0.29.7

src/config/compile.rs

@@ -57,6 +57,10 @@ pub fn compile_with_active(
     }
     ensure!(config.web_services.len() <= 128, "too many Web Services (max 128)");
     let mut web_services = HashMap::new();
+    // PHP-FPM can retain FastCGI PHP_VALUE/PHP_ADMIN_VALUE directives in reused
+    // workers. Different directive sets on one socket can leak to the next vhost.
+    // Report unsafe legacy configurations but keep them loadable for migration.
+    let mut php_endpoint_policies: HashMap<String, (String, std::collections::BTreeMap<String, String>, std::collections::BTreeMap<String, String>)> = HashMap::new();
     for service in &mut config.web_services {
         service.validate().with_context(|| format!("Web Service {}", service.id))?;
         // A profile changes effective runtime settings, not the saved standalone
@@ -68,6 +72,21 @@ pub fn compile_with_active(
             })?.clone();
             effective.validate().with_context(|| format!("Web Service {} PHP-FPM profile {}", service.id, id))?;
         }
+        if effective.php.enabled {
+            let php = &effective.php;
+            if let Some((owner, values, admin_values)) = php_endpoint_policies.get(&php.endpoint) {
+                if values != &php.php_values || admin_values != &php.php_admin_values {
+                    tracing::warn!(
+                        service = %effective.id, other_service = %owner, endpoint = %php.endpoint,
+                        "PHP-FPM endpoint is shared by Web Services with different PHP_VALUE/PHP_ADMIN_VALUE settings; FPM worker settings can leak across requests. Use distinct PHP-FPM pools/sockets (especially for open_basedir)."
+                    );
+                }
+            } else {
+                php_endpoint_policies.insert(php.endpoint.clone(), (
+                    effective.id.clone(), php.php_values.clone(), php.php_admin_values.clone(),
+                ));
+            }
+        }
         let compiled = Arc::new(effective.compile().with_context(|| format!("Web Service {}", service.id))?);
         ensure!(web_services.insert(service.id.clone(), compiled).is_none(), "duplicate Web Service id");
     }