Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103857
Return-Path: <alice@librelamp.com>
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 13786 invoked from network); 28 Jan 2019 04:25:20 -0000
Received: from unknown (HELO librelamp.com) (45.79.96.192)
  by pb1.pair.com with SMTP; 28 Jan 2019 04:25:20 -0000
DKIM-Filter: OpenDKIM Filter v2.11.0 librelamp.com 286BA489
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=librelamp.com;
	s=libre2019; t=1548637460;
	bh=wMw9xmZYDtwiZh5ART4MHKe1ZIPYgdT5KS8iawxvnvM=;
	h=Subject:To:References:From:Date:In-Reply-To:From;
	b=sdqatlJWoKIBIjeUQ2lLqnsGjMX52JZGLZAHMPQB6Oa/wEz9TWXr8YIAsfka/I6XE
	 h6fJl+iOF3cX1w5DGdfaIAw+HXW60CmqBW8Z/sIuLqsJ4Eevo1/8u5O2Zzh1Us5Ith
	 VI4p+n1WkxcEZGfr4iWIDf2ZK4TvZ4QpdU2klNsO7Dl6Exd27YkMED3tWA90+CKmxn
	 AvaTUznqobAY523mOC+/6AeXmGqD67KU05r2rHdSf1iDiQKXg4KDM+XBzpFxcvQypL
	 1+2HlI+TMe9M2Y6WCjBACIBL1cxaoJOz8I+db6k6heqPzKfuynm1TCFv4Goh3VRjXk
	 7MK2Vg0uzT0OQ==
To: internals@lists.php.net
References: <244d3fd0-35ef-5639-fe80-4f1809ce9a28@librelamp.com>
Message-ID: <4453ca32-41fc-e4f2-3f77-21efac9ad8ca@librelamp.com>
Date: Sun, 27 Jan 2019 17:04:19 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.0
MIME-Version: 1.0
In-Reply-To: <244d3fd0-35ef-5639-fe80-4f1809ce9a28@librelamp.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] 7.3.1 corruption issue
From: alice@librelamp.com (Alice Wonder)

On 1/27/19 4:57 PM, Alice Wonder wrote:
> I can't file a bug report because I do not know what went run. I only 
> know system
> 
> php 7.3.1
> 
> Site suddenly stopped working.
> Apache error log says:
> 
> Mon Jan 28 00:45:17.896727 2019] [php7:error] [pid 4117:tid 
> 140287279617792] [client 73.15.182.232:53028] PHP Fatal error: 
> require_once(): Failed opening required 'base.inc.php' 
> (include_path='.:/usr/share/pear:/usr/share/php') in 
> /srv/[redacted]/www/controller.php on line 2
> 
> That include path is interesting, it lists /usr/share/pear:/usr/share/php
> 
> I set the include path in Apache config:
> 
> <Directory "/srv/[redacted]/www">
>    Options FollowSymlinks
>    AllowOverride All
>    Require all granted
>    php_value include_path "/srv/[redacted]/phpinclude:/usr/share/pear"
>    AddType application/x-httpd-php-source .phps
> </Directory>
> 
> I never set include path in my php code.
> 
> It looks like the value became corrupted and so it went to a default.
> 
> Restarted Apache and everything worked.
> 
> How would I find out what corrupted that setting? That sounds dangerous. 
> Never happened in php 7.1.x which I ran from start, or in 7.3.0 which I 
> also ran from the start. Memory corruption bug?
> 

correction, it reverted to .:/usr/share/pear:/usr/share/php which is 
dangerous, php should not have a default that includes the directory the 
script is running from even though a lot of people like to do that.

When a path is explicitly set to NOT include the current directory, 
including it in a default when the setting becomes corrupt could 
(should?) be considered a security flaw.