8.2.24

[N6REJ]

PR Type

Enhancement

---

Description

• Added support for new PHP versions: 8.1.31, 8.2.26, 8.3.14, 8.4.1
• Added/updated configuration files (php.ini) for all new PHP versions with standard settings
• Updated ImageMagick dependency from 7.1.1-38 to 7.1.1-34 for PHP 8.1.30
• Added extension configurations for PHP 8.3.14 (imagick, memcache, xdebug)
• Updated bundle release version to 2024.9.14
• Removed PHP 8.3.12 and test.bat

---

Changes walkthrough 📝

	Relevant files
Configuration changes	7 files php.ini.ber Add PHP 8.2.26 configuration file                                                bin/php8.2.26/php.ini.ber Added new PHP 8.2.26 configuration file with standard PHP INI settings Configured paths, extensions, and PHP specific settings Set up error handling, caching, and performance options +1979/-0 php.ini.ber Configure PHP 8.4.1 paths and settings                                      bin/php8.4.1/php.ini.ber Updated paths to point to PHP 8.4.1 installation Modified include_path and extension_dir settings Updated zend_extension path for opcache +3/-3      php.ini Configure PHP 8.1.31 paths and settings                                    bin/php8.1.31/php.ini Updated paths to point to PHP 8.1.31 installation Modified include_path and extension_dir settings Updated zend_extension path for opcache +3/-3      exts.properties Add PHP 8.3.14 extension configurations                                    bin/php8.3.14/exts.properties Added imagick, memcache, and xdebug extension configurations Specified download URLs for PHP 8.3 extensions +4/-1      build.properties Update bundle release version                                                        build.properties Updated bundle release version from 2024.11.30 to 2024.9.14 +1/-1      php.ini.ber Initial PHP 8.1.31 configuration file setup                            bin/php8.1.31/php.ini.ber Added comprehensive PHP configuration file with default settings Configured core PHP settings including memory limits, error handling, and session management Set up extensions like mysqli, pdo, openssl, and xdebug Defined development-specific settings for debugging and error reporting +1960/-0 php.ini.ber New PHP 8.3.14 Configuration File Addition                              bin/php8.3.14/php.ini.ber Initial configuration file for PHP 8.3.14 with comprehensive settings Includes core PHP settings, module configurations, and extension settings Contains development-oriented settings like error reporting and debugging Configures paths, memory limits, session handling and other key PHP parameters +1959/-0
Enhancement	1 files releases.properties Update PHP versions and download URLs                                        releases.properties Added new PHP versions: 8.1.31, 8.2.26, 8.3.14, 8.4.1 Updated download URLs for existing versions Removed old PHP version 8.3.12 +5/-2
Dependencies	1 files deps.properties Update ImageMagick dependency version                                        bin/php8.1.30/deps.properties Updated ImageMagick dependency version from 7.1.1-38 to 7.1.1-34 +1/-1
Additional files (token-limit)	3 files php.ini ...                                                                                                            bin/php8.2.26/php.ini ... +1959/-0 php.ini ...                                                                                                            bin/php8.3.14/php.ini ... +1959/-0 php.ini ...                                                                                                            bin/php8.4.1/php.ini ... +1959/-0

---

💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

[qodo-merge-pro]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Configuration Issue The include_path setting points to a different PHP version (8.3.12) than the actual version (8.4.1). This could cause issues with PEAR functionality. Configuration Issue The include_path and extension_dir settings point to PHP 8.3.12 instead of 8.1.31. This could cause loading issues for extensions and PEAR.

[qodo-merge-pro]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Score
Security	Disable error display in production to prevent information leakage The display_errors setting is enabled which can expose sensitive information in error messages. This should be disabled in production environments. bin/php8.2.26/php.ini.ber [501] -display_errors = On +display_errors = Off Apply this suggestion Suggestion importance[1-10]: 9 Why: Displaying errors in production can expose sensitive application details and server information to potential attackers, making this a critical security concern.	9
	Disable PHP version disclosure in HTTP headers to improve security Set expose_php to Off to prevent exposing PHP version information in HTTP headers, which could help attackers identify vulnerabilities. bin/php8.1.31/php.ini.ber [397] -expose_php = On +expose_php = Off Apply this suggestion Suggestion importance[1-10]: 9 Why: Hiding PHP version information is a critical security measure that prevents attackers from identifying vulnerable PHP versions and targeting known exploits.	9
	Prevent exposure of sensitive error information in production environments Set display_errors to Off in production to prevent exposing sensitive error information to users. bin/php8.1.31/php.ini.ber [500] -display_errors = On +display_errors = Off Apply this suggestion Suggestion importance[1-10]: 9 Why: Displaying errors in production can expose sensitive application details to potential attackers. This change is crucial for maintaining security in production environments.	9
	Disable dangerous PHP functions to prevent potential system-level attacks Disable potentially dangerous PHP functions that could be used for attacks by setting disable_functions. bin/php8.3.14/php.ini.ber [322] -disable_functions = +disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source Apply this suggestion Suggestion importance[1-10]: 9 Why: Disabling dangerous system-level PHP functions is crucial for security as it prevents potential remote code execution and system command injection attacks.	9
	Disable PHP version exposure in HTTP headers to improve security The expose_php setting is enabled which reveals PHP version information in HTTP headers, creating a potential security risk by exposing system information to attackers. bin/php8.2.26/php.ini.ber [398] -expose_php = On +expose_php = Off Apply this suggestion Suggestion importance[1-10]: 8 Why: Exposing PHP version information in HTTP headers is a security risk as it helps attackers identify potential vulnerabilities specific to the PHP version being used.	8
	Prevent remote file inclusion vulnerabilities by disabling URL-based file operations Disable allow_url_fopen to prevent remote file inclusion attacks and restrict PHP from opening remote URLs as files. bin/php8.1.31/php.ini.ber [869] -allow_url_fopen = On +allow_url_fopen = Off Apply this suggestion Suggestion importance[1-10]: 8 Why: Disabling allow_url_fopen is a significant security improvement that prevents remote file inclusion attacks and reduces the attack surface of the application.	8
	Disable PHP version exposure in HTTP headers to prevent information disclosure Disable PHP version exposure in HTTP headers to improve security by preventing attackers from identifying PHP version information. bin/php8.3.14/php.ini.ber [397] -expose_php = On +expose_php = Off Apply this suggestion Suggestion importance[1-10]: 8 Why: Hiding PHP version information is a critical security measure that prevents attackers from exploiting known vulnerabilities in specific PHP versions.	8
	Set a maximum limit on input variables to prevent DOS attacks Set a secure value for max_input_vars to prevent potential DOS attacks via numerous POST variables. bin/php8.3.14/php.ini.ber [423] -;max_input_vars = 1000 +max_input_vars = 1000 Apply this suggestion Suggestion importance[1-10]: 7 Why: Uncommenting and setting max_input_vars helps prevent denial-of-service attacks through excessive POST variables, while still allowing legitimate form submissions.	7
General	Enable output buffering with appropriate buffer size to improve performance The output_buffering setting is set to "off" which can impact performance. For production environments, setting this to 4096 bytes is recommended for better performance through buffered output. bin/php8.2.26/php.ini.ber [225] -output_buffering = off +output_buffering = 4096 Apply this suggestion Suggestion importance[1-10]: 7 Why: Setting output_buffering to 4096 can significantly improve performance by reducing packet overhead and enabling better output control, as recommended in the PHP documentation for production environments.	7