From 7f38188479e31e8fe2c4d3a921a0d6ba60f8c86c Mon Sep 17 00:00:00 2001 From: Daniel Scherzer Date: Sun, 20 Sep 2026 15:08:35 -0700 Subject: [PATCH] LiteSpeed: document security considerations for INI overrides Make it clear that the `alter_ini()` function is indeed meant to be operating at the `ZEND_INI_SYSTEM` level, and document in the README file that only trusted sources should be granted direct access to the listener. --- sapi/litespeed/README.md | 8 ++++++++ sapi/litespeed/lsapi_main.c | 5 +++++ 2 files changed, 13 insertions(+) diff --git a/sapi/litespeed/README.md b/sapi/litespeed/README.md index 86037732953a..fd4fca3d1732 100644 --- a/sapi/litespeed/README.md +++ b/sapi/litespeed/README.md @@ -76,6 +76,14 @@ have lsphp bind to address 192.168.0.2:3000, have lsphp accept request on Unix domain socket `/tmp/lsphp_manual.sock`. +### INI Security + +The lsphp listener must only be reachable by trusted sources, generally just +LiteSpeed web front end. Any source that can set its own environment variables +can configure arbitrary PHP INI directives at the `ZEND_INI_SYSTEM` level for +that request. This is the equivalent level of access as the Apache +`php_admin_value` directive or the FPM's `PHP_ADMIN_VALUE` parameter. + ## Using LiteSpeed PHP with LiteSpeed Web Server Detailed information about how to configure LiteSpeed web server with PHP diff --git a/sapi/litespeed/lsapi_main.c b/sapi/litespeed/lsapi_main.c index 2acbd432ee84..3268aa83b703 100644 --- a/sapi/litespeed/lsapi_main.c +++ b/sapi/litespeed/lsapi_main.c @@ -774,6 +774,11 @@ static int lsapi_module_main(int show_source) } +/* The use of `type = ZEND_INI_SYSTEM when the key starts with `\x01\x04` is + * intentional - this is the mechanism by which LiteSpeed communicates the + * system-level INI options that should be set. This is only called from + * override_ini() with LSAPI_ForeachSpecialEnv(). See README.md in this + * directory for more details. */ static int alter_ini( const char * pKey, int keyLen, const char * pValue, int valLen, void * arg ) {