so create an unguessable name and link it into place: link() neither follows nor replaces anything there.
 			$tmp    = dirname( $file ) . '/.custom.ini.ee-' . bin2hex( random_bytes( 8 ) );
 			$umask  = umask( 022 );
@@ -376,24 +463,59 @@ private static function open_ini( string $file, bool $create ) {
 				}
 			}
 		} else {
-			$handle = @fopen( $file, 'r+' );
+			$handle = @fopen( $file, $mode );
 		}
 		if ( false === $handle ) {
-			throw new \Exception( $create ? 'could not create custom.ini' : 'could not open custom.ini' );
+			throw new \Exception( 'create' === $mode ? 'could not create custom.ini' : 'could not open custom.ini' );
 		}
 
-		// Swapped for a symlink around the open, or a hard link to another file.
+		// Swapped for a symlink, or a directory above it swapped, around the open.
 		$opened = fstat( $handle );
-		clearstatcache( true, $file );
+		clearstatcache();
 		$linked = @lstat( $file );
-		if ( ! $opened || ! $linked || $opened['dev'] !== $linked['dev'] || $opened['ino'] !== $linked['ino'] || 0100000 !== ( $linked['mode'] & 0170000 ) || 1 !== $opened['nlink'] ) {
+		$error  = null;
+		if ( ! $opened || ! $linked || $opened['dev'] !== $linked['dev'] || $opened['ino'] !== $linked['ino'] || 0100000 !== ( $linked['mode'] & 0170000 ) ) {
+			$error = 'custom.ini is not a regular file';
+		} elseif ( realpath( dirname( $file ) ) !== $dir ) {
+			$error = 'a directory above custom.ini is a symlink';
+		} elseif ( 'r' !== $mode && 1 !== $opened['nlink'] ) {
+			$error = 'custom.ini has other hard links';
+		}
+		if ( null !== $error ) {
+			if ( 'create' === $mode && $opened ) {
+				self::unlink_own( $file, $dir, $opened );
+			}
 			fclose( $handle );
-			throw new \Exception( 'custom.ini is not a regular file' );
+			throw new \Exception( $error );
 		}
 
 		return $handle;
 	}
 
+	/**
+	 * Remove a file this migration created, only while it is still that file in that directory.
+	 *
+	 * @param string $file custom.ini path.
+	 * @param string $dir  Real path conf.d must resolve to.
+	 * @param array  $stat Its dev and ino.
+	 *
+	 * @throws \Exception When it can't be removed.
+	 */
+	private static function unlink_own( string $file, string $dir, array $stat ) {
+
+		clearstatcache();
+		$now = @lstat( $file );
+		if ( ! $now ) {
+			return;
+		}
+		if ( $now['ino'] !== $stat['ino'] || $now['dev'] !== $stat['dev'] || realpath( dirname( $file ) ) !== $dir ) {
+			throw new \Exception( 'it was replaced, so it was left as it is' );
+		}
+		if ( ! @unlink( $file ) ) {
+			throw new \Exception( 'could not remove it' );
+		}
+	}
+
 	/**
 	 * Overwrite the file through its handle: owner, mode and inode stay (macOS bind-mounts this single file).
 	 *

From 30264f583be86aaee38581fe424608b151e080b2 Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Sat, 24 Oct 2026 00:40:43 +0530
Subject: [PATCH 09/14] fix(restore): re-add the upload-progress line through a
 checked handle

The restored custom.ini sits in the site's config volume, which its php container can change: between the checks and the write it could swap the file for a symlink, or conf.d for a symlink to a host directory, and file_put_contents() as root would follow it. A short write also left only part of the file behind.

Add helpers that open such a file once and verify the handle is the regular, singly linked file in the site's conf.d before anything is read or written through it: on Linux by the kernel's path of the open file from /proc/self/fd, which a directory swapped around the open can't fake, elsewhere by checking the path before and after. A missing file is created under an unguessable name and hard-linked into place, since fopen() follows a dangling symlink even in 'x' mode. The restore now reads read-only first, writes through the handle, and on a failed write puts the restored file back or removes the new one.
---
 src/helper/Site_Backup_Restore.php |  67 +++++++++---
 src/helper/site-utils.php          | 169 +++++++++++++++++++++++++++++
 2 files changed, 218 insertions(+), 18 deletions(-)

diff --git a/src/helper/Site_Backup_Restore.php b/src/helper/Site_Backup_Restore.php
index f4de8bc4..77232a05 100644
--- a/src/helper/Site_Backup_Restore.php
+++ b/src/helper/Site_Backup_Restore.php
@@ -1714,30 +1714,61 @@ private function keep_session_upload_progress_off() {
 			return;
 		}
 
-		$content = $created ? '' : @file_get_contents( $file );
-		if ( false === $content ) {
-			EE::warning( "Could not read the restored custom.ini to check session.upload_progress. $manual" );
-
-			return;
-		}
+		// The directory is in the site's config volume, which its php container can change: every read and write goes through a checked handle.
+		try {
+			$dir     = \EE\Site\Utils\site_php_conf_dir( EE_ROOT_DIR . '/sites/' . $site_url );
+			$content = '';
+			if ( ! $created ) {
+				$handle = \EE\Site\Utils\open_container_file( $file, 'r', $dir );
+				try {
+					$content = stream_get_contents( $handle );
+				} finally {
+					fclose( $handle );
+				}
+				if ( false === $content ) {
+					throw new \Exception( 'could not read it' );
+				}
+			}
 
-		$new_content = \EE\Site\Utils\add_session_upload_progress_off( $content );
-		if ( null === $new_content ) {
-			return;
-		}
+			$new_content = \EE\Site\Utils\add_session_upload_progress_off( $content );
+			if ( null === $new_content ) {
+				return;
+			}
 
-		// Written in place: keeps owner, mode and inode (macOS bind-mounts this single file).
-		$written = @file_put_contents( $file, $new_content );
-		clearstatcache( true, $file );
-		if ( strlen( $new_content ) !== $written ) {
-			EE::warning( "Could not turn off session.upload_progress in the restored custom.ini. $manual" );
+			$handle = \EE\Site\Utils\open_container_file( $file, $created ? 'create' : 'r+', $dir );
+			try {
+				$stat = fstat( $handle );
+				if ( stream_get_contents( $handle ) !== $content ) {
+					throw new \Exception( 'it changed while it was checked' );
+				}
+				try {
+					\EE\Site\Utils\rewrite_container_file( $handle, $new_content );
+				} catch ( \Exception $e ) {
+					// A short write leaves part of the file; put the restored one back, or remove the new one.
+					if ( $created ) {
+						\EE\Site\Utils\remove_container_file( $file, $dir, $stat );
+					} else {
+						\EE\Site\Utils\rewrite_container_file( $handle, $content );
+					}
+					throw $e;
+				}
+			} finally {
+				fclose( $handle );
+			}
+		} catch ( \Exception $e ) {
+			EE::warning( "Could not turn off session.upload_progress in the restored custom.ini ({$e->getMessage()}). $manual" );
 
 			return;
 		}
+
 		if ( $created ) {
-			@chmod( $file, 0644 );
-			@chown( $file, fileowner( $conf_dir ) );
-			@chgrp( $file, filegroup( $conf_dir ) );
+			// lchown never follows a symlink; the inode check skips anything swapped in since.
+			clearstatcache( true );
+			$now = @lstat( $file );
+			if ( $now && $now['ino'] === $stat['ino'] && $now['dev'] === $stat['dev'] ) {
+				@lchown( $file, fileowner( $conf_dir ) );
+				@lchgrp( $file, filegroup( $conf_dir ) );
+			}
 		}
 
 		EE::log( 'The restored custom.ini did not set session.upload_progress.enabled, so it was set to Off again. Set it to On there only if your app needs it.' );
diff --git a/src/helper/site-utils.php b/src/helper/site-utils.php
index eb364532..6ac64001 100644
--- a/src/helper/site-utils.php
+++ b/src/helper/site-utils.php
@@ -1727,3 +1727,172 @@ function ini_global_part( string $content ) {
 
 	return $content;
 }
+
+/**
+ * Real path of a site's conf.d. config/php is EasyEngine's own link to the site's config volume; everything below it belongs to the site's php container.
+ *
+ * @param string $site_fs_path Site root.
+ *
+ * @return string
+ * @throws \Exception
+ */
+function site_php_conf_dir( string $site_fs_path ) {
+
+	$base = realpath( $site_fs_path . '/config/php' );
+	if ( false === $base ) {
+		throw new \Exception( 'could not resolve config/php' );
+	}
+
+	return $base . '/php/conf.d';
+}
+
+/**
+ * Open a file in a directory the site's php container can change, as a handle for every later read and write, so nothing swapped in at that path is followed afterwards.
+ *
+ * Host root must not write through a symlink, a hard link or a swapped directory, so the handle has to be the regular file in $dir. On Linux the kernel's own path of the open file decides; elsewhere the path is checked before and after opening.
+ *
+ * @param string $file Path.
+ * @param string $mode 'r', 'r+', or 'create', which fails when anything, even a dangling symlink, is at the path.
+ * @param string $dir  Real path of the directory the file must be in.
+ *
+ * @return resource
+ * @throws \Exception
+ */
+function open_container_file( string $file, string $mode, string $dir ) {
+
+	$name = basename( $file );
+	clearstatcache( true );
+	if ( realpath( dirname( $file ) ) !== $dir ) {
+		throw new \Exception( "a directory above $name is a symlink" );
+	}
+
+	if ( 'create' === $mode ) {
+		// fopen() follows a dangling symlink even with 'x', so create an unguessable name and link it into place: link() neither follows nor replaces anything there.
+		$tmp    = dirname( $file ) . "/.$name.ee-" . bin2hex( random_bytes( 8 ) );
+		$umask  = umask( 022 );
+		$handle = @fopen( $tmp, 'x+' );
+		umask( $umask );
+		if ( false === $handle ) {
+			throw new \Exception( "could not create $name" );
+		}
+		$created = fstat( $handle );
+		$linked  = @link( $tmp, $file );
+		@unlink( $tmp );
+		fclose( $handle );
+		if ( ! $linked ) {
+			throw new \Exception( "could not create $name" );
+		}
+
+		try {
+			$handle = open_container_file( $file, 'r+', $dir );
+			$opened = fstat( $handle );
+			if ( $opened['ino'] !== $created['ino'] || $opened['dev'] !== $created['dev'] ) {
+				fclose( $handle );
+				throw new \Exception( "$name was replaced while it was created" );
+			}
+		} catch ( \Exception $e ) {
+			try {
+				remove_container_file( $file, $dir, $created );
+			} catch ( \Exception $ignored ) {
+				// Not ours any more.
+			}
+			throw $e;
+		}
+
+		return $handle;
+	}
+
+	$handle = @fopen( $file, $mode );
+	if ( false === $handle ) {
+		throw new \Exception( "could not open $name" );
+	}
+
+	$opened = fstat( $handle );
+	clearstatcache( true );
+	$linked = @lstat( $file );
+	$real   = opened_file_path( $handle );
+	$error  = null;
+	if ( ! $opened || ! $linked || $opened['dev'] !== $linked['dev'] || $opened['ino'] !== $linked['ino'] || 0100000 !== ( $linked['mode'] & 0170000 ) ) {
+		$error = "$name is not a regular file";
+	} elseif ( realpath( dirname( $file ) ) !== $dir || ( null !== $real && "$dir/$name" !== $real ) ) {
+		$error = "a directory above $name is a symlink";
+	} elseif ( 'r' !== $mode && 1 !== $opened['nlink'] ) {
+		$error = "$name has other hard links";
+	}
+	if ( null !== $error ) {
+		fclose( $handle );
+		throw new \Exception( $error );
+	}
+
+	return $handle;
+}
+
+/**
+ * The kernel's path of an open file, from /proc/self/fd, which no later swap of a directory changes.
+ *
+ * @param resource $handle Open file.
+ *
+ * @return string|null Null without /proc (macOS); '' when the file isn't found there.
+ */
+function opened_file_path( $handle ) {
+
+	$want = fstat( $handle );
+	$fds  = $want ? @scandir( '/proc/self/fd' ) : false;
+	if ( ! $fds ) {
+		return null;
+	}
+
+	clearstatcache( true );
+	foreach ( $fds as $fd ) {
+		if ( ! preg_match( '/^\d+$/', $fd ) ) {
+			continue;
+		}
+		$stat = @stat( "/proc/self/fd/$fd" );
+		if ( $stat && $stat['dev'] === $want['dev'] && $stat['ino'] === $want['ino'] ) {
+			$path = @readlink( "/proc/self/fd/$fd" );
+
+			return false === $path ? '' : $path;
+		}
+	}
+
+	return '';
+}
+
+/**
+ * Overwrite an open file through its handle: owner, mode and inode stay (macOS bind-mounts single config files).
+ *
+ * @param resource $handle  Handle from open_container_file().
+ * @param string   $content New content.
+ *
+ * @throws \Exception When the file doesn't hold exactly $content afterwards.
+ */
+function rewrite_container_file( $handle, string $content ) {
+
+	if ( ! rewind( $handle ) || strlen( $content ) !== fwrite( $handle, $content ) || ! fflush( $handle ) || ! ftruncate( $handle, strlen( $content ) ) || ! rewind( $handle ) || stream_get_contents( $handle ) !== $content ) {
+		throw new \Exception( 'could not write ' . basename( stream_get_meta_data( $handle )['uri'] ) );
+	}
+}
+
+/**
+ * Remove a file EasyEngine created, only while it is still that file in that directory.
+ *
+ * @param string $file Path.
+ * @param string $dir  Real path of the directory it must be in.
+ * @param array  $stat Its dev and ino.
+ *
+ * @throws \Exception When it was replaced or can't be removed.
+ */
+function remove_container_file( string $file, string $dir, array $stat ) {
+
+	clearstatcache( true );
+	$now = @lstat( $file );
+	if ( ! $now ) {
+		return;
+	}
+	if ( $now['ino'] !== $stat['ino'] || $now['dev'] !== $stat['dev'] || realpath( dirname( $file ) ) !== $dir ) {
+		throw new \Exception( basename( $file ) . ' was replaced, so it was left as it is' );
+	}
+	if ( ! @unlink( $file ) ) {
+		throw new \Exception( 'could not remove ' . basename( $file ) );
+	}
+}

From 16beb4d7da78ecb2736cdb952e793c39341ba319 Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Sat, 24 Oct 2026 00:40:43 +0530
Subject: [PATCH 10/14] fix(migrations): use the checked file helpers in the
 recheck migration

