From: Matteo Nastasi Date: Sun, 13 Sep 2026 10:31:28 +0000 (+0200) Subject: fixes that showed up by actually running the application on debian 13 X-Git-Url: https://mop.ddnsfree.com/gitweb/?a=commitdiff_plain;h=bcf862a9ace8a91a0022f3cf7daf97fc53d41850;p=brisk.git fixes that showed up by actually running the application on debian 13 Found by bringing the whole stack up in a container: apache 2.4.68 with mod_proxy_fdpass2, the brisk-spush daemon on php 8.4 with the ancillary extension, postgresql 17. None of these was visible with the lint, with loading the include chain, or with the tests on the objects: they only show up by starting the daemon and serving a real request. sac-a-push.phh: fatal when the daemon starts sig_handler() was registered with pcntl_signal() as array("Sac_a_push", "sig_handler"), that is in static form, but declared non static. Since php 8 that is no longer a valid callable and pcntl_signal() raises a TypeError: the daemon died before opening a socket. It is the same class of problem as the 15 static calls already fixed, but with the array() syntax: the check I had written looked for "Class::method" and did not see it. The other two callables in that form were checked as well (IPClassItem::compare and Cookie::create): both already static. INSTALL.sh: Etc/ was born exposed on the web The Etc directory holds the configuration with $G_dbauth, that is the database credentials in clear, and it falls inside the DocumentRoot. The .pho extension is not associated with php, so the file was served as plain text: checked, HTTP 200 with the content. In production it is protected only because someone added a .htaccess by hand; a fresh installation was born without one. INSTALL.sh now creates it, in the apache 2.4 form with a 2.2 fallback. After the change: HTTP 403. WARNING.txt: the suggested ProxyPass lines did not work It is the text INSTALL.sh prints to the administrator as the configuration to write, and it was wrong in three ways: - "fd:///path" is refused at configuration time by apache 2.4.68 ("ProxyPass URL must be absolute!"); "fd://localhost/path" is needed - it mentioned a single "brisk.sock", from before the pool existed: the path is the prefix and the module appends ".sock" to it - the hardcoded path /var/www/brisk-priv ignored the -U option Rewritten with the form verified to work, plus the note that the first argument must be an exact path and not a prefix with a trailing slash. The file also lists, and this part was already right, which urls go to the daemon: index.php, index_wr.php, index_rd.php, index_rd_wss.php and the matching ones under briskin5. Everything else is served by apache. Final check in the container: GET /brisk/index.php answers 200 with the game page (19725 bytes), the .css are served by apache, Obj/, spush/ and briskin5/Obj/ answer 403, Etc/ answers 403, and the daemon does not emit a single warning or deprecation while serving the requests. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_014M1jiEq9cHdE5SE5j6vFuE --- diff --git a/INSTALL.sh b/INSTALL.sh index 7a44117..d57cef9 100755 --- a/INSTALL.sh +++ b/INSTALL.sh @@ -472,6 +472,26 @@ else cp "${web_path}__""/Obj/brisk.conf-templ.pho" "$etc_path/$brisk_conf" fi +# The Etc directory holds the configuration with the database credentials in +# clear, and it falls inside the DocumentRoot: without this file +# "$brisk_conf" can be downloaded as plain text, because the .pho extension +# is not associated with php. Checked on apache 2.4.68: without the deny the +# url /Etc/ answers 200 with the content. +# NOTE: nginx does not read .htaccess files, the same rule has to be written +# in the server configuration. +if [ ! -f "$etc_path/.htaccess" ]; then + echo "Protect $etc_path from the web." + cat > "$etc_path/.htaccess" <<'EOEOF' + + Require all denied + + + Order Deny,Allow + Deny from All + +EOEOF +fi + if [ -d ${web_path} ]; then mv ${web_path} ${web_path}.old fi diff --git a/WARNING.txt b/WARNING.txt index edd81bc..74b0e7c 100644 --- a/WARNING.txt +++ b/WARNING.txt @@ -1,18 +1,42 @@ APACHE2 CONFIGURATION IS CHANGED ! THIS IS A SAMPLE: -ProxyPassMatch ^/brisk/.