Build PHP hash and session modules by default

[feld]

Summary

There is a known bug affecting FreeBSD which causes a security setting
(session.hash_function) to always be set to md5 because we do not build
these modules into core php by default.

The result it is impossible to use a different session hash function on
FreeBSD. Any software expecting a better hash function does not get
correct results on FreeBSD.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=202591

Test Plan

build, test, run, upgrade

[feld]

somehow www/node012 leaked into this diff... fixed my tree, re-submitted.

[tz]

Hello feld,

thanks for working on this. It slips steadily under my focus and workload :/

I'm unsure about the change of PHP 7.1. Since the diff should solve PR 202591 its worth noticing, that the directive "session.hash_function" was removed in PHP 7.1. The change wouldn't be needed to get the security, but it would be consequent. So i'm in slight favor of your change.

Greetings,
Torsten

[feld]

Correct, php71 is getting the change for consistency only. Honestly, hash and session modules are so commonly used it should be of no consequence to include them.

[antoine]

The following lines look wrong:

hash_DEPENDS= lang/php${PHP_VER}
session_DEPENDS=lang/php${PHP_VER}

PHP_EXT_INC should be used instead.

[tz]

Please notice: the hash module is gone in PHP 7.4. Its part of the core and can't be disabled anymore. You find details here:
https://reviews.freebsd.org/D21349