Its own handle checks compared paths before and after opening, which a container that swaps conf.d for a host symlink and back around the open can beat; the shared helpers also check the kernel's path of the open file. Clear PHP's realpath cache along with the stat cache before each check, and remove a custom.ini the migration created when writing it fails.
---
 ...ommand_recheck_session_upload_progress.php | 154 +++---------------
 1 file changed, 24 insertions(+), 130 deletions(-)

diff --git a/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php b/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
index af53908c..07967567 100644
--- a/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
+++ b/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
@@ -7,6 +7,10 @@
 use function EE\Site\Utils\add_session_upload_progress_off;
 use function EE\Site\Utils\ini_global_value;
 use function EE\Site\Utils\ini_sets_globally;
+use function EE\Site\Utils\open_container_file;
+use function EE\Site\Utils\remove_container_file;
+use function EE\Site\Utils\rewrite_container_file;
+use function EE\Site\Utils\site_php_conf_dir;
 
 /**
  * Checks the custom.ini of every WordPress and PHP site again and turns off session.upload_progress where it is still not set globally.
@@ -175,6 +179,7 @@ private function update_site( $site ) {
 		$file     = $conf_dir . '/custom.ini';
 		$manual   = "Add 'session.upload_progress.enabled = Off' to the top of $file and run: ee site reload $site->site_url";
 
+		clearstatcache( true );
 		if ( is_link( $file ) || ( file_exists( $file ) && ! is_file( $file ) ) ) {
 			EE::warning( "Skipped disabling session.upload_progress for $site->site_url: custom.ini is not a regular file. $manual" );
 
@@ -188,11 +193,11 @@ private function update_site( $site ) {
 			return;
 		}
 
-		$dir     = self::conf_dir( $site );
+		$dir     = site_php_conf_dir( $site->site_fs_path );
 		$content = '';
 		if ( ! $created ) {
 			// Read-only first: a file that needs no change may be read-only or hard-linked.
-			$handle = self::open_ini( $file, 'r', $dir );
+			$handle = open_container_file( $file, 'r', $dir );
 			try {
 				if ( fstat( $handle )['size'] > self::MAX_SIZE ) {
 					EE::warning( "Skipped disabling session.upload_progress for $site->site_url: custom.ini is larger than " . self::MAX_SIZE . " bytes. $manual" );
@@ -226,7 +231,7 @@ private function update_site( $site ) {
 			return;
 		}
 
-		$handle = self::open_ini( $file, $created ? 'create' : 'r+', $dir );
+		$handle = open_container_file( $file, $created ? 'create' : 'r+', $dir );
 		try {
 			$stat = fstat( $handle );
 			if ( stream_get_contents( $handle ) !== $content ) {
@@ -234,7 +239,7 @@ private function update_site( $site ) {
 			}
 			$written = $this->write_ini( $site, $handle, $stat, $file, $dir, $created, $content, $new_content, $manual );
 			if ( $written && $created ) {
-				clearstatcache( true, $file );
+				clearstatcache( true );
 				$now = @lstat( $file );
 				// lchown never follows a symlink; the inode check skips anything swapped in since.
 				if ( $now && $now['ino'] === $stat['ino'] && $now['dev'] === $stat['dev'] ) {
@@ -245,7 +250,7 @@ private function update_site( $site ) {
 		} catch ( \Throwable $e ) {
 			if ( $created && ! isset( $this->changed[ $site->site_url ] ) ) {
 				try {
-					self::unlink_own( $file, $dir, $stat ?? fstat( $handle ) );
+					remove_container_file( $file, $dir, $stat ?? fstat( $handle ) );
 				} catch ( \Throwable $e2 ) {
 					EE::debug( "Could not remove $file: {$e2->getMessage()}" );
 				}
@@ -256,6 +261,14 @@ private function update_site( $site ) {
 		}
 
 		if ( ! $written ) {
+			if ( $created && ! isset( $this->changed[ $site->site_url ] ) ) {
+				try {
+					remove_container_file( $file, $dir, $stat );
+				} catch ( \Throwable $e ) {
+					EE::warning( "Could not remove $file after the failed write: {$e->getMessage()}" );
+				}
+			}
+
 			return;
 		}
 
@@ -267,7 +280,7 @@ private function update_site( $site ) {
 	}
 
 	/**
-	 * Back up and rewrite custom.ini through the handle from open_ini().
+	 * Back up and rewrite custom.ini through the handle from open_container_file().
 	 *
 	 * @param Site     $site        Site.
 	 * @param resource $handle      custom.ini handle.
@@ -309,14 +322,14 @@ private function write_ini( $site, $handle, array $stat, string $file, string $d
 		];
 
 		try {
-			self::rewrite( $handle, $new_content );
+			rewrite_container_file( $handle, $new_content );
 		} catch ( \Exception $e ) {
 			EE::warning( "Could not disable session.upload_progress for $site->site_url: could not write custom.ini. $manual" );
 			if ( $created ) {
 				return false;
 			}
 			try {
-				self::rewrite( $handle, $content );
+				rewrite_container_file( $handle, $content );
 			} catch ( \Exception $e2 ) {
 				// Left for down() to retry from the backup.
 				$entry['written']                 = false;
@@ -359,7 +372,7 @@ private function restore_file( string $site_url ) {
 
 		try {
 			if ( null === $entry['backup'] ) {
-				self::unlink_own( $entry['file'], $entry['dir'], $entry );
+				remove_container_file( $entry['file'], $entry['dir'], $entry );
 
 				return;
 			}
@@ -368,11 +381,11 @@ private function restore_file( string $site_url ) {
 			if ( false === $content ) {
 				throw new \Exception( 'could not read the backup' );
 			}
-			$handle = self::open_ini( $entry['file'], 'r+', $entry['dir'] );
+			$handle = open_container_file( $entry['file'], 'r+', $entry['dir'] );
 			try {
 				// Skip the write when it never happened.
 				if ( stream_get_contents( $handle ) !== $content ) {
-					self::rewrite( $handle, $content );
+					rewrite_container_file( $handle, $content );
 				}
 			} finally {
 				fclose( $handle );
@@ -412,125 +425,6 @@ private function remove_empty_backup_root() {
 		}
 	}
 