*\.(png|gif|jpg|css|js)$ ! - ProxyPass /brisk/briskin5/index_rd.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30 - ProxyPass /brisk/briskin5/index_rd_wss.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30 - ProxyPass /brisk/briskin5/index_wr.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30 - ProxyPass /brisk/briskin5/briskin5/index.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30 - ProxyPass /brisk/briskin5/index.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30 - ProxyPass /brisk/index_rd.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30 - ProxyPass /brisk/index_rd_wss.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30 - ProxyPass /brisk/index_wr.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30 - ProxyPass /brisk/index.php fd:///var/www/brisk-priv/brisk.sock keepalive=Off connectiontimeout=5 timeout=30 +Replace with the value passed to INSTALL.sh with -U +(default: /home/nastasi/brisk-priv/brisk). + +ProxyPassMatch ^/brisk/.*\.(png|gif|jpg|css|js|mp3|swf)$ ! + ProxyPass /brisk/briskin5/index_rd.php fd://localhost keepalive=Off connectiontimeout=5 timeout=30 + ProxyPass /brisk/briskin5/index_rd_wss.php fd://localhost keepalive=Off connectiontimeout=5 timeout=30 + ProxyPass /brisk/briskin5/index_wr.php fd://localhost keepalive=Off connectiontimeout=5 timeout=30 + ProxyPass /brisk/briskin5/briskin5/index.php fd://localhost keepalive=Off connectiontimeout=5 timeout=30 + ProxyPass /brisk/briskin5/index.php fd://localhost keepalive=Off connectiontimeout=5 timeout=30 + ProxyPass /brisk/index_rd.php fd://localhost keepalive=Off connectiontimeout=5 timeout=30 + ProxyPass /brisk/index_rd_wss.php fd://localhost keepalive=Off connectiontimeout=5 timeout=30 + ProxyPass /brisk/index_wr.php fd://localhost keepalive=Off connectiontimeout=5 timeout=30 + ProxyPass /brisk/index.php fd://localhost keepalive=Off connectiontimeout=5 timeout=30 -------- # # PLEASE, ADD THE ErrorDocument LINE TO APACHE CONF FILE. # ErrorLog ${APACHE_LOG_DIR}/error.log + ErrorDocument 500 /error.php + +-------- +NOTES on the shape of the ProxyPass lines (checked on apache 2.4.68): + +1. "fd://localhost..." and not "fd://...": apache refuses a URL with an empty + authority at configuration time, with "ProxyPass URL must be absolute!". + The host is not used to reach the socket, it only gets past the check. + Requires an updated mod_proxy_fdpass2. + +2. The path is the PREFIX of the sockets, without ".sock": the module appends + ".sock" to it, picking N at random in the pool. With + -U /home/brisk/priv/brisk the daemon listens on brisk0.sock..brisk9.sock + and the module contacts one of those. Earlier versions of this file + mentioned a single "brisk.sock", from before the pool existed. + +3. The first argument must be an EXACT path, not a prefix with a trailing + slash: with "ProxyPass /brisk/ ..." mod_proxy appends the rest of the + requested path to the backend URL and the socket name comes out wrong. + +Everything that is not in this list (the static pages, admin.php, +usermgmt.php, the .css and the .js) is still served by apache. diff --git a/web/Obj/sac-a-push.phh b/web/Obj/sac-a-push.phh index 801279a..1f745e7 100644 --- a/web/Obj/sac-a-push.phh +++ b/web/Obj/sac-a-push.phh @@ -453,7 +453,11 @@ class Sac_a_push { { } - function sig_handler($sig) + /* php8: registered with pcntl_signal() as array("Sac_a_push", + "sig_handler"), that is in static form. Not being declared static it is + no longer a valid callable and pcntl_signal() raises a TypeError when + the daemon starts. It does not use $this, only static::$cnt_master. */ + static function sig_handler($sig) { switch ($sig) { case SIGINT: