From da6d7dcf15ee10759ffbdfeccb9014ba4c8f16d1 Mon Sep 17 00:00:00 2001 From: Daniel Scherzer Date: Sun, 20 Sep 2026 15:08:35 -0700 Subject: [PATCH 1/3] LiteSpeed: document security considerations for INI overrides Make it clear that the `alter_ini()` function is indeed meant to be operating at the `ZEND_INI_SYSTEM` level, and document in the README file that only trusted sources should be granted direct access to the listener. --- sapi/litespeed/README.md | 8 ++++++++ sapi/litespeed/lsapi_main.c | 5 +++++ 2 files changed, 13 insertions(+) diff --git a/sapi/litespeed/README.md b/sapi/litespeed/README.md index 86037732953a..fd4fca3d1732 100644 --- a/sapi/litespeed/README.md +++ b/sapi/litespeed/README.md @@ -76,6 +76,14 @@ have lsphp bind to address 192.168.0.2:3000, have lsphp accept request on Unix domain socket `/tmp/lsphp_manual.sock`. +### INI Security + +The lsphp listener must only be reachable by trusted sources, generally just +LiteSpeed web front end. Any source that can set its own environment variables +can configure arbitrary PHP INI directives at the `ZEND_INI_SYSTEM` level for +that request. This is the equivalent level of access as the Apache +`php_admin_value` directive or the FPM's `PHP_ADMIN_VALUE` parameter. + ## Using LiteSpeed PHP with LiteSpeed Web Server Detailed information about how to configure LiteSpeed web server with PHP diff --git a/sapi/litespeed/lsapi_main.c b/sapi/litespeed/lsapi_main.c index 2acbd432ee84..3268aa83b703 100644 --- a/sapi/litespeed/lsapi_main.c +++ b/sapi/litespeed/lsapi_main.c @@ -774,6 +774,11 @@ static int lsapi_module_main(int show_source) } +/* The use of `type = ZEND_INI_SYSTEM when the key starts with `\x01\x04` is + * intentional - this is the mechanism by which LiteSpeed communicates the + * system-level INI options that should be set. This is only called from + * override_ini() with LSAPI_ForeachSpecialEnv(). See README.md in this + * directory for more details. */ static int alter_ini( const char * pKey, int keyLen, const char * pValue, int valLen, void * arg ) { From 85837d6260b3013794d1236789f00a451e27ffb5 Mon Sep 17 00:00:00 2001 From: Daniel Scherzer Date: Thu, 1 Oct 2026 19:07:35 -0700 Subject: [PATCH 2/3] Missing backtick --- sapi/litespeed/lsapi_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sapi/litespeed/lsapi_main.c b/sapi/litespeed/lsapi_main.c index 3268aa83b703..5b7fc3b6c84e 100644 --- a/sapi/litespeed/lsapi_main.c +++ b/sapi/litespeed/lsapi_main.c @@ -774,7 +774,7 @@ static int lsapi_module_main(int show_source) } -/* The use of `type = ZEND_INI_SYSTEM when the key starts with `\x01\x04` is +/* The use of `type = ZEND_INI_SYSTEM` when the key starts with `\x01\x04` is * intentional - this is the mechanism by which LiteSpeed communicates the * system-level INI options that should be set. This is only called from * override_ini() with LSAPI_ForeachSpecialEnv(). See README.md in this From 9a4b6c63d440dc5e808deb729da65d6d11b91a0a Mon Sep 17 00:00:00 2001 From: Daniel Scherzer Date: Mon, 19 Oct 2026 13:39:06 -0700 Subject: [PATCH 3/3] "the" --- sapi/litespeed/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sapi/litespeed/README.md b/sapi/litespeed/README.md index fd4fca3d1732..3174bb55ad74 100644 --- a/sapi/litespeed/README.md +++ b/sapi/litespeed/README.md @@ -79,7 +79,7 @@ have lsphp accept request on Unix domain socket `/tmp/lsphp_manual.sock`. ### INI Security The lsphp listener must only be reachable by trusted sources, generally just -LiteSpeed web front end. Any source that can set its own environment variables +the LiteSpeed web front end. Any source that can set its own environment variables can configure arbitrary PHP INI directives at the `ZEND_INI_SYSTEM` level for that request. This is the equivalent level of access as the Apache `php_admin_value` directive or the FPM's `PHP_ADMIN_VALUE` parameter.