[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  final class PhabricatorSetupCheckPHPConfig extends PhabricatorSetupCheck {
   4  
   5    public function getExecutionOrder() {
   6      return 0;
   7    }
   8  
   9    protected function executeChecks() {
  10      $safe_mode = ini_get('safe_mode');
  11      if ($safe_mode) {
  12        $message = pht(
  13          "You have 'safe_mode' enabled in your PHP configuration, but ".
  14          "Phabricator will not run in safe mode. Safe mode has been deprecated ".
  15          "in PHP 5.3 and removed in PHP 5.4.".
  16          "\n\n".
  17          "Disable safe mode to continue.");
  18  
  19        $this->newIssue('php.safe_mode')
  20          ->setIsFatal(true)
  21          ->setName(pht('Disable PHP safe_mode'))
  22          ->setMessage($message)
  23          ->addPHPConfig('safe_mode');
  24        return;
  25      }
  26  
  27      // Check for `disable_functions` or `disable_classes`. Although it's
  28      // possible to disable a bunch of functions (say, `array_change_key_case()`)
  29      // and classes and still have Phabricator work fine, it's unreasonably
  30      // difficult for us to be sure we'll even survive setup if these options
  31      // are enabled. Phabricator needs access to the most dangerous functions,
  32      // so there is no reasonable configuration value here which actually
  33      // provides a benefit while guaranteeing Phabricator will run properly.
  34  
  35      $disable_options = array('disable_functions', 'disable_classes');
  36      foreach ($disable_options as $disable_option) {
  37        $disable_value = ini_get($disable_option);
  38        if ($disable_value) {
  39  
  40          // By default Debian installs the pcntl extension but disables all of
  41          // its functions using configuration. Whitelist disabling these
  42          // functions so that Debian PHP works out of the box (we do not need to
  43          // call these functions from the web UI). This is pretty ridiculous but
  44          // it's not the users' fault and they haven't done anything crazy to
  45          // get here, so don't make them pay for Debian's unusual choices.
  46          // See: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605571
  47          $fatal = true;
  48          if ($disable_option == 'disable_functions') {
  49            $functions = preg_split('/[, ]+/', $disable_value);
  50            $functions = array_filter($functions);
  51            foreach ($functions as $k => $function) {
  52              if (preg_match('/^pcntl_/', $function)) {
  53                unset($functions[$k]);
  54              }
  55            }
  56            if (!$functions) {
  57              $fatal = false;
  58            }
  59          }
  60  
  61          if ($fatal) {
  62            $message = pht(
  63              "You have '%s' enabled in your PHP configuration.\n\n".
  64              "This option is not compatible with Phabricator. Remove ".
  65              "'%s' from your configuration to continue.",
  66              $disable_option,
  67              $disable_option);
  68  
  69            $this->newIssue('php.'.$disable_option)
  70              ->setIsFatal(true)
  71              ->setName(pht('Remove PHP %s', $disable_option))
  72              ->setMessage($message)
  73              ->addPHPConfig($disable_option);
  74          }
  75        }
  76      }
  77  
  78      $overload_option = 'mbstring.func_overload';
  79      $func_overload = ini_get($overload_option);
  80      if ($func_overload) {
  81        $message = pht(
  82          "You have '%s' enabled in your PHP configuration.\n\n".
  83          "This option is not compatible with Phabricator. Disable ".
  84          "'%s' in your PHP configuration to continue.",
  85          $overload_option,
  86          $overload_option);
  87  
  88        $this->newIssue('php'.$overload_option)
  89          ->setIsFatal(true)
  90          ->setName(pht('Disable PHP %s', $overload_option))
  91          ->setMessage($message)
  92          ->addPHPConfig($overload_option);
  93      }
  94  
  95      $open_basedir = ini_get('open_basedir');
  96      if ($open_basedir) {
  97  
  98        // 'open_basedir' restricts which files we're allowed to access with
  99        // file operations. This might be okay -- we don't need to write to
 100        // arbitrary places in the filesystem -- but we need to access certain
 101        // resources. This setting is unlikely to be providing any real measure
 102        // of security so warn even if things look OK.
 103  
 104        $failures = array();
 105  
 106        try {
 107          $open_libphutil = class_exists('Future');
 108        } catch (Exception $ex) {
 109          $failures[] = $ex->getMessage();
 110        }
 111  
 112        try {
 113          $open_arcanist = class_exists('ArcanistDiffParser');
 114        } catch (Exception $ex) {
 115          $failures[] = $ex->getMessage();
 116        }
 117  
 118        $open_urandom = false;
 119        try {
 120          Filesystem::readRandomBytes(1);
 121          $open_urandom = true;
 122        } catch (FilesystemException $ex) {
 123          $failures[] = $ex->getMessage();
 124        }
 125  
 126        try {
 127          $tmp = new TempFile();
 128          file_put_contents($tmp, '.');
 129          $open_tmp = @fopen((string)$tmp, 'r');
 130          if (!$open_tmp) {
 131            $failures[] = pht(
 132              "Unable to read temporary file '%s'.",
 133              (string)$tmp);
 134          }
 135        } catch (Exception $ex) {
 136          $message = $ex->getMessage();
 137          $dir = sys_get_temp_dir();
 138          $failures[] = pht(
 139            "Unable to open temp files from '%s': %s",
 140            $dir,
 141            $message);
 142        }
 143  
 144        $issue = $this->newIssue('php.open_basedir')
 145          ->setName(pht('Disable PHP open_basedir'))
 146          ->addPHPConfig('open_basedir');
 147  
 148        if ($failures) {
 149          $message = pht(
 150            "Your server is configured with 'open_basedir', which prevents ".
 151            "Phabricator from opening files it requires access to.".
 152            "\n\n".
 153            "Disable this setting to continue.".
 154            "\n\n".
 155            "Failures:\n\n%s",
 156            implode("\n\n", $failures));
 157  
 158          $issue
 159            ->setIsFatal(true)
 160            ->setMessage($message);
 161  
 162          return;
 163        } else {
 164          $summary = pht(
 165            "You have 'open_basedir' configured in your PHP settings, which ".
 166            "may cause some features to fail.");
 167  
 168          $message = pht(
 169            "You have 'open_basedir' configured in your PHP settings. Although ".
 170            "this setting appears permissive enough that Phabricator will ".
 171            "work properly, you may still run into problems because of it.".
 172            "\n\n".
 173            "Consider disabling 'open_basedir'.");
 174  
 175          $issue
 176            ->setSummary($summary)
 177            ->setMessage($message);
 178        }
 179      }
 180    }
 181  }