-	/**
-	 * Real path that conf.d must resolve to. config/php is EasyEngine's own link to the site's config volume; everything below it is the container's.
-	 *
-	 * @param Site $site Site.
-	 *
-	 * @return string
-	 * @throws \Exception
-	 */
-	private static function conf_dir( $site ) {
-
-		$base = realpath( $site->site_fs_path . '/config/php' );
-		if ( false === $base ) {
-			throw new \Exception( 'could not resolve config/php' );
-		}
-
-		return $base . '/php/conf.d';
-	}
-
-	/**
-	 * Opens custom.ini through one handle that every later read and write uses, so nothing swapped in at that path afterwards is followed.
-	 * The directory is mounted into the site's php container, so nothing in it is trusted: the file and every directory above it up to config/php are checked before and after opening.
-	 *
-	 * @param string $file custom.ini path.
-	 * @param string $mode 'r', 'r+', or 'create', which fails when anything, even a dangling symlink, is there.
-	 * @param string $dir  Real path conf.d must resolve to.
-	 *
-	 * @return resource
-	 * @throws \Exception When the path is not the regular file in the site's conf.d, or for writing, has other hard links.
-	 */
-	private static function open_ini( string $file, string $mode, string $dir ) {
-
-		clearstatcache();
-		if ( realpath( dirname( $file ) ) !== $dir ) {
-			throw new \Exception( 'a directory above custom.ini is a symlink' );
-		}
-
-		if ( 'create' === $mode ) {
-			// fopen() follows a dangling symlink even with 'x', so create an unguessable name and link it into place: link() neither follows nor replaces anything there.
-			$tmp    = dirname( $file ) . '/.custom.ini.ee-' . bin2hex( random_bytes( 8 ) );
-			$umask  = umask( 022 );
-			$handle = @fopen( $tmp, 'x+' );
-			umask( $umask );
-			if ( false !== $handle ) {
-				$linked = @link( $tmp, $file );
-				@unlink( $tmp );
-				if ( ! $linked ) {
-					fclose( $handle );
-					$handle = false;
-				}
-			}
-		} else {
-			$handle = @fopen( $file, $mode );
-		}
-		if ( false === $handle ) {
-			throw new \Exception( 'create' === $mode ? 'could not create custom.ini' : 'could not open custom.ini' );
-		}
-
-		// Swapped for a symlink, or a directory above it swapped, around the open.
-		$opened = fstat( $handle );
-		clearstatcache();
-		$linked = @lstat( $file );
-		$error  = null;
-		if ( ! $opened || ! $linked || $opened['dev'] !== $linked['dev'] || $opened['ino'] !== $linked['ino'] || 0100000 !== ( $linked['mode'] & 0170000 ) ) {
-			$error = 'custom.ini is not a regular file';
-		} elseif ( realpath( dirname( $file ) ) !== $dir ) {
-			$error = 'a directory above custom.ini is a symlink';
-		} elseif ( 'r' !== $mode && 1 !== $opened['nlink'] ) {
-			$error = 'custom.ini has other hard links';
-		}
-		if ( null !== $error ) {
-			if ( 'create' === $mode && $opened ) {
-				self::unlink_own( $file, $dir, $opened );
-			}
-			fclose( $handle );
-			throw new \Exception( $error );
-		}
-
-		return $handle;
-	}
-
-	/**
-	 * Remove a file this migration created, only while it is still that file in that directory.
-	 *
-	 * @param string $file custom.ini path.
-	 * @param string $dir  Real path conf.d must resolve to.
-	 * @param array  $stat Its dev and ino.
-	 *
-	 * @throws \Exception When it can't be removed.
-	 */
-	private static function unlink_own( string $file, string $dir, array $stat ) {
-
-		clearstatcache();
-		$now = @lstat( $file );
-		if ( ! $now ) {
-			return;
-		}
-		if ( $now['ino'] !== $stat['ino'] || $now['dev'] !== $stat['dev'] || realpath( dirname( $file ) ) !== $dir ) {
-			throw new \Exception( 'it was replaced, so it was left as it is' );
-		}
-		if ( ! @unlink( $file ) ) {
-			throw new \Exception( 'could not remove it' );
-		}
-	}
-
-	/**
-	 * Overwrite the file through its handle: owner, mode and inode stay (macOS bind-mounts this single file).
-	 *
-	 * @param resource $handle  Handle from open_ini().
-	 * @param string   $content New content.
-	 *
-	 * @throws \Exception When the file doesn't hold exactly $content afterwards.
-	 */
-	private static function rewrite( $handle, string $content ) {
-
-		if ( ! rewind( $handle ) || strlen( $content ) !== fwrite( $handle, $content ) || ! fflush( $handle ) || ! ftruncate( $handle, strlen( $content ) ) || ! rewind( $handle ) || stream_get_contents( $handle ) !== $content ) {
-			throw new \Exception( 'could not write custom.ini' );
-		}
-	}
-
 	/**
 	 * @param Site $site Site.
 	 *

From 51f14ffc5607ec1d5328961652a268f192cd832f Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Sat, 24 Oct 2026 01:01:57 +0530
Subject: [PATCH 11/14] fix(restore): remove and chown created config files
 from inside their directory

remove_container_file() and the owner change of a newly created custom.ini went by path after their checks, so a container that swapped conf.d or php/ for a host symlink in between could have a custom.ini outside the site removed or chowned. Both now enter the directory, check with getcwd() that it is the site's conf.d, and work on the bare file name, which keeps reaching that directory whatever its path points to later.

Reads of the file are capped at 64 KB (read_container_file()), so a file the container keeps growing can't exhaust memory or stall the ini check; the restore warns and leaves a larger custom.ini as it is.
---
 src/helper/Site_Backup_Restore.php |  15 +---
 src/helper/site-utils.php          | 107 ++++++++++++++++++++++++++---
 2 files changed, 100 insertions(+), 22 deletions(-)

diff --git a/src/helper/Site_Backup_Restore.php b/src/helper/Site_Backup_Restore.php
index 77232a05..1dc5811c 100644
--- a/src/helper/Site_Backup_Restore.php
+++ b/src/helper/Site_Backup_Restore.php
@@ -1721,13 +1721,10 @@ private function keep_session_upload_progress_off() {
 			if ( ! $created ) {
 				$handle = \EE\Site\Utils\open_container_file( $file, 'r', $dir );
 				try {
-					$content = stream_get_contents( $handle );
+					$content = \EE\Site\Utils\read_container_file( $handle );
 				} finally {
 					fclose( $handle );
 				}
-				if ( false === $content ) {
-					throw new \Exception( 'could not read it' );
-				}
 			}
 
 			$new_content = \EE\Site\Utils\add_session_upload_progress_off( $content );
@@ -1738,7 +1735,7 @@ private function keep_session_upload_progress_off() {
 			$handle = \EE\Site\Utils\open_container_file( $file, $created ? 'create' : 'r+', $dir );
 			try {
 				$stat = fstat( $handle );
-				if ( stream_get_contents( $handle ) !== $content ) {
+				if ( \EE\Site\Utils\read_container_file( $handle ) !== $content ) {
 					throw new \Exception( 'it changed while it was checked' );
 				}
 				try {
@@ -1762,13 +1759,7 @@ private function keep_session_upload_progress_off() {
 		}
 
 		if ( $created ) {
-			// lchown never follows a symlink; the inode check skips anything swapped in since.
-			clearstatcache( true );
-			$now = @lstat( $file );
-			if ( $now && $now['ino'] === $stat['ino'] && $now['dev'] === $stat['dev'] ) {
-				@lchown( $file, fileowner( $conf_dir ) );
-				@lchgrp( $file, filegroup( $conf_dir ) );
-			}
+			\EE\Site\Utils\chown_container_file( $file, $dir, $stat );
 		}
 
 		EE::log( 'The restored custom.ini did not set session.upload_progress.enabled, so it was set to Off again. Set it to On there only if your app needs it.' );
diff --git a/src/helper/site-utils.php b/src/helper/site-utils.php
index 6ac64001..6c4e7ca5 100644
--- a/src/helper/site-utils.php
+++ b/src/helper/site-utils.php
@@ -1873,6 +1873,61 @@ function rewrite_container_file( $handle, string $content ) {
 	}
 }
 
