Merge branch '2.4'
Jordi Boggiano
commit
8913d7cac6
12
CHANGELOG.md
12
CHANGELOG.md
|
|
@ -1,3 +1,14 @@
|
|||
### [2.4.2] 2022-09-14
|
||||
|
||||
* Fixed bash completion hanging when running as root without `COMPOSER_ALLOW_SUPERUSER` set (#11024)
|
||||
* Fixed handling of plugin activation when running as root without `COMPOSER_ALLOW_SUPERUSER` set so it always happens after prompting, or does not happen if input is non-interactive
|
||||
* Fixed package filter on `bump` command (#11053)
|
||||
* Fixed handling of --ignore-platform-req with upper-bound ignores to not apply to conflict rules (#11037)
|
||||
* Fixed handling of `COMPOSER_DISCARD_CHANGES` when set to `0`
|
||||
* Fixed handling of zero-major versions in `outdated` command with `--major-only` (#11032)
|
||||
* Fixed `show --platform` regression since 2.4.0 when running in a directory without composer.json (#11046)
|
||||
* Fixed a few strict type errors
|
||||
|
||||
### [2.4.1] 2022-08-20
|
||||
|
||||
* Added a `COMPOSER_NO_AUDIT` env var to easily apply the new --no-audit flag in CI (#10998)
|
||||
|
|
@ -1626,6 +1637,7 @@
|
|||
|
||||
* Initial release
|
||||
|
||||
[2.4.2]: https://github.com/composer/composer/compare/2.4.1...2.4.2
|
||||
[2.4.1]: https://github.com/composer/composer/compare/2.4.0...2.4.1
|
||||
[2.4.0]: https://github.com/composer/composer/compare/2.4.0-RC1...2.4.0
|
||||
[2.4.0-RC1]: https://github.com/composer/composer/compare/2.3.10...2.4.0-RC1
|
||||
|
|
|
|||
|
|
@ -1959,16 +1959,16 @@
|
|||
"packages-dev": [
|
||||
{
|
||||
"name": "phpstan/phpstan",
|
||||
"version": "1.8.3",
|
||||
"version": "1.8.5",
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/phpstan/phpstan.git",
|
||||
"reference": "5583623b61caafebd62bc78a99533aa9d769d097"
|
||||
"reference": "f6598a5ff12ca4499a836815e08b4d77a2ddeb20"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/phpstan/phpstan/zipball/5583623b61caafebd62bc78a99533aa9d769d097",
|
||||
"reference": "5583623b61caafebd62bc78a99533aa9d769d097",
|
||||
"url": "https://api.github.com/repos/phpstan/phpstan/zipball/f6598a5ff12ca4499a836815e08b4d77a2ddeb20",
|
||||
"reference": "f6598a5ff12ca4499a836815e08b4d77a2ddeb20",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
|
|
@ -1998,7 +1998,7 @@
|
|||
],
|
||||
"support": {
|
||||
"issues": "https://github.com/phpstan/phpstan/issues",
|
||||
"source": "https://github.com/phpstan/phpstan/tree/1.8.3"
|
||||
"source": "https://github.com/phpstan/phpstan/tree/1.8.5"
|
||||
},
|
||||
"funding": [
|
||||
{
|
||||
|
|
@ -2014,7 +2014,7 @@
|
|||
"type": "tidelift"
|
||||
}
|
||||
],
|
||||
"time": "2022-09-01T15:27:34+00:00"
|
||||
"time": "2022-09-07T16:05:32+00:00"
|
||||
},
|
||||
{
|
||||
"name": "phpstan/phpstan-deprecation-rules",
|
||||
|
|
|
|||
|
|
@ -205,6 +205,28 @@ class Application extends BaseApplication
|
|||
}
|
||||
}
|
||||
|
||||
$needsSudoCheck = !Platform::isWindows()
|
||||
&& function_exists('exec')
|
||||
&& !Platform::getEnv('COMPOSER_ALLOW_SUPERUSER')
|
||||
&& (ini_get('open_basedir') || !file_exists('/.dockerenv'));
|
||||
$isNonAllowedRoot = false;
|
||||
|
||||
// Clobber sudo credentials if COMPOSER_ALLOW_SUPERUSER is not set before loading plugins
|
||||
if ($needsSudoCheck) {
|
||||
$isNonAllowedRoot = function_exists('posix_getuid') && posix_getuid() === 0;
|
||||
|
||||
if ($isNonAllowedRoot) {
|
||||
if ($uid = (int) Platform::getEnv('SUDO_UID')) {
|
||||
// Silently clobber any sudo credentials on the invoking user to avoid privilege escalations later on
|
||||
// ref. https://github.com/composer/composer/issues/5119
|
||||
Silencer::call('exec', "sudo -u \\#{$uid} sudo -K > /dev/null 2>&1");
|
||||
}
|
||||
}
|
||||
|
||||
// Silently clobber any remaining sudo leases on the current user as well to avoid privilege escalations
|
||||
Silencer::call('exec', 'sudo -K > /dev/null 2>&1');
|
||||
