Add PHP_DISABLE_FUNCTIONS, PHP_HTML_ERRORS, PHP_REALPATH_CACHE_SIZE, and PHP_SESSION_COOKIE_HTTPONLY environment variables

docs/content/docs/8.reference/1.environment-variable-specification.md

@@ -77,6 +77,7 @@ Setting environment variables all depends on what method you're using to run you
 `NGINX_WEBROOT`<br />*Default: "`/var/www/html/public"*|Sets the root directory for requests. (<a target="_blank" href="https://nginx.org/en/docs/http/ngx_http_core_module.html#root">Official Docs</a>)|fpm-nginx
 `NGINX_CLIENT_MAX_BODY_SIZE`<br />*Default: "100M"*|Sets the max body size for requests. (<a target="_blank" href="https://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size">Official Docs</a>)|fpm-nginx
 `PHP_DATE_TIMEZONE`<br />*Default: "UTC"*|Control your timezone. (<a target="_blank" href="https://www.php.net/manual/en/datetime.configuration.php#ini.date.timezone">Official Docs</a>)|all
+`PHP_DISABLE_FUNCTIONS`<br />*Default: ""*|Comma-separated list of functions to disable, such as `exec,shell_exec`. Empty by default because Laravel, Composer, and Symfony Process rely on `proc_open`. (<a target="_blank" href="https://www.php.net/manual/en/ini.core.php#ini.disable-functions">Official docs</a>)|all
 `PHP_DISPLAY_ERRORS`<br />*Default: Off*|Show PHP errors on screen. (<a target="_blank" href="https://www.php.net/manual/en/errorfunc.configuration.php#ini.display-errors">Official docs</a>)|all
 `PHP_DISPLAY_STARTUP_ERRORS`<br />*Default: Off*|Even when display_errors is on, errors that occur during PHP's startup sequence are not displayed. (<a target="_blank" href="https://www.php.net/manual/en/errorfunc.configuration.php#ini.display-startup-errors">Official docs</a>)| all
 `PHP_ERROR_LOG`<br />*Default: "/dev/stderr"*|Name of the file where script errors should be logged. . (<a target="_blank" href="https://www.php.net/manual/en/errorfunc.configuration.php#ini.error-log">Official docs</a>)|all
@@ -93,6 +94,7 @@ Setting environment variables all depends on what method you're using to run you
 `PHP_FPM_PM_STATUS_PATH`<br />*Default: ""*|The path to the PHP-FPM status page. (<a target="_blank" href="https://www.php.net/manual/en/install.fpm.configuration.php">Official docs</a>)|fpm*
 `PHP_FPM_POOL_NAME`<br />*Default: "www"*|Set the name of your PHP-FPM pool (helpful when running multiple sites on a single server).|fpm*
 `PHP_FPM_PROCESS_CONTROL_TIMEOUT`<br />*Default: "10s"*|Set the timeout for the process control commands. (<a target="_blank" href="https://www.php.net/manual/en/install.fpm.configuration.php">Official docs</a>)|fpm*
+`PHP_HTML_ERRORS`<br />*Default: "On"*|Format displayed errors as HTML. Only affects errors shown on screen when `PHP_DISPLAY_ERRORS` is on, never logged errors. PHP hardcodes this to Off for the CLI SAPI. (<a target="_blank" href="https://www.php.net/manual/en/errorfunc.configuration.php#ini.html-errors">Official docs</a>)|all
 `PHP_MAX_EXECUTION_TIME`<br />*Default: "99"*|Set the maximum time in seconds a script is allowed to run before it is terminated by the parser. (<a target="_blank" href="https://www.php.net/manual/en/info.configuration.php#ini.max-execution-time">Official docs</a>)|all
 `PHP_MAX_FILE_UPLOADS`<br />*Default: "20"*|The maximum number of files allowed to be uploaded in a single request. (<a target="_blank" href="https://www.php.net/manual/en/ini.core.php#ini.max-file-uploads">Official docs</a>)|all
 `PHP_MAX_INPUT_TIME`<br />*Default: "-1"*|This sets the maximum time in seconds a script is allowed to parse input data, like POST and GET. Timing begins at the moment PHP is invoked at the server and ends when execution begins. The default setting is -1, which means that max_execution_time is used instead. Set to 0 to allow unlimited time. This directive is hardcoded to -1 for the CLI SAPI by PHP. (<a target="_blank" href="https://php.net/max-input-time">Official docs</a>)|all
