Skip to content

LiteSpeed: document security considerations for INI overrides #23806

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DanielEScherzer wants to merge 1 commit into
base: master
Choose a base branch
from
+13 −0
Open

LiteSpeed: document security considerations for INI overrides #23806

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions sapi/litespeed/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,14 @@ have lsphp bind to address 192.168.0.2:3000,

have lsphp accept request on Unix domain socket `/tmp/lsphp_manual.sock`.

### INI Security

The lsphp listener must only be reachable by trusted sources, generally just
LiteSpeed web front end. Any source that can set its own environment variables
can configure arbitrary PHP INI directives at the `ZEND_INI_SYSTEM` level for
that request. This is the equivalent level of access as the Apache
`php_admin_value` directive or the FPM's `PHP_ADMIN_VALUE` parameter.

## Using LiteSpeed PHP with LiteSpeed Web Server

Detailed information about how to configure LiteSpeed web server with PHP
Expand Down
5 changes: 5 additions & 0 deletions sapi/litespeed/lsapi_main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -774,6 +774,11 @@ static int lsapi_module_main(int show_source)
}


/* The use of `type = ZEND_INI_SYSTEM when the key starts with `\x01\x04` is
* intentional - this is the mechanism by which LiteSpeed communicates the
* system-level INI options that should be set. This is only called from
* override_ini() with LSAPI_ForeachSpecialEnv(). See README.md in this
* directory for more details. */
static int alter_ini( const char * pKey, int keyLen, const char * pValue, int valLen,
void * arg )
{
Expand Down
Loading