phpinfo in APP_PATH

[dejandim]

./src/php/common/rootfs/etc/cont-init.d/10-project: echo '<?php phpinfo();' >"$APPROOT/index.php"

Please fix this, you are currently placing this in the apache document root.

[shinsenter]

@dejandim

Hi, I don't actually have enough context to determine if this is truly a bug or not.

When you don't set DOCUMENT_ROOT, APP_PATH and APPROOT will be exactly the same.

Without knowing the specific details of the application and setup, I can't say for certain whether having APP_PATH and APPROOT be the same would cause issues. Please give me more information on why you think there will be an error when creating index.php in APPROOT.

[shinsenter]

@dejandim
The index.php file is automatically generated by default - this feature has been around for a while. If you check out the source code, there's an if statement ([ ! -f "$APPROOT/index.php" ]) that stops it from overwriting your index.php if you already have one.

php/src/php/common/rootfs/etc/cont-init.d/10-project

Lines 72 to 74 in dfa7a4e

	if ! is-true $DISABLE_AUTORUN_GENERATING_INDEX && [ ! -f "$APPROOT/index.php" ]; then
	echo '<?php phpinfo();' >"$APPROOT/index.php"
	web-chown fix "$APPROOT/index.php" 2>&1 >/dev/null

I'd appreciate any extra details you can provide to help reproduce the problem you're running into. Let me know if you need me to clarify or expand on anything!

[dejandim]

@shinsenter
I appologize if I got this wrong, haven't noticed this feature before. I only checked the latest commit:
and saw the added $DISABLE_AUTORUN_GENERATING_INDEX.
Our application runs behind a load balancer and the index.php is not directly in the APP_PATH or DOCUMENT_ROOT, there are only softlinks to other folders. The index.php file with phpinfo() is always created and during the latest beta deployment it exposed it to the clients.
I still think the default value should be 1, or at least add a Caution tag in the readme.md. As an alternative, maybe don't use phpinfo(), something like echo 'Running PHP 8.1' should be fine and it's doesn't expose data. If I didn't check the container directly I wouldn't know such a file existed.

Thank you for your hard work

[shinsenter]

@dejandim

I think I can understand the issue you're running into.

I will consider using -e instead of -f to check if index.php already exists, since -f only checks for regular files not symlinks.

Secondly, I will only print phpinfo when the container is in debug mode (by setting DEBUG=1).

I'm not sure if these approaches will help your project, but in the meantime you can set DISABLE_AUTORUN_GENERATING_INDEX=1 to avoid the auto-generated index.php.

Let me know if this helps provide a temporary workaround!

[shinsenter]

@dejandim

New docker images with bug fixes will be queued for rebuilding on tomorrow. I hope you can understand and be patient

[shinsenter]

@dejandim
I updated new docker images with bug fixes. Please try pulling the latest images and help me verify if it has resolved your issue.