From 129b00caad0b5661e5d20481bd74affb3f360d29 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Wed, 21 Oct 2026 10:19:50 +0200
Subject: [PATCH] Temporarily disable PHP session upload progress

---
 .gitea/workflows/container.yml | 4 ++++
 Dockerfile                     | 1 +
 README.md                      | 6 ++++++
 session-upload-progress.ini    | 3 +++
 4 files changed, 14 insertions(+)
 create mode 100644 session-upload-progress.ini

diff --git a/.gitea/workflows/container.yml b/.gitea/workflows/container.yml
index 6e9dcbd..06141b7 100644
--- a/.gitea/workflows/container.yml
+++ b/.gitea/workflows/container.yml
@@ -77,6 +77,10 @@ jobs:
               httpd -k stop
             '
           docker run --rm --entrypoint php "${IMAGE}:${COMMIT_SHA}" -r '
+            if (ini_get("session.upload_progress.enabled")) {
+                fwrite(STDERR, "PHP session upload progress must be disabled.\n");
+                exit(1);
+            }
             foreach (["exif", "gd", "iconv", "imagick", "intl", "Zend OPcache", "pgsql", "pdo_pgsql"] as $extension) {
                 if (!extension_loaded($extension)) {
                     fwrite(STDERR, "Missing PHP extension: {$extension}\n");
diff --git a/Dockerfile b/Dockerfile
index d9cac15..3588f86 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,6 +29,7 @@ RUN sed -i '/mod_mpm_event/ s/^/#/' /etc/httpd/conf/httpd.conf \
 
 COPY opcache.ini /etc/php/conf.d/opcache.ini
 COPY imagick.ini /etc/php/conf.d/imagick.ini
+COPY session-upload-progress.ini /etc/php/conf.d/session-upload-progress.ini
 COPY apache-status.conf /etc/httpd/conf/extra/apache-status.conf
 
 ENTRYPOINT ["httpd", "-DFOREGROUND"]
diff --git a/README.md b/README.md
index 22b6ba6..2478fd0 100644
--- a/README.md
+++ b/README.md
@@ -14,6 +14,12 @@ Apache exposes extended `mod_status` data only on pod-local loopback port 8080.
 The Helm chart can add an Apache exporter sidecar, a `ServiceMonitor`, and
 portable alert rules without exposing the detailed status page to the cluster.
 
+PHP session-backed upload progress is temporarily disabled in the image while
+the announced October 2026 PHP security release is pending. This does not
+disable ordinary uploads and is not a substitute for rebuilding with a fixed
+PHP package once Arch publishes it. Verify the installed PHP package in the
+built image before calling a release patched.
+
 ## Continuous integration
 
 The Gitea Actions workflow builds and tests the image on every push. It also
diff --git a/session-upload-progress.ini b/session-upload-progress.ini
new file mode 100644
index 0000000..6c1dec3
--- /dev/null
+++ b/session-upload-progress.ini
@@ -0,0 +1,3 @@
+; Temporary hardening while awaiting the October 2026 PHP security release.
+; These sites do not use PHP's session-backed upload progress tracking.
+session.upload_progress.enabled=Off