[packages/php/PHP_8_4] opcache: mediate include_once/require_once under revalidate_path

[arekm]

commit d3a672ef52272b8198f1daf454b3ab55a62afd2b
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Wed Sep 2 00:22:57 2026 +0200

    opcache: mediate include_once/require_once under revalidate_path
    
    Those forms skipped the open(), so on a shared SHM cache one uid could run
    another uid's cached script past the LSM profile and open_basedir.

 opcache-revalidate-path-once.patch | 16 ++++++++++++++++
 php.spec                           |  4 +++-
 2 files changed, 19 insertions(+), 1 deletion(-)
---
diff --git a/php.spec b/php.spec
index 4a7394d..d6bf3ca 100644
--- a/php.spec
+++ b/php.spec
@@ -131,7 +131,7 @@
 %define		ver_suffix	84
 %define		php_suffix	%{!?with_default_php:%{ver_suffix}}
 %define		subver		%{nil}
-%define		rel		2
+%define		rel		3
 Summary:	PHP: Hypertext Preprocessor
 Summary(fr.UTF-8):	Le langage de script embarque-HTML PHP
 Summary(pl.UTF-8):	Język skryptowy PHP
@@ -191,6 +191,7 @@ Patch59:	%{orgname}-systzdata.patch
 Patch66:	php-db.patch
 Patch67:	mysql-lib-ver-mismatch.patch
 Patch71:	libdb-info.patch
+Patch72:	opcache-revalidate-path-once.patch
 URL:		https://www.php.net/
 %{?with_pdo_firebird:%{!?with_interbase_inst:BuildRequires:	Firebird-devel >= 3.0}}
 BuildRequires:	apache-base >= 2.4.0
@@ -1803,6 +1804,7 @@ cp -p php.ini-production php.ini
 %patch -P66 -p1
 %patch -P67 -p1 -b .mysql-lib-ver-mismatch
 %patch -P71 -p1 -b .libdb-info
+%patch -P72 -p1
 
 %{__sed} -i -e '1s,/usr/bin/env php,%{_bindir}/php,' \
 	ext/ext_skel.php \
diff --git a/opcache-revalidate-path-once.patch b/opcache-revalidate-path-once.patch
new file mode 100644
index 0000000..6e75f8f
--- /dev/null
+++ b/opcache-revalidate-path-once.patch
@@ -0,0 +1,16 @@
+Make opcache.revalidate_path cover include_once/require_once too: they take a ready
+cached script from persistent_zend_resolve_path() and skip the open(), so on an SHM
+cache shared by several uids one account can run another's cached script past the
+LSM profile or open_basedir. No-op with the default revalidate_path=0.
+
+--- php/ext/opcache/ZendAccelerator.c.orig
++++ php/ext/opcache/ZendAccelerator.c
+@@ -2574,7 +2574,7 @@
+ 			if (resolved_path) {
+ 				/* lookup by real path */
+ 				zend_accel_hash_entry *bucket = zend_accel_hash_find_entry(&ZCSG(hash), resolved_path);
+-				if (bucket) {
++				if (bucket && !ZCG(accel_directives).revalidate_path) {
+ 					zend_persistent_script *persistent_script = (zend_persistent_script *)bucket->data;
+ 					if (!persistent_script->corrupted) {
+ 						if (key) {
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/php.git/commitdiff/d3a672ef52272b8198f1daf454b3ab55a62afd2b