+/**
+ * Read an open file, at most $max bytes, so a file the container keeps growing can't exhaust memory.
+ *
+ * @param resource $handle Handle from open_container_file().
+ * @param int      $max    Largest size accepted.
+ *
+ * @return string
+ * @throws \Exception When it can't be read or is larger.
+ */
+function read_container_file( $handle, int $max = 65536 ) {
+
+	$name    = basename( stream_get_meta_data( $handle )['uri'] );
+	$content = stream_get_contents( $handle, $max + 1 );
+	if ( false === $content ) {
+		throw new \Exception( "could not read $name" );
+	}
+	if ( strlen( $content ) > $max ) {
+		throw new \Exception( "$name is larger than $max bytes" );
+	}
+
+	return $content;
+}
+
+/**
+ * Run $fn with the working directory set to the file's directory, checked to be $dir. Names relative to it reach that directory even if a directory above it is swapped for a symlink afterwards.
+ *
+ * @param string   $file Path.
+ * @param string   $dir  Real path of the directory it must be in.
+ * @param callable $fn   Gets the file name.
+ *
+ * @return mixed What $fn returns.
+ * @throws \Exception
+ */
+function in_container_dir( string $file, string $dir, callable $fn ) {
+
+	$name = basename( $file );
+	$cwd  = getcwd();
+	if ( ! @chdir( dirname( $file ) ) ) {
+		throw new \Exception( "could not enter the directory of $name" );
+	}
+	try {
+		// getcwd() is the kernel's path of the directory now entered.
+		if ( getcwd() !== $dir ) {
+			throw new \Exception( "a directory above $name is a symlink" );
+		}
+		clearstatcache( true );
+
+		return $fn( $name );
+	} finally {
+		if ( false !== $cwd ) {
+			@chdir( $cwd );
+		}
+	}
+}
+
 /**
  * Remove a file EasyEngine created, only while it is still that file in that directory.
  *
@@ -1884,15 +1939,47 @@ function rewrite_container_file( $handle, string $content ) {
  */
 function remove_container_file( string $file, string $dir, array $stat ) {
 
-	clearstatcache( true );
-	$now = @lstat( $file );
-	if ( ! $now ) {
-		return;
-	}
-	if ( $now['ino'] !== $stat['ino'] || $now['dev'] !== $stat['dev'] || realpath( dirname( $file ) ) !== $dir ) {
-		throw new \Exception( basename( $file ) . ' was replaced, so it was left as it is' );
-	}
-	if ( ! @unlink( $file ) ) {
-		throw new \Exception( 'could not remove ' . basename( $file ) );
+	in_container_dir(
+		$file,
+		$dir,
+		function ( $name ) use ( $stat ) {
+			$now = @lstat( $name );
+			if ( ! $now ) {
+				return;
+			}
+			if ( $now['ino'] !== $stat['ino'] || $now['dev'] !== $stat['dev'] ) {
+				throw new \Exception( "$name was replaced, so it was left as it is" );
+			}
+			if ( ! @unlink( $name ) ) {
+				throw new \Exception( "could not remove $name" );
+			}
+		}
+	);
+}
+
+/**
+ * Give a file EasyEngine created the owner and group of its directory, only while it is still that file there; lchown() never follows a symlink.
+ *
+ * @param string $file Path.
+ * @param string $dir  Real path of the directory it must be in.
+ * @param array  $stat Its dev and ino.
+ */
+function chown_container_file( string $file, string $dir, array $stat ) {
+
+	try {
+		in_container_dir(
+			$file,
+			$dir,
+			function ( $name ) use ( $stat ) {
+				$now = @lstat( $name );
+				if ( $now && $now['ino'] === $stat['ino'] && $now['dev'] === $stat['dev'] ) {
+					@lchown( $name, fileowner( '.' ) );
+					@lchgrp( $name, filegroup( '.' ) );
+				}
+			}
+		);
+	} catch ( \Exception $e ) {
+		// Ownership is cosmetic here; php-fpm only reads the file.
+		EE::debug( "Could not set the owner of $file: {$e->getMessage()}" );
 	}
 }

From 0c36b0c74f5c464d88d53105b9aa34e71d55f194 Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Sat, 24 Oct 2026 01:01:57 +0530
Subject: [PATCH 12/14] fix(migrations): bound the recheck migration's reads
 and chown through the helpers

The size check used fstat() before reading, but the container can grow the file after it; read at most 64 KB plus one byte instead, also when comparing before the write and when restoring. Set the owner of a created custom.ini with chown_container_file().
---
 ...ommand_recheck_session_upload_progress.php | 28 ++++++-------------
 1 file changed, 8 insertions(+), 20 deletions(-)

diff --git a/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php b/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
index 07967567..6c39ad67 100644
--- a/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
+++ b/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
@@ -5,9 +5,11 @@
 use EE;
 use EE\Model\Site;
 use function EE\Site\Utils\add_session_upload_progress_off;
+use function EE\Site\Utils\chown_container_file;
 use function EE\Site\Utils\ini_global_value;
 use function EE\Site\Utils\ini_sets_globally;
 use function EE\Site\Utils\open_container_file;
+use function EE\Site\Utils\read_container_file;
 use function EE\Site\Utils\remove_container_file;
 use function EE\Site\Utils\rewrite_container_file;
 use function EE\Site\Utils\site_php_conf_dir;
@@ -25,7 +27,7 @@ class RecheckSessionUploadProgress extends Base {
 
 	const DIRECTIVE = 'session.upload_progress.enabled';
 
-	/** Larger files are skipped: the check re-parses the text before every '[', and the file is the container's to fill. */
+	/** Larger files are skipped with a warning: the check re-parses the text before every '[', and the file is the container's to fill. */
 	const MAX_SIZE = 65536;
 
 	/** @var Site[] */
@@ -199,18 +201,10 @@ private function update_site( $site ) {
 			// Read-only first: a file that needs no change may be read-only or hard-linked.
 			$handle = open_container_file( $file, 'r', $dir );
 			try {
-				if ( fstat( $handle )['size'] > self::MAX_SIZE ) {
-					EE::warning( "Skipped disabling session.upload_progress for $site->site_url: custom.ini is larger than " . self::MAX_SIZE . " bytes. $manual" );
-
-					return;
-				}
-				$content = stream_get_contents( $handle );
+				$content = read_container_file( $handle, self::MAX_SIZE );
 			} finally {
 				fclose( $handle );
 			}
-			if ( false === $content ) {
-				throw new \Exception( 'could not read custom.ini' );
-			}
 		}
 
 		$new_content = add_session_upload_progress_off( $content );
@@ -234,18 +228,12 @@ private function update_site( $site ) {
 		$handle = open_container_file( $file, $created ? 'create' : 'r+', $dir );
 		try {
 			$stat = fstat( $handle );
-			if ( stream_get_contents( $handle ) !== $content ) {
+			if ( read_container_file( $handle, self::MAX_SIZE ) !== $content ) {
 				throw new \Exception( 'custom.ini changed while it was checked' );
 			}
 			$written = $this->write_ini( $site, $handle, $stat, $file, $dir, $created, $content, $new_content, $manual );
 			if ( $written && $created ) {
-				clearstatcache( true );
-				$now = @lstat( $file );
-				// lchown never follows a symlink; the inode check skips anything swapped in since.
-				if ( $now && $now['ino'] === $stat['ino'] && $now['dev'] === $stat['dev'] ) {
-					@lchown( $file, fileowner( $conf_dir ) );
-					@lchgrp( $file, filegroup( $conf_dir ) );
-				}
+				chown_container_file( $file, $dir, $stat );
 			}
 		} catch ( \Throwable $e ) {
 			if ( $created && ! isset( $this->changed[ $site->site_url ] ) ) {
@@ -383,8 +371,8 @@ private function restore_file( string $site_url ) {
 			}
 			$handle = open_container_file( $entry['file'], 'r+', $entry['dir'] );
 			try {
-				// Skip the write when it never happened.
-				if ( stream_get_contents( $handle ) !== $content ) {
+				// Skip the write when it never happened; read no more than needed to tell.
+				if ( stream_get_contents( $handle, strlen( $content ) + 1 ) !== $content ) {
 					rewrite_container_file( $handle, $content );
 				}
 			} finally {

From 3684b8f857ba024bd4e409f4154ca8078c0a5170 Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Sat, 24 Oct 2026 01:18:40 +0530
Subject: [PATCH 13/14] fix(restore): don't create a missing custom.ini, bound
 the write check

Creating the file can't be confined to the site's conf.d from PHP: fopen() and link() expand the path to an absolute one, so a conf.d swapped for a host symlink at the wrong moment gets the new file outside, before any check of the open handle can catch it. A site without custom.ini now gets the warning with the manual fix instead; the restore only copies custom.ini from a backup that has one, so the site keeps its own. With nothing created, the helpers that removed and chowned created files are gone.