@@ -111,8 +113,10 @@ Setting environment variables all depends on what method you're using to run you
 `PHP_OPCACHE_VALIDATE_TIMESTAMPS`<br />*Default: "1"*|Whether OPcache checks for changes to files, or requires reload of PHP to revalidate OPcache. (<a target="_blank" href="https://www.php.net/manual/en/opcache.configuration.php#ini.opcache.validate-timestamps">Official docs</a>)|all
 `PHP_OPEN_BASEDIR`<br />*Default: "None"* |Limit the files that can be accessed by PHP to the specified directory-tree, including the file itself. `open_basedir` is just an extra safety net, that is in no way comprehensive, and can therefore not be relied upon when security is needed. (<a target="_blank" href="https://www.php.net/manual/en/ini.core.php#ini.open-basedir">Official docs</a>)| all
 `PHP_POST_MAX_SIZE`<br />*Default: "100M"*|Sets max size of post data allowed. (<a target="_blank" href="https://www.php.net/manual/en/ini.core.php#ini.post-max-size">Official docs</a>)|all
+`PHP_REALPATH_CACHE_SIZE`<br />*Default: "4096K"*|Size of the realpath cache. Applications with many files (large `vendor/` directories) may benefit from a larger cache. Note: the cache is disabled when `PHP_OPEN_BASEDIR` is set. (<a target="_blank" href="https://www.php.net/manual/en/ini.core.php#ini.realpath-cache-size">Official docs</a>)|all
 `PHP_REALPATH_CACHE_TTL`<br />*Default: "120"*|The duration of time, in seconds for which to cache realpath information for a given file or directory. (<a target="_blank" href="https://www.php.net/manual/en/ini.core.php#ini.realpath-cache-ttl">Official docs</a>)|all
-`PHP_SESSION_COOKIE_SECURE`<br />*Default: 1 (true)*|Specifies whether cookies should only be sent over secure connections.  (<a target="_blank" href="https://www.php.net/manual/en/session.configuration.php#ini.session.cookie-secure">Official docs</a>)|all
+`PHP_SESSION_COOKIE_HTTPONLY`<br />*Default: "On"*|Add the `HttpOnly` flag to the session cookie so browser scripts cannot read it. On by default as recommended by PHP. Only applies to native PHP sessions. Laravel manages its own session cookie flags. (<a target="_blank" href="https://www.php.net/manual/en/session.configuration.php#ini.session.cookie-httponly">Official docs</a>)|all
+`PHP_SESSION_COOKIE_SECURE`<br />*Default: "false"*|Specifies whether the session cookie should only be sent over HTTPS. Off by default so local development over HTTP works. Set to `true` in production when serving over HTTPS. Only applies to native PHP sessions. Laravel manages its own session cookie flags. (<a target="_blank" href="https://www.php.net/manual/en/session.configuration.php#ini.session.cookie-secure">Official docs</a>)|all
 `PHP_UPLOAD_MAX_FILE_SIZE`<br />*Default: "100M"*|The maximum size of an uploaded file. (<a target="_blank" href="https://www.php.net/manual/en/ini.core.php#ini.upload-max-filesize">Official docs</a>)|all
 `PHP_ZEND_DETECT_UNICODE`<br />*Default: ""*|Check for BOM (Byte Order Mark) and see if the file contains valid multibyte characters. This detection is performed before processing of __halt_compiler(). Available only in Zend Multibyte mode. (<a target="_blank" href="https://www.php.net/manual/en/ini.core.php#ini.zend.detect-unicode">Official docs</a>)|all
 `PHP_ZEND_MULTIBYTE`<br />*Default: "Off"*|Enable or disable Zend Multibyte. (<a target="_blank" href="https://www.php.net/manual/en/ini.core.php#ini.zend.multibyte">Official docs</a>)|all

scripts/test-image.sh

@@ -46,6 +46,17 @@ done
 [ -z "$missing_extensions" ] || fail "PHP extensions not loaded:$missing_extensions"
 pass "Extensions loaded: $expected_extensions"
 