}
|
||||
|
||||
// avoid loading plugins/initializing the Composer instance earlier than necessary if no plugin command is needed
|
||||
// if showing the version, we never need plugin commands
|
||||
$mayNeedPluginCommand = false === $input->hasParameterOption(['--version', '-V'])
|
||||
|
|
@ -216,6 +238,21 @@ class Application extends BaseApplication
|
|||
);
|
||||
|
||||
if ($mayNeedPluginCommand && !$this->disablePluginsByDefault && !$this->hasPluginCommands) {
|
||||
// at this point plugins are needed, so if we are running as root and it is not allowed we need to prompt
|
||||
// if interactive, and abort otherwise
|
||||
if ($isNonAllowedRoot) {
|
||||
$io->writeError('<warning>Do not run Composer as root/super user! See https://getcomposer.org/root for details</warning>');
|
||||
|
||||
if ($io->isInteractive() && $io->askConfirmation('<info>Continue as root/super user</info> [<comment>yes</comment>]? ')) {
|
||||
// avoid a second prompt later
|
||||
$isNonAllowedRoot = false;
|
||||
} else {
|
||||
$io->writeError('<warning>Aborting as no plugin should be loaded if running as super user is not explicitly allowed</warning>');
|
||||
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
|
||||
try {
|
||||
foreach ($this->getPluginCommands() as $command) {
|
||||
if ($this->has($command->getName())) {
|
||||
|
|
@ -245,6 +282,10 @@ class Application extends BaseApplication
|
|||
$this->hasPluginCommands = true;
|
||||
}
|
||||
|
||||
if ($isNonAllowedRoot && !$io->isInteractive()) {
|
||||
$this->disablePluginsByDefault = true;
|
||||
}
|
||||
|
||||
// determine command name to be executed incl plugin commands, and check if it's a proxy command
|
||||
$isProxyCommand = false;
|
||||
if ($name = $this->getCommandName($input)) {
|
||||
|
|
@ -277,30 +318,16 @@ class Application extends BaseApplication
|
|||
$io->writeError(sprintf('<warning>Warning: This development build of Composer is over 60 days old. It is recommended to update it by running "%s self-update" to get the latest version.</warning>', $_SERVER['PHP_SELF']));
|
||||
}
|
||||
|
||||
if (
|
||||
!Platform::isWindows()
|
||||
&& function_exists('exec')
|
||||
&& !Platform::getEnv('COMPOSER_ALLOW_SUPERUSER')
|
||||
&& (ini_get('open_basedir') || !file_exists('/.dockerenv'))
|
||||
) {
|
||||
if (function_exists('posix_getuid') && posix_getuid() === 0) {
|
||||
if ($commandName !== 'self-update' && $commandName !== 'selfupdate') {
|
||||
$io->writeError('<warning>Do not run Composer as root/super user! See https://getcomposer.org/root for details</warning>');
|
||||
if ($isNonAllowedRoot) {
|
||||
if ($commandName !== 'self-update' && $commandName !== 'selfupdate' && $commandName !== '_complete') {
|
||||
$io->writeError('<warning>Do not run Composer as root/super user! See https://getcomposer.org/root for details</warning>');
|
||||
|
||||
if ($io->isInteractive()) {
|
||||
if (!$io->askConfirmation('<info>Continue as root/super user</info> [<comment>yes</comment>]? ')) {
|
||||
return 1;
|
||||
}
|
||||
if ($io->isInteractive()) {
|
||||
if (!$io->askConfirmation('<info>Continue as root/super user</info> [<comment>yes</comment>]? ')) {
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
if ($uid = (int) Platform::getEnv('SUDO_UID')) {
|
||||
// Silently clobber any sudo credentials on the invoking user to avoid privilege escalations later on
|
||||
// ref. https://github.com/composer/composer/issues/5119
|
||||
Silencer::call('exec', "sudo -u \\#{$uid} sudo -K > /dev/null 2>&1");
|
||||
}
|
||||
}
|
||||
// Silently clobber any remaining sudo leases on the current user as well to avoid privilege escalations
|
||||
Silencer::call('exec', 'sudo -K > /dev/null 2>&1');
|
||||
}
|
||||
|
||||
// Check system temp folder for usability as it can cause weird runtime issues otherwise
|
||||
|
|
|
|||
Loading…
Reference in New Issue