Tasks related to enhancing the security of Phabricator.
Details
Yesterday
One issue I'm struggling with is that some daemon parsing is failing...
One issue I'm struggling with is that some daemon parsing is failing:
Actually, Phabricator uses static::class since D21744 and it works in older PHP per 3v4l.org, so I think I'm incorrect that this requires PHP 8.
See T13637. See T13588. In PHP 8.1, the behavior of static variables in methods changed, per this snippet from the PHP Documentation:
I do want $array[null] to kill the server in the general case so all the high-quality Phabricator code I write in the future can't do it, but I realize I may need to concede and silence the error. I am going to give up on this one:
also maybe copy https://we.phorge.it/D25387, which makes it so deprecation
messages don't kill the server.
- AWS now has over 800 instance types???
- I believe I've launched a new admin with a patched PHP that is surviving a least some of the deployment process. MySQL can't upgrade databases across major versions, so I'm restoring from backup now.
- @jmeador oh hi there
- @avivey Yeah, like half the pages are working for me while logged in but things are still pretty rough.
A wild epriestley appears!
Typical state-of-the-art software upgrade process:
General state of affairs:
Wed, Oct 21
Recent versions of Ubuntu default to a sudo implemented in Rust which doesn't support -E to pass the entire environment. A quick fix for this is to select sudo.ws as an alternative:
Oct 26 2022
There are some remaining non-security bugs with this that I'll follow up on in T13682. I believe the security side of this is now resolved.
The details of this attack will be disclosed at a later date, once installs have had some sort of plausible chance to upgrade.
May 27 2022
May 17 2022
May 9 2022
I believe D21811 covers this completely.
Apr 29 2022
Just for visibility, this is I believe the change that broke Diffusion (which was fixed in rP52df4ff515b7), where the error message is something like
Apr 20 2022
I believe these were all hunted down.
Apr 14 2022
I deployed this everywhere in the Phacility cluster yesterday and things have been quiet, so I'm assuming it worked until evidence arises to the contrary.
Apr 13 2022
D21756 effectively makes all Git pathways call setSudoAsDaemon(true).
Just for visibility, the error messages you'll see if you're affected by this issue look something like this:
