fixes that showed up by actually running the application on debian 13

Found by bringing the whole stack up in a container: apache 2.4.68 with
mod_proxy_fdpass2, the brisk-spush daemon on php 8.4 with the ancillary
extension, postgresql 17. None of these was visible with the lint, with
loading the include chain, or with the tests on the objects: they only show
up by starting the daemon and serving a real request.

sac-a-push.phh: fatal when the daemon starts
 sig_handler() was registered with pcntl_signal() as
 array("Sac_a_push", "sig_handler"), that is in static form, but declared
 non static. Since php 8 that is no longer a valid callable and
 pcntl_signal() raises a TypeError: the daemon died before opening a socket.
 It is the same class of problem as the 15 static calls already fixed, but
 with the array() syntax: the check I had written looked for "Class::method"
 and did not see it. The other two callables in that form were checked as
 well (IPClassItem::compare and Cookie::create): both already static.

INSTALL.sh: Etc/ was born exposed on the web
 The Etc directory holds the configuration with $G_dbauth, that is the
 database credentials in clear, and it falls inside the DocumentRoot. The
 .pho extension is not associated with php, so the file was served as plain
 text: checked, HTTP 200 with the content. In production it is protected only
 because someone added a .htaccess by hand; a fresh installation was born
 without one. INSTALL.sh now creates it, in the apache 2.4 form with a 2.2
 fallback. After the change: HTTP 403.

WARNING.txt: the suggested ProxyPass lines did not work
 It is the text INSTALL.sh prints to the administrator as the configuration
 to write, and it was wrong in three ways:
  - "fd:///path" is refused at configuration time by apache 2.4.68
    ("ProxyPass URL must be absolute!"); "fd://localhost/path" is needed
  - it mentioned a single "brisk.sock", from before the pool existed: the
    path is the prefix and the module appends "<N>.sock" to it
  - the hardcoded path /var/www/brisk-priv ignored the -U option
 Rewritten with the form verified to work, plus the note that the first
 argument must be an exact path and not a prefix with a trailing slash.

The file also lists, and this part was already right, which urls go to the
daemon: index.php, index_wr.php, index_rd.php, index_rd_wss.php and the
matching ones under briskin5. Everything else is served by apache.

Final check in the container: GET /brisk/index.php answers 200 with the game
page (19725 bytes), the .css are served by apache, Obj/, spush/ and
briskin5/Obj/ answer 403, Etc/ answers 403, and the daemon does not emit a
single warning or deprecation while serving the requests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014M1jiEq9cHdE5SE5j6vFuE

diff --git a/INSTALL.sh b/INSTALL.sh
index 7a441178ff1ca0a5491211d358f8e67a644dd91b..d57cef97f3804b73654b429eccc2ccc975a78814 100755 (executable)
--- a/INSTALL.sh
+++ b/INSTALL.sh
@@ -472,6 +472,26 @@ else
     cp  "${web_path}__""/Obj/brisk.conf-templ.pho" "$etc_path/$brisk_conf"
 fi
 
+# The Etc directory holds the configuration with the database credentials in
+# clear, and it falls inside the DocumentRoot: without this file
+# "$brisk_conf" can be downloaded as plain text, because the .pho extension
+# is not associated with php. Checked on apache 2.4.68: without the deny the
+# url /Etc/<conf> answers 200 with the content.
+# NOTE: nginx does not read .htaccess files, the same rule has to be written
+# in the server configuration.
+if [ ! -f "$etc_path/.htaccess" ]; then
+    echo "Protect $etc_path from the web."
+    cat > "$etc_path/.htaccess" <<'EOEOF'
+<IfModule mod_authz_core.c>
+    Require all denied
+</IfModule>
+<IfModule !mod_authz_core.c>
+    Order Deny,Allow
+    Deny from All
+</IfModule>
+EOEOF
+fi
+
 if [ -d ${web_path} ]; then
     mv ${web_path} ${web_path}.old
 fi

diff --git a/WARNING.txt b/WARNING.txt
index edd81bc71b2f6185e07157c9cd55109524fcf74f..74b0e7c2fee1cf6435cd92bceb445a4f2c588113 100644 (file)
--- a/WARNING.txt
+++ b/WARNING.txt
@@ -1,18 +1,42 @@
 APACHE2 CONFIGURATION IS CHANGED ! THIS IS A SAMPLE:
 
