Merge branch '2.4'

CHANGELOG.md

@@ -1,3 +1,14 @@
+### [2.4.2] 2022-09-14
+
+  * Fixed bash completion hanging when running as root without `COMPOSER_ALLOW_SUPERUSER` set (#11024)
+  * Fixed handling of plugin activation when running as root without `COMPOSER_ALLOW_SUPERUSER` set so it always happens after prompting, or does not happen if input is non-interactive
+  * Fixed package filter on `bump` command (#11053)
+  * Fixed handling of --ignore-platform-req with upper-bound ignores to not apply to conflict rules (#11037)
+  * Fixed handling of `COMPOSER_DISCARD_CHANGES` when set to `0`
+  * Fixed handling of zero-major versions in `outdated` command with `--major-only` (#11032)
+  * Fixed `show --platform` regression since 2.4.0 when running in a directory without composer.json (#11046)
+  * Fixed a few strict type errors
+
 ### [2.4.1] 2022-08-20
 
   * Added a `COMPOSER_NO_AUDIT` env var to easily apply the new --no-audit flag in CI (#10998)
@@ -1626,6 +1637,7 @@
 
   * Initial release
 
+[2.4.2]: https://github.com/composer/composer/compare/2.4.1...2.4.2
 [2.4.1]: https://github.com/composer/composer/compare/2.4.0...2.4.1
 [2.4.0]: https://github.com/composer/composer/compare/2.4.0-RC1...2.4.0
 [2.4.0-RC1]: https://github.com/composer/composer/compare/2.3.10...2.4.0-RC1

composer.lock

@@ -1959,16 +1959,16 @@
     "packages-dev": [
         {
             "name": "phpstan/phpstan",
-            "version": "1.8.3",
+            "version": "1.8.5",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpstan/phpstan.git",
-                "reference": "5583623b61caafebd62bc78a99533aa9d769d097"
+                "reference": "f6598a5ff12ca4499a836815e08b4d77a2ddeb20"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/5583623b61caafebd62bc78a99533aa9d769d097",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/f6598a5ff12ca4499a836815e08b4d77a2ddeb20",
-                "reference": "5583623b61caafebd62bc78a99533aa9d769d097",
+                "reference": "f6598a5ff12ca4499a836815e08b4d77a2ddeb20",
                 "shasum": ""
             },
             "require": {
@@ -1998,7 +1998,7 @@
             ],
             "support": {
                 "issues": "https://github.com/phpstan/phpstan/issues",
-                "source": "https://github.com/phpstan/phpstan/tree/1.8.3"
+                "source": "https://github.com/phpstan/phpstan/tree/1.8.5"
             },
             "funding": [
                 {
@@ -2014,7 +2014,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2022-09-01T15:27:34+00:00"
+            "time": "2022-09-07T16:05:32+00:00"
         },
         {
             "name": "phpstan/phpstan-deprecation-rules",

src/Composer/Console/Application.php

@@ -205,6 +205,28 @@ class Application extends BaseApplication
             }
         }
 
+        $needsSudoCheck = !Platform::isWindows()
+            && function_exists('exec')
+            && !Platform::getEnv('COMPOSER_ALLOW_SUPERUSER')
+            && (ini_get('open_basedir') || !file_exists('/.dockerenv'));
+        $isNonAllowedRoot = false;
+
+        // Clobber sudo credentials if COMPOSER_ALLOW_SUPERUSER is not set before loading plugins
+        if ($needsSudoCheck) {
+            $isNonAllowedRoot = function_exists('posix_getuid') && posix_getuid() === 0;
+
+            if ($isNonAllowedRoot) {
+                if ($uid = (int) Platform::getEnv('SUDO_UID')) {
+                    // Silently clobber any sudo credentials on the invoking user to avoid privilege escalations later on
+                    // ref. https://github.com/composer/composer/issues/5119
+                    Silencer::call('exec', "sudo -u \\#{$uid} sudo -K > /dev/null 2>&1");
+                }
+            }
+
+            // Silently clobber any remaining sudo leases on the current user as well to avoid privilege escalations
+            Silencer::call('exec', 'sudo -K > /dev/null 2>&1');
+        }
+
         // avoid loading plugins/initializing the Composer instance earlier than necessary if no plugin command is needed
         // if showing the version, we never need plugin commands
         $mayNeedPluginCommand = false === $input->hasParameterOption(['--version', '-V'])
@@ -216,6 +238,21 @@ class Application extends BaseApplication
             );
 
