Bug 33355 - Regression, apache serve raw php content
Summary: Regression, apache serve raw php content
Status: NEW
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Marc Krämer
QA Contact:
URL: https://serverfault.com/questions/116...
Whiteboard: MGA9TOO
Keywords:
Depends on: 33358
Blocks:
  Show dependency treegraph
 
Reported: 2024-07-02 17:22 CEST by Raphael Gertz
Modified: 2024-07-05 00:17 CEST (History)
1 user (show)

See Also:
Source RPM: php-8.3.9-1.mga10.src.rpm
CVE:
Status comment:


Attachments

Description Raphael Gertz 2024-07-02 17:22:21 CEST
Description of problem:
After upgrading to 2.4.60, some page which were serving php executed content display raw file content.

Version-Release number of selected component (if applicable):
Apache 2.4.60
Php 8.3.8

How reproducible:
Always

Steps to Reproduce:
1. Upgrade to apache 2.4.60
2. Run php call like a POST on /?/Api/
3. Get raw file content instead of executed php script
Comment 1 Raphael Gertz 2024-07-02 17:24:06 CEST
See link for explanation of regression.

I changed AddType to AddHandler in these files:
/etc/httpd/conf/modules.d/70_mod_php.conf
/etc/httpd/conf/sites.d/0x_xxx.example.com_vhosts.conf
/etc/httpd/conf/httpd.conf

Since then it seems to works correctly again.
Comment 2 Morgan Leijström 2024-07-02 17:50:13 CEST
Nicolas, you pushed it on build system.

Could you push a version with notes that display upon installation?
Apache have updated their notes, see link in URL field in this bug.

CC: (none) => fri
Assignee: bugsquad => nicolas.salguero

Comment 3 Raphael Gertz 2024-07-02 18:49:03 CEST
It may be nice to have at least mod_php/mod_perl/mod_etc working by default.
katnatek 2024-07-03 03:44:05 CEST

Blocks: (none) => 33353

Comment 4 Nicolas Salguero 2024-07-03 11:03:15 CEST
For what I saw, mod_perl is already using AddHandler rather than AddType.

According to https://lists.apache.org/thread/hgnpfrwjy68rs0vdl9f3xlgj2ngrmkjp, using "AddType application/x-httpd-php .php" has been invalid for at least 15 years.

I will add a file README.urpmi into apache-2.4.60-2.mga9 and apache-2.4.60-2.mga10.

But, regarding that bug, the problem is with php, not apache.

Version: 9 => Cauldron
Whiteboard: (none) => MGA9TOO
Source RPM: apache-2.4.60-1.mga9.src.rpm => php-8.3.9-1.mga10.src.rpm
Assignee: nicolas.salguero => mageia

Comment 5 Marc Krämer 2024-07-03 11:18:14 CEST
in case php-fpm is running this should not happen. As a handler is setup to handle php files.

I guess this directive only matches, if php-fpm is not running.

Will be adressed, in the next php update (comming today)
Marc Krämer 2024-07-03 14:51:48 CEST

Depends on: (none) => 33358

Marc Krämer 2024-07-03 14:52:33 CEST

Depends on: 33358 => (none)
Blocks: 33353 => (none)

Marc Krämer 2024-07-03 14:53:09 CEST

Depends on: (none) => 33358

Comment 6 Raphael Gertz 2024-07-03 16:06:13 CEST
(In reply to Marc Krämer from comment #5)
> in case php-fpm is running this should not happen. As a handler is setup to
> handle php files.
> 
> I guess this directive only matches, if php-fpm is not running.
> 
> Will be adressed, in the next php update (comming today)

The problem happened with mod_php in my case.

Please update backported mga9 php version too if possible.
Comment 7 Marc Krämer 2024-07-03 17:20:35 CEST
@Raphael, if you have enabled mod_php (which is "deprecated"), you don't need php-fpm-apache which caused this.
The change is for backports too.

I suggest to switch to php-fpm.
Comment 8 Raphael Gertz 2024-07-04 04:46:50 CEST
Sorry, but the "fix" by adding a note in a README.urpmi about the AddType don't seems to be really smart, it will not work by default.

Would it be possible to fix apache-mod_php8.3 to depend on new apache 2.4.60 version and replace the AddType by AddHandler in /etc/httpd/conf/modules.d/70_mod_php.conf ?

I didn't find why mod_php is deprecated, looks like a rhel choice, may you point to a reference explaining it ?
Comment 9 Marc Krämer 2024-07-04 14:54:37 CEST
a) no Readme is not needed

b) is fixed in [updates,backports]_testing

c) no, not just rhel - it is not officially deprecated - but I would consider switching:
- php-fpm is independent of the webserver
- integrated php in apache makes it bigger,slower with each request, whether php is used or not
- apache must run in non threaded mode (prefork only)
- bugs in mod_php may make apache volunerable
- php can run in different contexts (security)

A few more things can be found here:
https://www.php.net/manual/en/install.fpm.php
Comment 10 katnatek 2024-07-05 00:17:19 CEST
Also please test with new apache packages https://bugs.mageia.org/show_bug.cgi?id=33353#c8

Note You need to log in before you can comment on or make changes to this bug.