From 61638de820c0ac97d62fe369a68ab4da8e2a1c6e Mon Sep 17 00:00:00 2001
From: Robert <robert@white.fm>
Date: Fri, 23 Oct 2026 14:19:04 -0400
Subject: [PATCH] Require patched PHP and disable session upload progress

---
 Dockerfile                            |  1 +
 root/etc/php84/conf.d/99-security.ini |  4 ++++
 tests/test_login.py                   | 10 ++++++++++
 3 files changed, 15 insertions(+)
 create mode 100644 root/etc/php84/conf.d/99-security.ini

diff --git a/Dockerfile b/Dockerfile
index ff622df..c7a037d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -58,6 +58,7 @@ RUN set -ex \
       tzdata \
  && ln -sf /usr/bin/php84 /usr/bin/php \
  && ln -sf /usr/sbin/php-fpm84 /usr/sbin/php-fpm \
+ && php -r 'if (PHP_VERSION_ID < 80427) { fwrite(STDERR, "PHP 8.4.27 or newer is required for the October 2026 security fixes.\n"); exit(1); }' \
  && rm -rf /var/cache/apk/* \
  && ln -sf /dev/stdout /var/log/nginx/access.log \
  && ln -sf /dev/stderr /var/log/nginx/error.log
diff --git a/root/etc/php84/conf.d/99-security.ini b/root/etc/php84/conf.d/99-security.ini
new file mode 100644
index 0000000..cc4df27
--- /dev/null
+++ b/root/etc/php84/conf.d/99-security.ini
@@ -0,0 +1,4 @@
+; PHP advisory, 2026-10-23: keep disabled until the follow-up fix lands.
+; https://www.php.net/archive/2026.php#2026-10-23-1
+; This is defense in depth and does not replace a patched PHP runtime.
+session.upload_progress.enabled = 0
diff --git a/tests/test_login.py b/tests/test_login.py
index 107faaf..c03f3e8 100644
--- a/tests/test_login.py
+++ b/tests/test_login.py
@@ -2,6 +2,7 @@
 import re
 import requests
 import os
+import subprocess
 
 from requests.exceptions import ConnectionError
 
@@ -84,3 +85,12 @@ def test_logging_in(wallabag_service):
     assert '/starred/list' in r.text
     assert '/archive/list' in r.text
     assert '/all/list' in r.text
+
+
+def test_php_security_baseline(wallabag_service, database):
+    subprocess.run([
+        "docker", "compose", "-p", "wallabag_{}".format(database),
+        "-f", "tests/docker-compose.{}.yml".format(database),
+        "exec", "-T", "wallabag", "php", "-r",
+        'exit(PHP_VERSION_ID >= 80427 && !filter_var(ini_get("session.upload_progress.enabled"), FILTER_VALIDATE_BOOLEAN) ? 0 : 1);',
+    ], check=True)