Page MenuHomeFreeBSD

Move PHP session and hash modules into base language binary to fix hash_function
Needs RevisionPublic

Authored by feld on Jun 10 2017, 9:00 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mar 17 2024, 5:54 AM
Unknown Object (File)
Mar 8 2024, 9:08 PM
Unknown Object (File)
Mar 4 2024, 12:02 AM
Unknown Object (File)
Feb 26 2024, 8:53 AM
Unknown Object (File)
Dec 20 2023, 2:59 AM
Unknown Object (File)
Nov 10 2023, 8:29 AM
Unknown Object (File)
Nov 10 2023, 6:55 AM
Unknown Object (File)
Nov 9 2023, 4:00 PM
Subscribers

Details

Reviewers
mat
Group Reviewers
portmgr
Summary

It is impossible to set hash_function in PHP on FreeBSD due to session
and hash extensions being built as modules. This means any application
that is defining hash_function to something more robust than MD5 is
failing to do so and PHP on FreeBSD is automatically using MD5 anyway.

This is a security issue we need to resolve.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=202591

Test Plan

Apply this patch which removes the extensions from the tree, removes
them as options in the ports framework, and touches each port that
requested these modules in USE_PHP to remove mention of them.

Build, test, run.

Diff Detail

Repository
rP FreeBSD ports repository
Lint
No Lint Coverage
Unit
No Test Coverage
Build Status
Buildable 9793
Build 10230: arc lint + arc unit

Event Timeline

Add forgotten php70 and php71-extensions ports

This update fixes places where removing hash or session module from USE_PHP was missed

It may still contain hanging ":build" etc values or empty USE_PHP=

This revision is now accepted and ready to land.Jun 12 2017, 11:56 AM
mat requested changes to this revision.Jun 13 2017, 8:36 AM

Mmmm, this morning, epiphany. You need to add, at the very least, an updating entry saying that the php*-hash and php*-session must be removed, alsoit could be advisable be to provide an empty package for the time being, so that people do not get bitten. Best yet would be to have pkg learn MOVED and remove the packages itself :-)

This revision now requires changes to proceed.Jun 13 2017, 8:36 AM