The read-back after a write stops one byte past the new content, so data the container appends in the meantime can't make it unbounded.
---
 src/helper/Site_Backup_Restore.php |  39 +++------
 src/helper/site-utils.php          | 133 ++---------------------------
 2 files changed, 20 insertions(+), 152 deletions(-)

diff --git a/src/helper/Site_Backup_Restore.php b/src/helper/Site_Backup_Restore.php
index 1dc5811c..639e7ba0 100644
--- a/src/helper/Site_Backup_Restore.php
+++ b/src/helper/Site_Backup_Restore.php
@@ -1703,28 +1703,24 @@ private function restore_php_conf( $backup_dir ) {
 	 */
 	private function keep_session_upload_progress_off() {
 		$site_url = $this->site_data['site_url'];
-		$conf_dir = EE_ROOT_DIR . '/sites/' . $site_url . '/config/php/php/conf.d';
-		$file     = $conf_dir . '/custom.ini';
+		$file     = EE_ROOT_DIR . '/sites/' . $site_url . '/config/php/php/conf.d/custom.ini';
 		$manual   = "Add 'session.upload_progress.enabled = Off' to $file and run: ee site reload $site_url";
 
-		$created = ! file_exists( $file ) && ! is_link( $file );
-		if ( is_link( $file ) || ( ! $created && ! is_file( $file ) ) || ( $created && ! is_dir( $conf_dir ) ) ) {
-			EE::warning( "Could not check session.upload_progress in the restored custom.ini: it is not a regular file or its directory is missing. $manual" );
+		// Not created when missing: PHP can't create a file safely in a directory the site's container can swap.
+		if ( is_link( $file ) || ! is_file( $file ) ) {
+			EE::warning( "Could not check session.upload_progress in the restored custom.ini: it is missing or not a regular file. $manual" );
 
 			return;
 		}
 
 		// The directory is in the site's config volume, which its php container can change: every read and write goes through a checked handle.
 		try {
-			$dir     = \EE\Site\Utils\site_php_conf_dir( EE_ROOT_DIR . '/sites/' . $site_url );
-			$content = '';
-			if ( ! $created ) {
-				$handle = \EE\Site\Utils\open_container_file( $file, 'r', $dir );
-				try {
-					$content = \EE\Site\Utils\read_container_file( $handle );
-				} finally {
-					fclose( $handle );
-				}
+			$dir    = \EE\Site\Utils\site_php_conf_dir( EE_ROOT_DIR . '/sites/' . $site_url );
+			$handle = \EE\Site\Utils\open_container_file( $file, 'r', $dir );
+			try {
+				$content = \EE\Site\Utils\read_container_file( $handle );
+			} finally {
+				fclose( $handle );
 			}
 
 			$new_content = \EE\Site\Utils\add_session_upload_progress_off( $content );
@@ -1732,21 +1728,16 @@ private function keep_session_upload_progress_off() {
 				return;
 			}
 
-			$handle = \EE\Site\Utils\open_container_file( $file, $created ? 'create' : 'r+', $dir );
+			$handle = \EE\Site\Utils\open_container_file( $file, 'r+', $dir );
 			try {
-				$stat = fstat( $handle );
 				if ( \EE\Site\Utils\read_container_file( $handle ) !== $content ) {
 					throw new \Exception( 'it changed while it was checked' );
 				}
 				try {
 					\EE\Site\Utils\rewrite_container_file( $handle, $new_content );
 				} catch ( \Exception $e ) {
-					// A short write leaves part of the file; put the restored one back, or remove the new one.
-					if ( $created ) {
-						\EE\Site\Utils\remove_container_file( $file, $dir, $stat );
-					} else {
-						\EE\Site\Utils\rewrite_container_file( $handle, $content );
-					}
+					// A short write leaves part of the file; put the restored one back.
+					\EE\Site\Utils\rewrite_container_file( $handle, $content );
 					throw $e;
 				}
 			} finally {
@@ -1758,10 +1749,6 @@ private function keep_session_upload_progress_off() {
 			return;
 		}
 
-		if ( $created ) {
-			\EE\Site\Utils\chown_container_file( $file, $dir, $stat );
-		}
-
 		EE::log( 'The restored custom.ini did not set session.upload_progress.enabled, so it was set to Off again. Set it to On there only if your app needs it.' );
 	}
 
diff --git a/src/helper/site-utils.php b/src/helper/site-utils.php
index 6c4e7ca5..69abeb45 100644
--- a/src/helper/site-utils.php
+++ b/src/helper/site-utils.php
@@ -1752,7 +1752,7 @@ function site_php_conf_dir( string $site_fs_path ) {
  * Host root must not write through a symlink, a hard link or a swapped directory, so the handle has to be the regular file in $dir. On Linux the kernel's own path of the open file decides; elsewhere the path is checked before and after opening.
  *
  * @param string $file Path.
- * @param string $mode 'r', 'r+', or 'create', which fails when anything, even a dangling symlink, is at the path.
+ * @param string $mode 'r' or 'r+'. Nothing is created: PHP expands every path it creates or links to an absolute one, so it can't be confined to a directory the container can swap.
  * @param string $dir  Real path of the directory the file must be in.
  *
  * @return resource
@@ -1760,48 +1760,16 @@ function site_php_conf_dir( string $site_fs_path ) {
  */
 function open_container_file( string $file, string $mode, string $dir ) {
 
+	if ( 'r' !== $mode && 'r+' !== $mode ) {
+		throw new \InvalidArgumentException( "Unsupported mode $mode." );
+	}
+
 	$name = basename( $file );
 	clearstatcache( true );
 	if ( realpath( dirname( $file ) ) !== $dir ) {
 		throw new \Exception( "a directory above $name is a symlink" );
 	}
 
-	if ( 'create' === $mode ) {
-		// fopen() follows a dangling symlink even with 'x', so create an unguessable name and link it into place: link() neither follows nor replaces anything there.
-		$tmp    = dirname( $file ) . "/.$name.ee-" . bin2hex( random_bytes( 8 ) );
-		$umask  = umask( 022 );
-		$handle = @fopen( $tmp, 'x+' );
-		umask( $umask );
-		if ( false === $handle ) {
-			throw new \Exception( "could not create $name" );
-		}
-		$created = fstat( $handle );
-		$linked  = @link( $tmp, $file );
-		@unlink( $tmp );
-		fclose( $handle );
-		if ( ! $linked ) {
-			throw new \Exception( "could not create $name" );
-		}
-
-		try {
-			$handle = open_container_file( $file, 'r+', $dir );
-			$opened = fstat( $handle );
-			if ( $opened['ino'] !== $created['ino'] || $opened['dev'] !== $created['dev'] ) {
-				fclose( $handle );
-				throw new \Exception( "$name was replaced while it was created" );
-			}
-		} catch ( \Exception $e ) {
-			try {
-				remove_container_file( $file, $dir, $created );
-			} catch ( \Exception $ignored ) {
-				// Not ours any more.
-			}
-			throw $e;
-		}
-
-		return $handle;
-	}
-
 	$handle = @fopen( $file, $mode );
 	if ( false === $handle ) {
 		throw new \Exception( "could not open $name" );
@@ -1868,7 +1836,8 @@ function opened_file_path( $handle ) {
  */
 function rewrite_container_file( $handle, string $content ) {
 