         if ($mayNeedPluginCommand && !$this->disablePluginsByDefault && !$this->hasPluginCommands) {
+            // at this point plugins are needed, so if we are running as root and it is not allowed we need to prompt
+            // if interactive, and abort otherwise
+            if ($isNonAllowedRoot) {
+                $io->writeError('<warning>Do not run Composer as root/super user! See https://getcomposer.org/root for details</warning>');
+
+                if ($io->isInteractive() && $io->askConfirmation('<info>Continue as root/super user</info> [<comment>yes</comment>]? ')) {
+                    // avoid a second prompt later
+                    $isNonAllowedRoot = false;
+                } else {
+                    $io->writeError('<warning>Aborting as no plugin should be loaded if running as super user is not explicitly allowed</warning>');
+
+                    return 1;
+                }
+            }
+
             try {
                 foreach ($this->getPluginCommands() as $command) {
                     if ($this->has($command->getName())) {
@@ -245,6 +282,10 @@ class Application extends BaseApplication
             $this->hasPluginCommands = true;
         }
 
+        if ($isNonAllowedRoot && !$io->isInteractive()) {
+            $this->disablePluginsByDefault = true;
+        }
+
         // determine command name to be executed incl plugin commands, and check if it's a proxy command
         $isProxyCommand = false;
         if ($name = $this->getCommandName($input)) {
@@ -277,30 +318,16 @@ class Application extends BaseApplication
                 $io->writeError(sprintf('<warning>Warning: This development build of Composer is over 60 days old. It is recommended to update it by running "%s self-update" to get the latest version.</warning>', $_SERVER['PHP_SELF']));
             }
 
-            if (
+            if ($isNonAllowedRoot) {
-                !Platform::isWindows()
+                if ($commandName !== 'self-update' && $commandName !== 'selfupdate' && $commandName !== '_complete') {
-                && function_exists('exec')
+                    $io->writeError('<warning>Do not run Composer as root/super user! See https://getcomposer.org/root for details</warning>');
-                && !Platform::getEnv('COMPOSER_ALLOW_SUPERUSER')
-                && (ini_get('open_basedir') || !file_exists('/.dockerenv'))
-            ) {
-                if (function_exists('posix_getuid') && posix_getuid() === 0) {
-                    if ($commandName !== 'self-update' && $commandName !== 'selfupdate') {
-                        $io->writeError('<warning>Do not run Composer as root/super user! See https://getcomposer.org/root for details</warning>');
 
-                        if ($io->isInteractive()) {
+                    if ($io->isInteractive()) {
-                            if (!$io->askConfirmation('<info>Continue as root/super user</info> [<comment>yes</comment>]? ')) {
+                        if (!$io->askConfirmation('<info>Continue as root/super user</info> [<comment>yes</comment>]? ')) {
-                                return 1;
+                            return 1;
-                            }
                         }
                     }
-                    if ($uid = (int) Platform::getEnv('SUDO_UID')) {
-                        // Silently clobber any sudo credentials on the invoking user to avoid privilege escalations later on
-                        // ref. https://github.com/composer/composer/issues/5119
-                        Silencer::call('exec', "sudo -u \\#{$uid} sudo -K > /dev/null 2>&1");
-                    }
                 }
-                // Silently clobber any remaining sudo leases on the current user as well to avoid privilege escalations
-                Silencer::call('exec', 'sudo -K > /dev/null 2>&1');
             }
 
             // Check system temp folder for usability as it can cause weird runtime issues otherwise