On Mon, 4 Jan 2016 01:26:28 +0100
Sebastian Pipping <sp...@gentoo.org> wrote:
> Hi!
>
>
> Better late then never. Posting 72 hours from now the earliest as
> advised by GLEP 42. Feedback welcome as usual.
>
>
> ===========================================================
> Title: Apache "-D PHP5" needs update to "-D PHP"
> Author: Sebastian Pipping <sp...@gentoo.org>
> Content-Type: text/plain
> Posted: 2016-01-04
> Revision: 1
> News-Item-Format: 1.0
> Display-If-Installed: app-eselect/eselect-php[apache2]
>
> With >=app-eselect/eselect-php-0.8.1, to enable PHP support
> for Apache 2.x file /etc/conf.d/apache2 no longer
... 2.x, the file ...
> needs to read
=> should no longer read
>
> APACHE2_OPTS="......... -D PHP5"
>
> but
>
> APACHE2_OPTS="......... -D PHP"
>
> , i.e. without "5" at the end. This change is related to
instead, i.e. ...
> unification in context of the advent of PHP 7.x.
Vague.
> With that change, guard "<IfDefine PHP>" in file
> /etc/apache2/modules.d/70_mod_php.conf
> has a chance to actually pull in PHP support.
We'd like to be pretty certain that PHP application server is going to
"actually" do that.
> Without updating APACHE2_OPTS, websites could end up serving
> PHP code (include configuration files with passwords)
> unprocessed to website visitors!
That would mean there is an additional (local) security problem.
jer
