On 1/27/19 4:57 PM, Alice Wonder wrote:
> I can't file a bug report because I do not know what went run. I only
> know system
>
> php 7.3.1
>
> Site suddenly stopped working.
> Apache error log says:
>
> Mon Jan 28 00:45:17.896727 2019] [php7:error] [pid 4117:tid
> 140287279617792] [client 73.15.182.232:53028] PHP Fatal error:
> require_once(): Failed opening required 'base.inc.php'
> (include_path='.:/usr/share/pear:/usr/share/php') in
> /srv/[redacted]/www/controller.php on line 2
>
> That include path is interesting, it lists /usr/share/pear:/usr/share/php
>
> I set the include path in Apache config:
>
> <Directory "/srv/[redacted]/www">
> Options FollowSymlinks
> AllowOverride All
> Require all granted
> php_value include_path "/srv/[redacted]/phpinclude:/usr/share/pear"
> AddType application/x-httpd-php-source .phps
> </Directory>
>
> I never set include path in my php code.
>
> It looks like the value became corrupted and so it went to a default.
>
> Restarted Apache and everything worked.
>
> How would I find out what corrupted that setting? That sounds dangerous.
> Never happened in php 7.1.x which I ran from start, or in 7.3.0 which I
> also ran from the start. Memory corruption bug?
>
correction, it reverted to .:/usr/share/pear:/usr/share/php which is
dangerous, php should not have a default that includes the directory the
script is running from even though a lot of people like to do that.
When a path is explicitly set to NOT include the current directory,
including it in a default when the setting becomes corrupt could
(should?) be considered a security flaw.
