FPM: php_value and php_admin_value entries are applied in reverse order [.phpt test included]

[dzuelke]

Description

The following FPM config:

[global]
error_log = {{FILE:LOG}}
[unconfined]
listen = {{ADDR}}
pm = static
pm.max_children = 5
php_value[memory_limit]=32M
php_value[memory_limit]=24M
php_admin_value[date.timezone]=Europe/London
php_admin_value[date.timezone]=Europe/Paris

Resulted in this php-fpm -tt output:

…
[26-Jan-2024 07:24:03] NOTICE: 	php_value[memory_limit] = 24M
[26-Jan-2024 07:24:03] NOTICE: 	php_value[memory_limit] = 32M
[26-Jan-2024 07:24:03] NOTICE: 	php_admin_value[date.timezone] = Europe/Paris
[26-Jan-2024 07:24:03] NOTICE: 	php_admin_value[date.timezone] = Europe/London

But I expected this output instead:

…
[26-Jan-2024 07:24:03] NOTICE: 	php_value[memory_limit] = 32M
[26-Jan-2024 07:24:03] NOTICE: 	php_value[memory_limit] = 24M
[26-Jan-2024 07:24:03] NOTICE: 	php_admin_value[date.timezone] = Europe/London
[26-Jan-2024 07:24:03] NOTICE: 	php_admin_value[date.timezone] = Europe/Paris

---

Note

This is not just cosmetic ordering in php-fpm -tt; the values are also applied in this order as INI directives, so ini_get() will return 32M and Europe/London instead of the expected 24M and Europe/Paris.

---

PHPT:

<?php // this is just for GitHub syntax coloring ?>
--TEST--
FPM: GH-13249 - php_value and php_admin_value entries are applied in reverse order
--SKIPIF--
<?php include "skipif.inc"; ?>
--FILE--
<?php

require_once "tester.inc";

$cfg = <<<EOT
[global]
error_log = {{FILE:LOG}}
[unconfined]
listen = {{ADDR}}
pm = static
pm.max_children = 5
php_value[memory_limit]=32M
php_value[memory_limit]=24M
php_admin_value[date.timezone]=Europe/London
php_admin_value[date.timezone]=Europe/Paris
EOT;

$code = <<<EOT
<?php
echo "Test Start\n";
var_dump(ini_get('memory_limit'), ini_get('date.timezone'));
echo "Test End\n";
EOT;

$tester = new FPM\Tester($cfg, $code);
$tester->start();
$tester->expectLogStartNotices();
$tester->request()->expectBody([
    'Test Start',
    'string(3) "24M"',
    'string(12) "Europe/Paris"',
    'Test End'
]);
$tester->terminate();
$tester->close();

?>
Done
--EXPECT--
Done
--CLEAN--
<?php
require_once "tester.inc";
FPM\Tester::clean();
?>

Test log:

---- EXPECTED OUTPUT
Done
---- ACTUAL OUTPUT
>>> Response
----------------- OUT -----------------
X-Powered-By: PHP/8.3.2
Content-type: text/html; charset=UTF-8

Test Start
string(3) "32M"
string(13) "Europe/London"
Test End

----------------- ERR -----------------

---------------------------------------

ERROR: ==> The expected body:
Test Start
string(3) "24M"
string(12) "Europe/Paris"
Test End
==> does not match the actual body:
Test Start
string(3) "32M"
string(13) "Europe/London"
Test End

LOGS:
--------------------------------------------------------------------
[26-Jan-2024 08:55:34] NOTICE: fpm is running, pid 62872
[26-Jan-2024 08:55:34] NOTICE: ready to handle connections
--------------------------------------------------------------------

Done
---- FAILED

PHP Version

PHP 8.3.2

Operating System

No response

[bukka]

I'm aware of this and have got it on my list as one of the higher priorities. It might have some BC implications so might be potentially just for master.

Here are some related issues already reported (not all of them are the same like this one):

• post_max_size evaluates .user.ini too late in php-fpm? #8157 - post_max_size evaluates .user.ini too late in php-fpm?
• fix for GH-8157, activate sapi module before POST handling to allow to apply user.ini  #8955 - activate sapi module before POST handling to allow to apply user.ini
• https://bugs.php.net/bug.php?id=80012 - PHP_ADMIN_VALUE parameter is not correctly inherited
• https://bugs.php.net/bug.php?id=72253 - phpinfo shows only first block of admin_value[disable_functions]
• https://bugs.php.net/bug.php?id=72018 - php_admin_value override
• https://bugs.php.net/bug.php?id=68171 - php_admin_value[extension] order not maintained
• https://bugs.php.net/bug.php?id=68018 - php_value directive modifies "Changeable" context (patch)
• https://bugs.php.net/bug.php?id=60387 - Problem with php_(admin)?_value/flag and load order
• php_value[xxx] in php-fpm pool - first declaration wins #8398 - php_value[xxx] in php-fpm pool - first declaration wins

[dzuelke]

Yup agreed re: the potential BC implications, so master seems reasonable.

There is a suggestion in #8398 to make this configurable somehow; I don't think that's a good idea in terms of surface area of code to maintain in the future.

But it did make me wonder for a moment... what should the behavior be for php_admin_value? You could theoretically make that argument that the first declaration should win, and following declarations (e.g. from globbed includes) should not be able to override it once set? This way, a server admin can set a value that truly cannot be overridden.

But I'd argue that, in those kind of environments, you probably don't want users to have any control whatsoever over PHP_INI_SYSTEM level config directives, so you wouldn't give folks the ability to configure FPM directly anyway - that's what .user.ini and ini_set() are for.

So IMO, this should be fixed the same for php_value and php_admin_value - later declarations override earlier ones.