1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-11-11 17:32:41 +01:00
phorge-phorge/src/applications/config/check/PhabricatorSetupCheckPHPConfig.php
epriestley 04d5402e2f Fatal during setup for "mbstring.func_overload"
Summary:
Fixes T5545. We assume `strlen()` returns the number of bytes in a string, which is the normal behavior (and the documented behavior).

There's a config option, `mbstring.func_overload`, which silently calls mb_strlen() instead. This may return some other result, might fail, etc., and there's no way to get the byte length of a string if this option is set.

If this option is set, fatal immediately. Nothing good can ever come of it.

Test Plan: {F173990}

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: epriestley

Maniphest Tasks: T5545

Differential Revision: https://secure.phabricator.com/D9811
2014-07-04 07:59:02 -07:00

181 lines
6.1 KiB
PHP

<?php
final class PhabricatorSetupCheckPHPConfig extends PhabricatorSetupCheck {
public function getExecutionOrder() {
return 0;
}
protected function executeChecks() {
$safe_mode = ini_get('safe_mode');
if ($safe_mode) {
$message = pht(
"You have 'safe_mode' enabled in your PHP configuration, but ".
"Phabricator will not run in safe mode. Safe mode has been deprecated ".
"in PHP 5.3 and removed in PHP 5.4.".
"\n\n".
"Disable safe mode to continue.");
$this->newIssue('php.safe_mode')
->setIsFatal(true)
->setName(pht('Disable PHP safe_mode'))
->setMessage($message)
->addPHPConfig('safe_mode');
return;
}
// Check for `disable_functions` or `disable_classes`. Although it's
// possible to disable a bunch of functions (say, `array_change_key_case()`)
// and classes and still have Phabricator work fine, it's unreasonably
// difficult for us to be sure we'll even survive setup if these options
// are enabled. Phabricator needs access to the most dangerous functions,
// so there is no reasonable configuration value here which actually
// provides a benefit while guaranteeing Phabricator will run properly.
$disable_options = array('disable_functions', 'disable_classes');
foreach ($disable_options as $disable_option) {
$disable_value = ini_get($disable_option);
if ($disable_value) {
// By default Debian installs the pcntl extension but disables all of
// its functions using configuration. Whitelist disabling these
// functions so that Debian PHP works out of the box (we do not need to
// call these functions from the web UI). This is pretty ridiculous but
// it's not the users' fault and they haven't done anything crazy to
// get here, so don't make them pay for Debian's unusual choices.
// See: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605571
$fatal = true;
if ($disable_option == 'disable_functions') {
$functions = preg_split('/[, ]+/', $disable_value);
$functions = array_filter($functions);
foreach ($functions as $k => $function) {
if (preg_match('/^pcntl_/', $function)) {
unset($functions[$k]);
}
}
if (!$functions) {
$fatal = false;
}
}
if ($fatal) {
$message = pht(
"You have '%s' enabled in your PHP configuration.\n\n".
"This option is not compatible with Phabricator. Remove ".
"'%s' from your configuration to continue.",
$disable_option,
$disable_option);
$this->newIssue('php.'.$disable_option)
->setIsFatal(true)
->setName(pht('Remove PHP %s', $disable_option))
->setMessage($message)
->addPHPConfig($disable_option);
}
}
}
$overload_option = 'mbstring.func_overload';
$func_overload = ini_get($overload_option);
if ($func_overload) {
$message = pht(
"You have '%s' enabled in your PHP configuration.\n\n".
"This option is not compatible with Phabricator. Disable ".
"'%s' in your PHP configuration to continue.",
$overload_option,
$overload_option);
$this->newIssue('php'.$overload_option)
->setIsFatal(true)
->setName(pht('Disable PHP %s', $overload_option))
->setMessage($message)
->addPHPConfig($overload_option);
}
$open_basedir = ini_get('open_basedir');
if ($open_basedir) {
// 'open_basedir' restricts which files we're allowed to access with
// file operations. This might be okay -- we don't need to write to
// arbitrary places in the filesystem -- but we need to access certain
// resources. This setting is unlikely to be providing any real measure
// of security so warn even if things look OK.
$failures = array();
try {
$open_libphutil = class_exists('Future');
} catch (Exception $ex) {
$failures[] = $ex->getMessage();
}
try {
$open_arcanist = class_exists('ArcanistDiffParser');
} catch (Exception $ex) {
$failures[] = $ex->getMessage();
}
$open_urandom = false;
try {
Filesystem::readRandomBytes(1);
$open_urandom = true;
} catch (FilesystemException $ex) {
$failures[] = $ex->getMessage();
}
try {
$tmp = new TempFile();
file_put_contents($tmp, '.');
$open_tmp = @fopen((string)$tmp, 'r');
if (!$open_tmp) {
$failures[] = pht(
"Unable to read temporary file '%s'.",
(string)$tmp);
}
} catch (Exception $ex) {
$message = $ex->getMessage();
$dir = sys_get_temp_dir();
$failures[] = pht(
"Unable to open temp files from '%s': %s",
$dir,
$message);
}
$issue = $this->newIssue('php.open_basedir')
->setName(pht('Disable PHP open_basedir'))
->addPHPConfig('open_basedir');
if ($failures) {
$message = pht(
"Your server is configured with 'open_basedir', which prevents ".
"Phabricator from opening files it requires access to.".
"\n\n".
"Disable this setting to continue.".
"\n\n".
"Failures:\n\n%s",
implode("\n\n", $failures));
$issue
->setIsFatal(true)
->setMessage($message);
return;
} else {
$summary = pht(
"You have 'open_basedir' configured in your PHP settings, which ".
"may cause some features to fail.");
$message = pht(
"You have 'open_basedir' configured in your PHP settings. Although ".
"this setting appears permissive enough that Phabricator will ".
"work properly, you may still run into problems because of it.".
"\n\n".
"Consider disabling 'open_basedir'.");
$issue
->setSummary($summary)
->setMessage($message);
}
}
}
}