[Pkg-roundcube-maintainers] Bug#1034064: roundcube-core: Default index file /usr/share/roundcube/index.php is missing closing PHP tag (?>).

[Guilhem Moulin]

Control: tag -1 moreinfo unreproducible

On Fri, 07 Apr 2023 at 14:52:01 -0500, Jonathan Hutchins wrote:
> Loading default page (.../mail) displays PHP code inestead of login page after upgrade from buster to bullseye.

index.php ends with the exact same line on buster (1.3.17+dfsg.1-1~deb10u2)
and bullseye (1.4.13+dfsg.1-1~deb11u1), and neither ends with a closing tag.
Moreover https://www.php.net/manual/en/language.basic-syntax.phptags.php
reads “If a file contains only PHP code, it is preferable to omit the
PHP closing tag at the end of the file.”

If appending a closing tag, without any other change, passes to the file
to interpreter instead of serving it as is, then I guess you have a
highly non-standard environment (and perhaps even insecure since the
config file might be exposed to the internet).  FWIW the autopkgtests
would choke if missing the closing the tag was an issue.

-- 
Guilhem.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-roundcube-maintainers/attachments/20230407/96868272/attachment.sig>