Default php ini now disable php system dangerous function

.github/workflows/glpi-development-env.yml

@@ -16,9 +16,30 @@ on:
   # Enable manual run
   workflow_dispatch:
 
+env:
+  DOCKER_IMAGES_REPO: ${{ vars.DOCKER_IMAGES_REPO || 'glpi-project/docker-images' }}
+  DOCKERHUB_DEV_IMAGE: ${{ vars.DOCKERHUB_DEV_IMAGE || 'glpi/glpi-development-env' }}
+  GHCR_DEV_IMAGE: ${{ vars.GHCR_DEV_IMAGE || 'ghcr.io/glpi-project/glpi-development-env' }}
+
 jobs:
+  prepare:
+    name: "Prepare"
+    runs-on: "ubuntu-latest"
+    outputs:
+      push: ${{ steps.set-vars.outputs.push }}
+    steps:
+      - name: "Set variables"
+        id: "set-vars"
+        run: |
+          PUSH="false"
+          if [[ "${{ github.ref }}" = 'refs/heads/main' && "${{ github.repository }}" = "${{ env.DOCKER_IMAGES_REPO }}" ]]; then
+              PUSH="true"
+          fi
+          echo "push=$PUSH" >> $GITHUB_OUTPUT
+
   build:
     runs-on: "ubuntu-latest"
+    needs: [prepare]
     strategy:
       fail-fast: false
       matrix:
@@ -31,23 +52,18 @@ jobs:
           - {base-image: "php:8.4-apache-trixie", php-version: "8.4", latest: "false"}
           - {base-image: "php:8.5-apache-trixie", php-version: "8.5", latest: "true"}
     steps:
-      - name: "Set variables"
-        run: |
-          OUTPUTS="type=image"
-          if [[ "${{ github.ref }}" = 'refs/heads/main' && "${{ github.repository }}" = 'glpi-project/docker-images' ]]; then
-              OUTPUTS="$OUTPUTS,push=true"
-          fi
-          echo "OUTPUTS=$OUTPUTS" >> $GITHUB_ENV
       - name: "Checkout"
         uses: "actions/checkout@v6"
       - name: "Set up Docker Buildx"
         uses: "docker/setup-buildx-action@v3"
       - name: "Login to DockerHub"
+        if: ${{ needs.prepare.outputs.push == 'true' }}
         uses: "docker/login-action@v3"
         with:
           username: "${{ secrets.DOCKER_HUB_USERNAME }}"
           password: "${{ secrets.DOCKER_HUB_TOKEN }}"
       - name: "Login to Github container registry"
+        if: ${{ needs.prepare.outputs.push == 'true' }}
         uses: "docker/login-action@v3"
         with:
           registry: "ghcr.io"
@@ -57,10 +73,10 @@ jobs:
         uses: "docker/build-push-action@v6"
         with:
           build-args: |
-            BASE_IMAGE=${{ matrix.base-image }}
+             BASE_IMAGE=${{ matrix.base-image }}
           cache-from: "type=gha"
           cache-to: "type=gha,mode=max"
           context: "glpi-development-env"
-          outputs: "${{ env.OUTPUTS }}"
+          outputs: "type=image,push=${{ needs.prepare.outputs.push }}"
           pull: true
-          tags: "ghcr.io/glpi-project/glpi-development-env:${{ matrix.php-version }}${{ matrix.latest == 'true' && ',ghcr.io/glpi-project/glpi-development-env:latest' || '' }}"
+          tags: "${{ env.GHCR_DEV_IMAGE }}:${{ matrix.php-version }}${{ matrix.latest == 'true' && format(',{0}:latest', env.GHCR_DEV_IMAGE) || '' }}"

glpi-development-env/files/etc/apache2/vhosts/glpi-common.conf

@@ -11,6 +11,9 @@ CustomLog ${APACHE_LOG_DIR}/access.log combined
     # Prevent bearer authorization token filtering
     RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
 
+    # Disable dangerous PHP functions to prevent RCE
+    php_admin_value disable_functions "exec,shell_exec,system,passthru,proc_open,popen,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_unshare,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname,posix_times,posix_getlogin,posix_ttyname,posix_ctermid,posix_getcwd,posix_getgrgid,posix_getgrnam,posix_getgroups,posix_getpgrp,posix_getpid,posix_getppid,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_getsid,posix_getuid,posix_initgroups,posix_isatty,posix_mknod,posix_access,putenv,dl,openlog,syslog,closelog,apache_child_terminate,apache_setenv"
+
     # Redirect all requests to GLPI router, unless file exists.
     RewriteCond %{REQUEST_FILENAME} !-f
     RewriteRule ^(.*)$ index.php [QSA,L]

glpi/files/etc/apache2/conf-available/zzz-glpi.conf

@@ -9,3 +9,6 @@ ServerName localhost
 # Harden Apache against fingerprinting
 ServerTokens Prod
 ServerSignature Off
+
+# Disable dangerous PHP functions to prevent RCE
+php_admin_value disable_functions "exec,shell_exec,system,passthru,proc_open,popen,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_unshare,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname,posix_times,posix_getlogin,posix_ttyname,posix_ctermid,posix_getcwd,posix_getgrgid,posix_getgrnam,posix_getgroups,posix_getpgrp,posix_getpid,posix_getppid,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_getsid,posix_getuid,posix_initgroups,posix_isatty,posix_mknod,posix_access,putenv,dl,openlog,syslog,closelog,apache_child_terminate,apache_setenv"

glpi/files/etc/php/conf.d/glpi.ini

@@ -11,3 +11,8 @@ session.gc_probability = 1
 session.gc_divisor = 100
 ; Same value as CronTask::cronSession
 session.gc_maxlifetime = 60480
+
+; Disable dangerous PHP functions to prevent RCE
+; This ini conf is used for CLI. Web request are secured by `php_admin_value` in apache config.
+; We remove `proc_open` from disabled functions so we can run commands like tools:locales:compile
+disable_functions = exec,shell_exec,system,passthru,proc_open,popen,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_unshare,posix_kill,posix_mkfifo,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname,posix_times,posix_getlogin,posix_ttyname,posix_ctermid,posix_getcwd,posix_getgrgid,posix_getgrnam,posix_getgroups,posix_getpgrp,posix_getpid,posix_getppid,posix_getpwnam,posix_getpwuid,posix_getrlimit,posix_getsid,posix_getuid,posix_initgroups,posix_isatty,posix_mknod,posix_access,putenv,dl,openlog,syslog,closelog,apache_child_terminate,apache_setenv