-	if ( ! rewind( $handle ) || strlen( $content ) !== fwrite( $handle, $content ) || ! fflush( $handle ) || ! ftruncate( $handle, strlen( $content ) ) || ! rewind( $handle ) || stream_get_contents( $handle ) !== $content ) {
+	// The read-back stops one byte past the content, so data the container appends can't make it unbounded.
+	if ( ! rewind( $handle ) || strlen( $content ) !== fwrite( $handle, $content ) || ! fflush( $handle ) || ! ftruncate( $handle, strlen( $content ) ) || ! rewind( $handle ) || stream_get_contents( $handle, strlen( $content ) + 1 ) !== $content ) {
 		throw new \Exception( 'could not write ' . basename( stream_get_meta_data( $handle )['uri'] ) );
 	}
 }
@@ -1895,91 +1864,3 @@ function read_container_file( $handle, int $max = 65536 ) {
 
 	return $content;
 }
-
-/**
- * Run $fn with the working directory set to the file's directory, checked to be $dir. Names relative to it reach that directory even if a directory above it is swapped for a symlink afterwards.
- *
- * @param string   $file Path.
- * @param string   $dir  Real path of the directory it must be in.
- * @param callable $fn   Gets the file name.
- *
- * @return mixed What $fn returns.
- * @throws \Exception
- */
-function in_container_dir( string $file, string $dir, callable $fn ) {
-
-	$name = basename( $file );
-	$cwd  = getcwd();
-	if ( ! @chdir( dirname( $file ) ) ) {
-		throw new \Exception( "could not enter the directory of $name" );
-	}
-	try {
-		// getcwd() is the kernel's path of the directory now entered.
-		if ( getcwd() !== $dir ) {
-			throw new \Exception( "a directory above $name is a symlink" );
-		}
-		clearstatcache( true );
-
-		return $fn( $name );
-	} finally {
-		if ( false !== $cwd ) {
-			@chdir( $cwd );
-		}
-	}
-}
-
-/**
- * Remove a file EasyEngine created, only while it is still that file in that directory.
- *
- * @param string $file Path.
- * @param string $dir  Real path of the directory it must be in.
- * @param array  $stat Its dev and ino.
- *
- * @throws \Exception When it was replaced or can't be removed.
- */
-function remove_container_file( string $file, string $dir, array $stat ) {
-
-	in_container_dir(
-		$file,
-		$dir,
-		function ( $name ) use ( $stat ) {
-			$now = @lstat( $name );
-			if ( ! $now ) {
-				return;
-			}
-			if ( $now['ino'] !== $stat['ino'] || $now['dev'] !== $stat['dev'] ) {
-				throw new \Exception( "$name was replaced, so it was left as it is" );
-			}
-			if ( ! @unlink( $name ) ) {
-				throw new \Exception( "could not remove $name" );
-			}
-		}
-	);
-}
-
-/**
- * Give a file EasyEngine created the owner and group of its directory, only while it is still that file there; lchown() never follows a symlink.
- *
- * @param string $file Path.
- * @param string $dir  Real path of the directory it must be in.
- * @param array  $stat Its dev and ino.
- */
-function chown_container_file( string $file, string $dir, array $stat ) {
-
-	try {
-		in_container_dir(
-			$file,
-			$dir,
-			function ( $name ) use ( $stat ) {
-				$now = @lstat( $name );
-				if ( $now && $now['ino'] === $stat['ino'] && $now['dev'] === $stat['dev'] ) {
-					@lchown( $name, fileowner( '.' ) );
-					@lchgrp( $name, filegroup( '.' ) );
-				}
-			}
-		);
-	} catch ( \Exception $e ) {
-		// Ownership is cosmetic here; php-fpm only reads the file.
-		EE::debug( "Could not set the owner of $file: {$e->getMessage()}" );
-	}
-}

From afda75a6da024ed23c521fc816124c17fd69deb5 Mon Sep 17 00:00:00 2001
From: Riddhesh Sanghvi <riddhesh237@gmail.com>
Date: Sat, 24 Oct 2026 01:18:40 +0530
Subject: [PATCH 14/14] fix(migrations): skip a missing custom.ini in the
 recheck migration

A missing custom.ini is now skipped with a warning and the manual fix, like a symlinked one, instead of being created, for the same reason as in the restore: PHP can't create it safely in a directory the site's container can swap. The v4.13.3 migrations already created it wherever conf.d existed, so this only leaves the sites they warned about. Every changed file now has a backup.
---
 ...ommand_recheck_session_upload_progress.php | 105 +++++-------------
 1 file changed, 28 insertions(+), 77 deletions(-)

diff --git a/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php b/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
index 6c39ad67..b0874e5e 100644
--- a/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
+++ b/migrations/container/20261023233000_site-command_recheck_session_upload_progress.php
@@ -5,12 +5,10 @@
 use EE;
 use EE\Model\Site;
 use function EE\Site\Utils\add_session_upload_progress_off;
-use function EE\Site\Utils\chown_container_file;
 use function EE\Site\Utils\ini_global_value;
 use function EE\Site\Utils\ini_sets_globally;
 use function EE\Site\Utils\open_container_file;
 use function EE\Site\Utils\read_container_file;
-use function EE\Site\Utils\remove_container_file;
 use function EE\Site\Utils\rewrite_container_file;
 use function EE\Site\Utils\site_php_conf_dir;
 
@@ -33,7 +31,7 @@ class RecheckSessionUploadProgress extends Base {
 	/** @var Site[] */
 	private $sites = [];
 
-	/** @var array site_url => [ 'site' => Site, 'file' => string, 'dir' => string, 'ino' => int, 'dev' => int, 'backup' => string|null, 'written' => bool ] for every custom.ini changed by up(). */
+	/** @var array site_url => [ 'site' => Site, 'file' => string, 'dir' => string, 'backup' => string, 'written' => bool ] for every custom.ini changed by up(). */
 	private $changed = [];
 
 	/** @var array site_url => php container ID seen by up(), for running sites. */
@@ -101,8 +99,7 @@ public function up() {
 		if ( ! $written ) {
 			return;
 		}
-		$backed_up = array_filter( array_column( $this->changed, 'backup' ) );
-		EE::log( 'Disabled session.upload_progress in custom.ini of ' . count( $written ) . ' more site(s) where it was not set globally.' . ( $backed_up ? ' The original files are in ' . $this->backup_root : '' ) );
+		EE::log( 'Disabled session.upload_progress in custom.ini of ' . count( $written ) . ' more site(s) where it was not set globally. The original files are in ' . $this->backup_root );
 
 		// The image migration may recreate php containers, which then read the new file anyway; reload only the others, once it is done.
 		if ( method_exists( '\EE\Migration\CustomContainerMigrations', 'keep_executed_migrations' ) ) {
@@ -177,34 +174,24 @@ public static function is_on( string $value ) {
 	 */
 	private function update_site( $site ) {
 