+# PHP_* environment variables reach php.ini through ${VAR} substitution. Override a few
+# of the different value types (size, boolean, list) and confirm PHP sees them.
+ini_values=$(docker run --rm \
+    --env PHP_MEMORY_LIMIT=512M \
+    --env PHP_REALPATH_CACHE_SIZE=8M \
+    --env PHP_SESSION_COOKIE_HTTPONLY=0 \
+    --env PHP_DISABLE_FUNCTIONS=shell_exec \
+    "$image" php -r 'echo ini_get("memory_limit"), " ", ini_get("realpath_cache_size"), " ", ini_get("session.cookie_httponly"), " ", ini_get("disable_functions");' | tail -n1)
+[ "$ini_values" = "512M 8M 0 shell_exec" ] || fail "PHP_* environment variables did not apply to php.ini. Got: $ini_values"
+pass "Environment variables apply to php.ini"
+
 has_healthcheck=$(docker image inspect --format '{{if .Config.Healthcheck}}yes{{end}}' "$image")
 if [ -z "$has_healthcheck" ]; then
     pass "No HEALTHCHECK defined, skipping startup check"

src/common/usr/local/etc/php/conf.d/serversideup-docker-php.ini

@@ -320,7 +320,7 @@ open_basedir = ${PHP_OPEN_BASEDIR}
 ; This directive allows you to disable certain functions.
 ; It receives a comma-delimited list of function names.
 ; https://php.net/disable-functions
-disable_functions =
+disable_functions = ${PHP_DISABLE_FUNCTIONS}
 
 ; This directive allows you to disable certain classes.
 ; It receives a comma-delimited list of class names.
@@ -348,7 +348,7 @@ disable_classes =
 ; the file operations performed.
 ; Note: if open_basedir is set, the cache is disabled
 ; https://php.net/realpath-cache-size
-;realpath_cache_size = 4096k
+realpath_cache_size = ${PHP_REALPATH_CACHE_SIZE}
 
 ; Duration of time, in seconds for which to cache realpath information for a given
 ; file or directory. For systems with rarely changing files, consider increasing this
@@ -563,7 +563,7 @@ report_memleaks = On
 ; the error message is formatted as HTML or not.
 ; Note: This directive is hardcoded to Off for the CLI SAPI
 ; https://php.net/html-errors
-;html_errors = On
+html_errors = ${PHP_HTML_ERRORS}
 
 ; If html_errors is set to On *and* docref_root is not empty, then PHP
 ; produces clickable error messages that direct to a page describing the error
@@ -1425,7 +1425,7 @@ session.cookie_domain =
 ; Whether or not to add the httpOnly flag to the cookie, which makes it
 ; inaccessible to browser scripting languages such as JavaScript.
 ; https://php.net/session.cookie-httponly
-session.cookie_httponly =
+session.cookie_httponly = ${PHP_SESSION_COOKIE_HTTPONLY}
 
 ; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF)
 ; Current valid values are "Strict", "Lax" or "None". When using "None",