-ProxyPassMatch ^/brisk/.*\.(png|gif|jpg|css|js)$ !
-    ProxyPass /brisk/briskin5/index_rd.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30
-    ProxyPass /brisk/briskin5/index_rd_wss.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30
-    ProxyPass /brisk/briskin5/index_wr.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30
-    ProxyPass /brisk/briskin5/briskin5/index.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30
-    ProxyPass /brisk/briskin5/index.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30
-    ProxyPass /brisk/index_rd.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30
-    ProxyPass /brisk/index_rd_wss.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30
-    ProxyPass /brisk/index_wr.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30
-    ProxyPass /brisk/index.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30
+Replace <USOCK_PATH_PFX> with the value passed to INSTALL.sh with -U
+(default: /home/nastasi/brisk-priv/brisk).
+
+ProxyPassMatch ^/brisk/.*\.(png|gif|jpg|css|js|mp3|swf)$ !
+    ProxyPass /brisk/briskin5/index_rd.php fd://localhost<USOCK_PATH_PFX> keepalive=Off connectiontimeout=5 timeout=30
+    ProxyPass /brisk/briskin5/index_rd_wss.php fd://localhost<USOCK_PATH_PFX> keepalive=Off connectiontimeout=5 timeout=30
+    ProxyPass /brisk/briskin5/index_wr.php fd://localhost<USOCK_PATH_PFX> keepalive=Off connectiontimeout=5 timeout=30
+    ProxyPass /brisk/briskin5/briskin5/index.php fd://localhost<USOCK_PATH_PFX> keepalive=Off connectiontimeout=5 timeout=30
+    ProxyPass /brisk/briskin5/index.php fd://localhost<USOCK_PATH_PFX> keepalive=Off connectiontimeout=5 timeout=30
+    ProxyPass /brisk/index_rd.php fd://localhost<USOCK_PATH_PFX> keepalive=Off connectiontimeout=5 timeout=30
+    ProxyPass /brisk/index_rd_wss.php fd://localhost<USOCK_PATH_PFX> keepalive=Off connectiontimeout=5 timeout=30
+    ProxyPass /brisk/index_wr.php fd://localhost<USOCK_PATH_PFX> keepalive=Off connectiontimeout=5 timeout=30
+    ProxyPass /brisk/index.php fd://localhost<USOCK_PATH_PFX> keepalive=Off connectiontimeout=5 timeout=30
 --------
 #
 # PLEASE, ADD THE ErrorDocument LINE TO APACHE CONF FILE.
 #
          ErrorLog ${APACHE_LOG_DIR}/error.log
 +        ErrorDocument 500 /error.php
+
+--------
+NOTES on the shape of the ProxyPass lines (checked on apache 2.4.68):
+
+1. "fd://localhost..." and not "fd://...": apache refuses a URL with an empty
+   authority at configuration time, with "ProxyPass URL must be absolute!".
+   The host is not used to reach the socket, it only gets past the check.
+   Requires an updated mod_proxy_fdpass2.
+
+2. The path is the PREFIX of the sockets, without ".sock": the module appends
+   "<N>.sock" to it, picking N at random in the pool. With
+   -U /home/brisk/priv/brisk the daemon listens on brisk0.sock..brisk9.sock
+   and the module contacts one of those. Earlier versions of this file
+   mentioned a single "brisk.sock", from before the pool existed.
+
+3. The first argument must be an EXACT path, not a prefix with a trailing
+   slash: with "ProxyPass /brisk/ ..." mod_proxy appends the rest of the
+   requested path to the backend URL and the socket name comes out wrong.
+
+Everything that is not in this list (the static pages, admin.php,
+usermgmt.php, the .css and the .js) is still served by apache.

diff --git a/web/Obj/sac-a-push.phh b/web/Obj/sac-a-push.phh
index 801279ae2c8404f4607ab4b75a4f1af204727930..1f745e77649084b8fa95f636067f1676b36f15b0 100644 (file)
--- a/web/Obj/sac-a-push.phh
+++ b/web/Obj/sac-a-push.phh
@@ -453,7 +453,11 @@ class Sac_a_push {
     {
     }
 
-    function sig_handler($sig)
+    /* php8: registered with pcntl_signal() as array("Sac_a_push",
+       "sig_handler"), that is in static form. Not being declared static it is
+       no longer a valid callable and pcntl_signal() raises a TypeError when
+       the daemon starts. It does not use $this, only static::$cnt_master. */
+    static function sig_handler($sig)
     {
         switch ($sig) {
         case SIGINT: