[mrrobot47]

Stacked on #519 and #520, merge after them. This branch is #520's head plus a merge of #519's head, so the diff below also shows their commits until they're merged; the commits of this PR are the ones after the merge commit.

What

Host-root code that reads or writes a site's php config volume no longer follows anything the site's php container put there: ee site restore, ee site update --php, ee site enable and #519's php.ini migration all go through one set of checked helpers.

Why

A site's config/php is a link to its config_php volume, which the php container mounts at /usr/local/etc (as root, and as www-data after a PHP switch, which chowns the volume's top directory to www-data). The container can therefore replace php/, php/conf.d, php-fpm.d or any file in them with a symlink, FIFO or device node. EasyEngine then followed it as root:

• restore_php_conf() ran rsync -a into config/php/php-fpm.d/, config/php/php/php.ini and config/php/php/conf.d/custom.ini, so a swapped directory sent the backed-up files into whatever host directory it pointed at.
• update_php() removed everything in the volume and mirrored the new version's config into it while the new php container was already running, so a swap during that window redirected deletes and writes. A symlinked custom.ini or easyengine.conf was copied into the backup as a link and then read back through it into the new config, so the contents of a host file ended up in the site's config.
• fix(templates): drop deprecated session ID ini settings from the PHP 8.4 and 8.5 configs #519's open_ini() checked only php.ini itself, not the directories above it.
• enable() recursively chowned config/php/php/conf.d while the container may be running.

PHP has no O_NOFOLLOW, openat() or O_PATH, and it resolves symlinks in user space before open(), so a path check alone is always racy. #520 added open_container_file(), which opens once and checks the handle (the kernel's path of the open fd from /proc/self/fd, fstat() against lstat(), one hard link for writes, non-blocking against FIFOs). This PR builds on it.

How

• site-utils.php:
  • open_container_file() now lstat()s the path first and refuses a missing file, a symlink, FIFO, device or directory without opening it, and the opened inode must be the one it saw.
  • get_container_file_contents() and put_container_file_contents() are the path-level read and in-place write (owner, mode and inode kept; compared read-only first, so an unchanged file isn't opened for writing; an optional expected content refuses a file that changed since it was checked; a short write puts the old content back). Neither creates a file.
  • check_plain_tree() refuses a tree that holds anything but directories and regular files; chown_container_tree() chowns directories and regular files only, with lchown(), re-checking each directory's real path.
  • site_php_conf_dir() takes the directory below config/php (default php/conf.d, as before).
• Restore: restore_php_conf_files() replaces the three rsync calls and restores the same set: the whole php-fpm.d/ tree including its subfolders, php/php.ini and php/conf.d/custom.ini. The backup came from the same volume, so it may hold only directories and regular files: symlinks, FIFOs, devices and names with control characters are refused with a warning (unzip already strips ../ and leading / from entry names, so those land inside the backup dir). php.ini and custom.ini are collected first; the php-fpm.d walk stops at 1000 entries with one warning, and nothing deeper than 16 levels is restored. An existing file is written over the site's regular file in place through a checked handle. A directory or file the site lacks (e.g. a pool file or subfolder added by hand, restored into a fresh site) is created from inside the running php container, one level at a time, parents first: a first docker exec changes into the parent, checks that it is a real directory there (cd -P + pwd -P, no symlink in its path) and reads its owner; a second one, run as that owner (-u uid:gid), does the same check and creates the entry relative to it (mkdir -m, or cat > with noclobber, then chmod). A symlink the container made can't point at the host, a directory swapped after the check can't redirect the write, and a user who can write the parent can't get root to change anything that user couldn't. The backed-up permission bits (rwx; setuid/setgid/sticky aren't taken from the backup) are applied the same way, to created entries and to existing ones whose bits differ. A created entry belongs to the owner and group of the directory it is created in (the backup holds no owner: 7-Zip's zip stores none, and unzip extracts as root); an existing one keeps its own, and its mode is only changed when that parent's owner may change it (otherwise warned). A directory or file that can't be restored (swapped for a symlink, not a plain directory or regular file in the site, or missing while php isn't running) is warned about; its files, and those below it, are kept under .backup/<site>-php-conf-not-restored-<time>/. On macOS, where config/php isn't mounted, a missing directory or file is skipped and no mode is set, which is what rsync's copy amounted to there. A backup whose php directory is itself a link (some 7-Zip versions store config/php that way) is refused. keep_session_upload_progress_off() (fix(restore): keep session upload progress off after restoring an older backup #520) uses the same helpers.
• update --php: the new image is pulled first (docker-compose pull php), while the site still runs. Then the php container, the only one that mounts the volume, is stopped; a running container that still mounts the volume (e.g. from a custom compose file) stops the update; the volume must hold only directories and regular files, or the update stops with "Nothing was changed" and the container is started again. The backup of the old config is a fresh copy (an older backup of the same version could hold a link that the mirror would write through; it is kept aside with a timestamp). The new version's config is put in place before the site starts on the new PHP version, so the new PHP never runs with the old version's config. A failure after the pull is rolled back: php is stopped again if enable() had started it, the old config is copied back from the backup (only while no other container mounts the volume), the old compose file is written and php is started on the old image (enable() is now called so that it throws instead of exiting).
• enable(): conf.d is given to www-data with chown_container_tree(); a failure is a warning, as the site can run without it.
• fix(templates): drop deprecated session ID ini settings from the PHP 8.4 and 8.5 configs #519's migration reads and rewrites php.ini through the helpers (capped at 1 MB); a swapped php.ini or php/ directory is now a per-site warning instead of a silent skip, a backup it no longer needs is removed, and a CR-only php.ini is split into lines (it used to be one line, so a match emptied the file).