src/variations/cli/Dockerfile

@@ -30,11 +30,13 @@ ENV APP_BASE_DIR=/var/www/html \
     DISABLE_DEFAULT_CONFIG=false \
     LOG_OUTPUT_LEVEL=warn \
     PHP_DATE_TIMEZONE="UTC" \
+    PHP_DISABLE_FUNCTIONS="" \
     PHP_DISPLAY_ERRORS=Off \
     PHP_DISPLAY_STARTUP_ERRORS=Off \
     PHP_ERROR_LOG="/dev/stderr" \
     PHP_ERROR_REPORTING="22527" \
     PHP_FILE_UPLOADS="On" \
+    PHP_HTML_ERRORS="On" \
     PHP_MAX_EXECUTION_TIME="99" \
     PHP_MAX_FILE_UPLOADS="20" \
     PHP_MAX_INPUT_TIME="-1" \
@@ -53,7 +55,9 @@ ENV APP_BASE_DIR=/var/www/html \
     PHP_OPCACHE_VALIDATE_TIMESTAMPS="1" \
     PHP_OPEN_BASEDIR="" \
     PHP_POST_MAX_SIZE="100M" \
+    PHP_REALPATH_CACHE_SIZE="4096K" \
     PHP_REALPATH_CACHE_TTL="120" \
+    PHP_SESSION_COOKIE_HTTPONLY="On" \
     PHP_SESSION_COOKIE_SECURE=false \
     PHP_UPLOAD_MAX_FILE_SIZE="100M" \
     PHP_ZEND_DETECT_UNICODE="" \

src/variations/fpm-apache/Dockerfile

@@ -58,6 +58,7 @@ ENV APACHE_DOCUMENT_ROOT=/var/www/html/public \
     HEALTHCHECK_PATH="/healthcheck" \
     LOG_OUTPUT_LEVEL=warn \
     PHP_DATE_TIMEZONE="UTC" \
+    PHP_DISABLE_FUNCTIONS="" \
     PHP_DISPLAY_ERRORS=Off \
     PHP_DISPLAY_STARTUP_ERRORS=Off \
     PHP_ERROR_LOG="/dev/stderr" \
@@ -72,6 +73,7 @@ ENV APACHE_DOCUMENT_ROOT=/var/www/html/public \
     PHP_FPM_PM_STATUS_PATH="/status" \
     PHP_FPM_POOL_NAME="www" \
     PHP_FPM_PROCESS_CONTROL_TIMEOUT="10s" \
+    PHP_HTML_ERRORS="On" \
     PHP_MAX_EXECUTION_TIME="99" \
     PHP_MAX_FILE_UPLOADS="20" \
     PHP_MAX_INPUT_TIME="-1" \
@@ -90,7 +92,9 @@ ENV APACHE_DOCUMENT_ROOT=/var/www/html/public \
     PHP_OPCACHE_VALIDATE_TIMESTAMPS="1" \
     PHP_OPEN_BASEDIR="" \
     PHP_POST_MAX_SIZE="100M" \
+    PHP_REALPATH_CACHE_SIZE="4096K" \
     PHP_REALPATH_CACHE_TTL="120" \
+    PHP_SESSION_COOKIE_HTTPONLY="On" \
     PHP_SESSION_COOKIE_SECURE=false \
     PHP_UPLOAD_MAX_FILE_SIZE="100M" \
     PHP_ZEND_DETECT_UNICODE="" \

src/variations/fpm-nginx/Dockerfile

@@ -132,6 +132,7 @@ ENV APP_BASE_DIR=/var/www/html \
     NGINX_WEBROOT=/var/www/html/public \
     NGINX_CLIENT_MAX_BODY_SIZE="100M" \
     PHP_DATE_TIMEZONE="UTC" \
+    PHP_DISABLE_FUNCTIONS="" \
     PHP_DISPLAY_ERRORS=Off \
     PHP_DISPLAY_STARTUP_ERRORS=Off \
     PHP_ERROR_LOG="/dev/stderr" \
@@ -146,6 +147,7 @@ ENV APP_BASE_DIR=/var/www/html \
     PHP_FPM_PM_STATUS_PATH="/status" \
     PHP_FPM_POOL_NAME="www" \
     PHP_FPM_PROCESS_CONTROL_TIMEOUT="10s" \
+    PHP_HTML_ERRORS="On" \
     PHP_MAX_EXECUTION_TIME="99" \
     PHP_MAX_FILE_UPLOADS="20" \
     PHP_MAX_INPUT_TIME="-1" \
@@ -164,7 +166,9 @@ ENV APP_BASE_DIR=/var/www/html \
     PHP_OPCACHE_VALIDATE_TIMESTAMPS="1" \
     PHP_OPEN_BASEDIR="" \
     PHP_POST_MAX_SIZE="100M" \
+    PHP_REALPATH_CACHE_SIZE="4096K" \
     PHP_REALPATH_CACHE_TTL="120" \
+    PHP_SESSION_COOKIE_HTTPONLY="On" \
     PHP_SESSION_COOKIE_SECURE=false \
     PHP_UPLOAD_MAX_FILE_SIZE="100M" \
     PHP_ZEND_DETECT_UNICODE="" \

