[packages/php/PHP_7_4] opcache: mediate include_once/require_once under revalidate_path

[arekm]

commit db5d16d9ff15da7e7c73bfe4d04ba19bc35cb42c
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Wed Sep 2 00:23:42 2026 +0200

    opcache: mediate include_once/require_once under revalidate_path
    
    Those forms skipped the open(), so on a shared SHM cache one uid could run
    another uid's cached script past the LSM profile and open_basedir.

 opcache-revalidate-path-once.patch | 16 ++++++++++++++++
 php.spec                           |  4 +++-
 2 files changed, 19 insertions(+), 1 deletion(-)
---
diff --git a/php.spec b/php.spec
index 0b949a4..c7f8d9e 100644
--- a/php.spec
+++ b/php.spec
@@ -150,7 +150,7 @@ Summary(ru.UTF-8):	PHP Версии 7 - язык препроцессирова
 Summary(uk.UTF-8):	PHP Версії 7 - мова препроцесування HTML-файлів, виконувана на сервері
 Name:		%{orgname}%{php_suffix}
 Version:	7.4.33
-Release:	16
+Release:	17
 Epoch:		4
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
@@ -210,6 +210,7 @@ Patch74:	icu74.patch
 Patch75:	libxml2-2.12.patch
 Patch76:	types.patch
 Patch77:	includes.patch
+Patch78:	opcache-revalidate-path-once.patch
 URL:		https://www.php.net/
 %{?with_pdo_firebird:%{!?with_interbase_inst:BuildRequires:	Firebird-devel >= 1.0.2.908-2}}
 %{?with_pspell:BuildRequires:	aspell-devel >= 2:0.50.0}
@@ -1933,6 +1934,7 @@ cp -p php.ini-production php.ini
 %patch -P75 -p1
 %patch -P76 -p1
 %patch -P77 -p1
+%patch -P78 -p1
 
 sed -E -i -e '1s,#!\s*/usr/bin/env\s+(.*),#!%{__bindir}\1,' \
       ext/ext_skel.php \
diff --git a/opcache-revalidate-path-once.patch b/opcache-revalidate-path-once.patch
new file mode 100644
index 0000000..6e75f8f
--- /dev/null
+++ b/opcache-revalidate-path-once.patch
@@ -0,0 +1,16 @@
+Make opcache.revalidate_path cover include_once/require_once too: they take a ready
+cached script from persistent_zend_resolve_path() and skip the open(), so on an SHM
+cache shared by several uids one account can run another's cached script past the
+LSM profile or open_basedir. No-op with the default revalidate_path=0.
+
+--- php/ext/opcache/ZendAccelerator.c.orig
++++ php/ext/opcache/ZendAccelerator.c
+@@ -2574,7 +2574,7 @@
+ 			if (resolved_path) {
+ 				/* lookup by real path */
+ 				zend_accel_hash_entry *bucket = zend_accel_hash_find_entry(&ZCSG(hash), resolved_path);
+-				if (bucket) {
++				if (bucket && !ZCG(accel_directives).revalidate_path) {
+ 					zend_persistent_script *persistent_script = (zend_persistent_script *)bucket->data;
+ 					if (!persistent_script->corrupted) {
+ 						if (key) {
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/php.git/commitdiff/db5d16d9ff15da7e7c73bfe4d04ba19bc35cb42c