Behaviour changes

• ee site restore overwrites existing files' content in place and creates missing directories and files (including subfolders of php-fpm.d, at any depth) from inside the running php container. Restored: content, directory structure, permission bits (rwx). Not restored: owner (created entries get their parent directory's owner, existing ones keep theirs; rsync made everything root-owned, since unzip extracts as root), setuid/setgid/sticky bits and mtime; the mode of an existing entry the parent directory's owner can't change (e.g. a root-owned file in a www-data directory) is left as it is, with a warning. Missing entries need the php container running; without it they are kept under .backup/ with a warning, and modes are not set (also warned). Entries in the site that the backup lacks are left alone, as with rsync (no --delete).
• ee site update --php stops the php container for the duration of the config switch (after pulling the image) and refuses a config volume that holds symlinks, FIFOs or devices. The image's /usr/local/etc and the template archives have none.
• The old chown -R www-data: config/php only ever changed the volume's top directory (chown doesn't descend through a symlink named on the command line); that's unchanged.

What is left

• chown_container_tree() (used by enable(), where the container may be running) re-checks each directory's real path before lchown(), but a directory swapped between that check and the lchown() can still redirect it; there is no fchownat() in PHP.
• Between the lstat() and the open() inside open_container_file() (microseconds), a symlink, FIFO or device renamed into place is still opened, non-blocking, and closed again before any read or write; opening some devices has side effects. Only an open with O_NOFOLLOW/openat(), which PHP lacks, or a write from inside a container that mounts only the volume avoids that. On macOS config/php is a host directory and only custom.ini is bind-mounted, so the container can't swap anything there.
• Not covered here: the backup side. 7z u conf.zip php follows symlinks inside the volume (it archives the target's content) and blocks on a FIFO; the restore refuses links but can't tell such content from a real file.
• The in-container chmod follows a symlink swapped in after its check; it runs as the parent directory's owner, so it can't change anything that owner couldn't, and it stays inside the container.