src/variations/fpm/Dockerfile

@@ -30,6 +30,7 @@ ENV APP_BASE_DIR=/var/www/html \
     DISABLE_DEFAULT_CONFIG=false \
     LOG_OUTPUT_LEVEL=warn \
     PHP_DATE_TIMEZONE="UTC" \
+    PHP_DISABLE_FUNCTIONS="" \
     PHP_DISPLAY_ERRORS=Off \
     PHP_DISPLAY_STARTUP_ERRORS=Off \
     PHP_ERROR_LOG="/dev/stderr" \
@@ -44,6 +45,7 @@ ENV APP_BASE_DIR=/var/www/html \
     PHP_FPM_PM_STATUS_PATH="/status" \
     PHP_FPM_POOL_NAME="www" \
     PHP_FPM_PROCESS_CONTROL_TIMEOUT="10s" \
+    PHP_HTML_ERRORS="On" \
     PHP_MAX_EXECUTION_TIME="99" \
     PHP_MAX_FILE_UPLOADS="20" \
     PHP_MAX_INPUT_TIME="-1" \
@@ -62,7 +64,9 @@ ENV APP_BASE_DIR=/var/www/html \
     PHP_OPCACHE_VALIDATE_TIMESTAMPS="1" \
     PHP_OPEN_BASEDIR="" \
     PHP_POST_MAX_SIZE="100M" \
+    PHP_REALPATH_CACHE_SIZE="4096K" \
     PHP_REALPATH_CACHE_TTL="120" \
+    PHP_SESSION_COOKIE_HTTPONLY="On" \
     PHP_SESSION_COOKIE_SECURE=Off \
     PHP_UPLOAD_MAX_FILE_SIZE="100M" \
     PHP_ZEND_DETECT_UNICODE="" \

src/variations/frankenphp/Dockerfile

@@ -150,11 +150,13 @@ LABEL org.opencontainers.image.title="serversideup/php (frankenphp)" \
     LOG_OUTPUT_LEVEL=info \
     HEALTHCHECK_PATH="/healthcheck" \
     PHP_DATE_TIMEZONE="UTC" \
+    PHP_DISABLE_FUNCTIONS="" \
     PHP_DISPLAY_ERRORS=Off \
     PHP_DISPLAY_STARTUP_ERRORS=Off \
     PHP_ERROR_LOG="/dev/stderr" \
     PHP_ERROR_REPORTING="22527" \
     PHP_FILE_UPLOADS="On" \
+    PHP_HTML_ERRORS="On" \
     PHP_MAX_EXECUTION_TIME="99" \
     PHP_MAX_FILE_UPLOADS="20" \
     PHP_MAX_INPUT_TIME="-1" \
@@ -173,7 +175,9 @@ LABEL org.opencontainers.image.title="serversideup/php (frankenphp)" \
     PHP_OPCACHE_VALIDATE_TIMESTAMPS="1" \
     PHP_OPEN_BASEDIR="" \
     PHP_POST_MAX_SIZE="100M" \
+    PHP_REALPATH_CACHE_SIZE="4096K" \
     PHP_REALPATH_CACHE_TTL="120" \
+    PHP_SESSION_COOKIE_HTTPONLY="On" \
     PHP_SESSION_COOKIE_SECURE=false \
     PHP_UPLOAD_MAX_FILE_SIZE="100M" \
     PHP_ZEND_DETECT_UNICODE="" \