[packages/php/PHP_8_2] opcache: mediate include_once/require_once under revalidate_path

[arekm]

commit 7440dada76246ae39e81ef128c03663379a3bb83
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Wed Sep 2 00:23:42 2026 +0200

    opcache: mediate include_once/require_once under revalidate_path
    
    Those forms skipped the open(), so on a shared SHM cache one uid could run
    another uid's cached script past the LSM profile and open_basedir.

 opcache-revalidate-path-once.patch | 16 ++++++++++++++++
 php.spec                           |  4 +++-
 2 files changed, 19 insertions(+), 1 deletion(-)
---
diff --git a/php.spec b/php.spec
index e8145f7..655705a 100644
--- a/php.spec
+++ b/php.spec
@@ -142,7 +142,7 @@
 %define		ver_suffix	82
 %define		php_suffix	%{!?with_default_php:%{ver_suffix}}
 %define		subver		%{nil}
-%define		rel		2
+%define		rel		3
 Summary:	PHP: Hypertext Preprocessor
 Summary(fr.UTF-8):	Le langage de script embarque-HTML PHP
 Summary(pl.UTF-8):	Język skryptowy PHP
@@ -208,6 +208,7 @@ Patch67:	mysql-lib-ver-mismatch.patch
 # https://bugs.php.net/bug.php?id=68344
 Patch68:	php-mysql-ssl-context.patch
 Patch71:	libdb-info.patch
+Patch72:	opcache-revalidate-path-once.patch
 URL:		https://www.php.net/
 %{?with_pdo_firebird:%{!?with_interbase_inst:BuildRequires:	Firebird-devel >= 1.0.2.908-2}}
 %{?with_pspell:BuildRequires:	aspell-devel >= 2:0.50.0}
@@ -1907,6 +1908,7 @@ cp -p php.ini-production php.ini
 %patch -P67 -p1 -b .mysql-lib-ver-mismatch
 #%%patch68 -p1 DROP or update to 7.0 APIs
 %patch -P71 -p1 -b .libdb-info
+%patch -P72 -p1
 
 %{__sed} -i -e '1s,/usr/bin/env php,%{_bindir}/php,' \
 	ext/ext_skel.php \
diff --git a/opcache-revalidate-path-once.patch b/opcache-revalidate-path-once.patch
new file mode 100644
index 0000000..6e75f8f
--- /dev/null
+++ b/opcache-revalidate-path-once.patch
@@ -0,0 +1,16 @@
+Make opcache.revalidate_path cover include_once/require_once too: they take a ready
+cached script from persistent_zend_resolve_path() and skip the open(), so on an SHM
+cache shared by several uids one account can run another's cached script past the
+LSM profile or open_basedir. No-op with the default revalidate_path=0.
+
+--- php/ext/opcache/ZendAccelerator.c.orig
++++ php/ext/opcache/ZendAccelerator.c
+@@ -2574,7 +2574,7 @@
+ 			if (resolved_path) {
+ 				/* lookup by real path */
+ 				zend_accel_hash_entry *bucket = zend_accel_hash_find_entry(&ZCSG(hash), resolved_path);
+-				if (bucket) {
++				if (bucket && !ZCG(accel_directives).revalidate_path) {
+ 					zend_persistent_script *persistent_script = (zend_persistent_script *)bucket->data;
+ 					if (!persistent_script->corrupted) {
+ 						if (key) {
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/php.git/commitdiff/7440dada76246ae39e81ef128c03663379a3bb83