-		$conf_dir = $site->site_fs_path . '/config/php/php/conf.d';
-		$file     = $conf_dir . '/custom.ini';
-		$manual   = "Add 'session.upload_progress.enabled = Off' to the top of $file and run: ee site reload $site->site_url";
+		$file   = $site->site_fs_path . '/config/php/php/conf.d/custom.ini';
+		$manual = "Add 'session.upload_progress.enabled = Off' to the top of $file and run: ee site reload $site->site_url";
 
+		// Not created when missing: PHP can't create a file safely in a directory the site's container can swap. The v4.13.3 migration created it wherever conf.d existed.
 		clearstatcache( true );
-		if ( is_link( $file ) || ( file_exists( $file ) && ! is_file( $file ) ) ) {
-			EE::warning( "Skipped disabling session.upload_progress for $site->site_url: custom.ini is not a regular file. $manual" );
+		if ( is_link( $file ) || ! is_file( $file ) ) {
+			EE::warning( "Skipped disabling session.upload_progress for $site->site_url: custom.ini is missing or not a regular file. $manual" );
 
 			return;
 		}
 
-		$created = ! file_exists( $file );
-		if ( $created && ! is_dir( $conf_dir ) ) {
-			EE::warning( "Skipped disabling session.upload_progress for $site->site_url: $conf_dir is missing. $manual" );
-
-			return;
-		}
-
-		$dir     = site_php_conf_dir( $site->site_fs_path );
-		$content = '';
-		if ( ! $created ) {
-			// Read-only first: a file that needs no change may be read-only or hard-linked.
-			$handle = open_container_file( $file, 'r', $dir );
-			try {
-				$content = read_container_file( $handle, self::MAX_SIZE );
-			} finally {
-				fclose( $handle );
-			}
+		// Read-only first: a file that needs no change may be read-only or hard-linked.
+		$dir    = site_php_conf_dir( $site->site_fs_path );
+		$handle = open_container_file( $file, 'r', $dir );
+		try {
+			$content = read_container_file( $handle, self::MAX_SIZE );
+		} finally {
+			fclose( $handle );
 		}
 
 		$new_content = add_session_upload_progress_off( $content );
@@ -225,38 +212,17 @@ private function update_site( $site ) {
 			return;
 		}
 
-		$handle = open_container_file( $file, $created ? 'create' : 'r+', $dir );
+		$handle = open_container_file( $file, 'r+', $dir );
 		try {
-			$stat = fstat( $handle );
 			if ( read_container_file( $handle, self::MAX_SIZE ) !== $content ) {
 				throw new \Exception( 'custom.ini changed while it was checked' );
 			}
-			$written = $this->write_ini( $site, $handle, $stat, $file, $dir, $created, $content, $new_content, $manual );
-			if ( $written && $created ) {
-				chown_container_file( $file, $dir, $stat );
-			}
-		} catch ( \Throwable $e ) {
-			if ( $created && ! isset( $this->changed[ $site->site_url ] ) ) {
-				try {
-					remove_container_file( $file, $dir, $stat ?? fstat( $handle ) );
-				} catch ( \Throwable $e2 ) {
-					EE::debug( "Could not remove $file: {$e2->getMessage()}" );
-				}
-			}
-			throw $e;
+			$written = $this->write_ini( $site, $handle, $file, $dir, $content, $new_content, $manual );
 		} finally {
 			fclose( $handle );
 		}
 
 		if ( ! $written ) {
-			if ( $created && ! isset( $this->changed[ $site->site_url ] ) ) {
-				try {
-					remove_container_file( $file, $dir, $stat );
-				} catch ( \Throwable $e ) {
-					EE::warning( "Could not remove $file after the failed write: {$e->getMessage()}" );
-				}
-			}
-
 			return;
 		}
 
@@ -272,39 +238,33 @@ private function update_site( $site ) {
 	 *
 	 * @param Site     $site        Site.
 	 * @param resource $handle      custom.ini handle.
-	 * @param array    $stat        fstat() of the handle.
 	 * @param string   $file        custom.ini path.
 	 * @param string   $dir         Real path of conf.d.
-	 * @param bool     $created     Whether this migration created the file.
 	 * @param string   $content     Current content.
 	 * @param string   $new_content New content.
 	 * @param string   $manual      Manual fix, for warnings.
 	 *
 	 * @return bool Whether the file now holds the new content.
 	 */
-	private function write_ini( $site, $handle, array $stat, string $file, string $dir, bool $created, string $content, string $new_content, string $manual ) {
+	private function write_ini( $site, $handle, string $file, string $dir, string $content, string $new_content, string $manual ) {
 
-		$backup = null;
-		if ( ! $created ) {
-			$backup = $this->backup_root . '/' . $site->site_url . '/custom.ini';
-			try {
-				$this->fs->mkdir( dirname( $backup ), 0700 );
-				$this->fs->dumpFile( $backup, $content );
-				$this->fs->chmod( $backup, $stat['mode'] & 0777 );
-				$this->fs->touch( $backup, $stat['mtime'] );
-			} catch ( \Throwable $e ) {
-				EE::warning( "Skipped disabling session.upload_progress for $site->site_url: could not back up custom.ini ({$e->getMessage()}). $manual" );
+		$stat   = fstat( $handle );
+		$backup = $this->backup_root . '/' . $site->site_url . '/custom.ini';
+		try {
+			$this->fs->mkdir( dirname( $backup ), 0700 );
+			$this->fs->dumpFile( $backup, $content );
+			$this->fs->chmod( $backup, $stat['mode'] & 0777 );
+			$this->fs->touch( $backup, $stat['mtime'] );
+		} catch ( \Throwable $e ) {
+			EE::warning( "Skipped disabling session.upload_progress for $site->site_url: could not back up custom.ini ({$e->getMessage()}). $manual" );
 
-				return false;
-			}
+			return false;
 		}
 
 		$entry = [
 			'site'    => $site,
 			'file'    => $file,
 			'dir'     => $dir,
-			'ino'     => $stat['ino'],
-			'dev'     => $stat['dev'],
 			'backup'  => $backup,
 			'written' => true,
 		];
@@ -313,9 +273,6 @@ private function write_ini( $site, $handle, array $stat, string $file, string $d
 			rewrite_container_file( $handle, $new_content );
 		} catch ( \Exception $e ) {
 			EE::warning( "Could not disable session.upload_progress for $site->site_url: could not write custom.ini. $manual" );
-			if ( $created ) {
-				return false;
-			}
 			try {
 				rewrite_container_file( $handle, $content );
 			} catch ( \Exception $e2 ) {
@@ -359,12 +316,6 @@ private function restore_file( string $site_url ) {
 		unset( $this->changed[ $site_url ] );
 
 		try {
-			if ( null === $entry['backup'] ) {
-				remove_container_file( $entry['file'], $entry['dir'], $entry );
-
-				return;
-			}
-
 			$content = @file_get_contents( $entry['backup'] );
 			if ( false === $content ) {
 				throw new \Exception( 'could not read the backup' );
@@ -379,7 +330,7 @@ private function restore_file( string $site_url ) {
 				fclose( $handle );
 			}
 		} catch ( \Throwable $e ) {
-			EE::warning( "Could not restore {$entry['file']} ({$e->getMessage()}). " . ( null === $entry['backup'] ? 'The session.upload_progress migration created it.' : "Its original is {$entry['backup']}" ) );
+			EE::warning( "Could not restore {$entry['file']} ({$e->getMessage()}). Its original is {$entry['backup']}" );
 
 			return;
 		}