Testing

• Helper checks on PHP 7.4 and 8.5 (CI, as root): regular file read/write/inode kept/size cap/expected-content mismatch, missing file (nothing created), symlinked file, symlinked parent directory, FIFO (no stall), device node, hard link, check_plain_tree() and chown_container_tree() (symlink target untouched).
• Race in a throwaway process pair, 20000 rewrites while another process keeps swapping conf.d with a symlink to another directory: the old file-only check plus path write wrote into the other directory 286 (7.4) / 361 (8.5) times; the helpers 0 times.
• fix(templates): drop deprecated session ID ini settings from the PHP 8.4 and 8.5 configs #519's migration against throwaway site dirs: regular php.ini changed and rolled back; symlinked php/ and symlinked php.ini refused with a warning, the target untouched. fix(templates): drop deprecated session ID ini settings from the PHP 8.4 and 8.5 configs #519's head writes through both.
• Restore against throwaway site dirs on PHP 7.4 and 8.5 (CI, as root), with a stand-in for docker exec that runs the same in-container script on the host with the volume as its base (so a symlink there really points outside): a backup with subfolders three levels deep, an empty directory and a name starting with - restores fully into a site that lacks them (php/conf.d missing too), with the backed-up modes, created entries owned like their parent and existing files keeping their owner, and a second restore needs no in-container step; in a www-data directory, created entries belong to www-data and a root-owned file's mode is left alone with a warning; a php-fpm.d with 1200 files still gets php.ini and custom.ini restored with one warning for the limit, and a tree 18 levels deep stops at 16; a backup holding a symlinked file, a symlinked directory, a relative symlink, a FIFO, a control-character name or a symlinked php/conf.d has those refused and the rest restored; a crafted zip with a symlink entry, a file through it, ../ and absolute entries, extracted with unzip, writes nothing outside and its plain entry is restored; a site whose php-fpm.d/pool or pool/sub is a symlink to an outside directory, or whose www.conf is one, gets a warning, the files kept under .backup/ and the outside directory untouched; the in-container step refuses a symlinked parent, .., absolute paths, other roots and setuid modes on its own; with php stopped, existing files are restored and missing ones kept; two races, 300 restores each: another process keeps swapping php-fpm.d/pool between the directory and a symlink to an outside directory while restore creates files in it, and a www-data process keeps swapping pool/m.conf with a symlink to a root-owned outside file while restore rewrites it and sets its mode: both show restores that went through and restores that were refused, and 0 changes outside (content, mode, owner).
• The re-check migration matrix from fix(restore): keep session upload progress off after restoring an older backup #520 (733 checks) still passes on 7.4 and 8.5.
• On a runner with core develop: with develop's site-command, a restore with a swapped conf.d writes into the host directory and update --php copies a host file into the site's custom.ini through a symlinked custom.ini; with this branch the host directory is untouched, the restore warns, update --php refuses with the php container running again on the old version, a clean restore brings back the backed-up custom.ini with upload progress Off, a restore recreates an easyengine.conf missing in the site from inside the container, a restore recreates a removed php-fpm.d/extra/sub/deep/ tree with its files, the backed-up modes (750/711/755/600) and www-data as owner like its parent, a restore with php-fpm.d/extra (or extra/sub) swapped for a symlink to a host directory refuses it, keeps its files and leaves the host directory untouched, a backup archive with symlink entries, ../ and absolute entries added writes nothing outside the site and restores its plain entries, an update --php that fails after the switch began (template archive removed) is rolled back to the old config, compose file and PHP version, and a clean update --php serves the new PHP version with custom.ini carried over and the old config backed up. Behat passes.

Release order

site-type-wp and site-type-php use get_container_file_contents()/put_container_file_contents() from this PR when they exist and fall back to a path check otherwise, so they work with an older site-command, but they get the race-safe behaviour only together with this one.

[Copilot]

🟡 Changes recommended

Unresolved rollback volume-access and migration line-splitting issues can permit unsafe host writes or erase unrelated configuration.

2 open issues

• Handle CR-only php.ini line endings without erasing configuration · New
• Prevent rollback while another service still mounts config_php · New

What changed in this PR

This PR hardens EasyEngine’s PHP configuration handling against container-controlled symlinks during restore, PHP version updates, enablement, and migrations. It also includes the stacked session-configuration fixes from #519 and #520.

Changes:

• Adds checked file-access helpers and safer restore and ownership operations.
• Stops PHP during configuration switches and adds rollback handling.
• Adds session-setting migrations and restore regression coverage with CI backup storage.

File	Description
src/​helper/​site-utils.php	Adds checked filesystem helpers and session-setting parsing.
src/​helper/​Site_Backup_Restore.php	Hardens PHP config restoration and preserves upload-progress protection.
src/​helper/​class-ee-site.php	Adds stopped-container config switching, rollback, and checked ownership changes.
migrations/​container/​20261023233000_site-command_recheck_session_upload_progress.php	Rechecks upload-progress settings with backups and rollback support.
migrations/​container/​20261023193000_site-command_drop_deprecated_session_sid_settings.php	Removes deprecated session ID settings through checked file access.
features/​upload-progress.sh	Provides guarded helpers for integration scenarios.
features/​upload-progress.feature	Covers migration and restore behavior for upload-progress settings.
.github/​workflows/​test_and_build.yml	Configures local backup storage and tests the current checkout.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The session-ID migration can corrupt valid multiline INI entries and leave php.ini unable to parse.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Handle multiline quoted INI values when stripping settings

migrations/​container/​20261023193000_site-command_drop_deprecated_session_sid_settings.php:219

strip_settings() treats physical lines as complete INI entries without tracking quoted values. A valid multiline entry such as session.sid_length = "26\n" loses only its first line, leaving a dangling quote and making the rewritten php.ini fail to parse; a directive-looking line inside another multiline value is also deleted even though it is not a setting. Please identify complete INI entries, preserving quoted-value contents and removing the entire deprecated entry, before overwriting the live configuration.

2 resolved since last review

• Prevent rollback while another service still mounts config_php
• Handle CR-only php.ini line endings without erasing configuration

_{Review effort: Balanced}