Review ini_set() block in default settings.php for D7

updating links for clarity

Drupal D6 default.settings.php:

ini_set('arg_separator.output',     '&');
 ini_set('magic_quotes_runtime',     0);
 ini_set('magic_quotes_sybase',      0);
 ini_set('session.cache_expire',     200000);
 ini_set('session.cache_limiter',    'none');
 ini_set('session.cookie_lifetime',  2000000);
 ini_set('session.gc_maxlifetime',   200000);
 ini_set('session.save_handler',     'user');
 ini_set('session.use_cookies',      1);
 ini_set('session.use_only_cookies', 1);
 ini_set('session.use_trans_sid',    0);
 ini_set('url_rewriter.tags',        '');

D7 default.settings.php:

ini_set('session.gc_probability', 1);
ini_set('session.gc_divisor', 100);
ini_set('session.gc_maxlifetime', 200000);
ini_set('session.gc_maxlifetime', 200000);
 

There's also overrides in .htaccess and drupal_environment_initialize() on D7+

Two years on, IMO services like recaptcha which depend on arg_separator.output = & should set it in their calls. Ideally Provision will drop these old settings AND modules like recaptcha will cope with non-default settings for arg_separator.output.

Sites may have legit reasons to set these values (idk why) & libraries which consume services requiring specific parameter formats (even sane ones!) can enforce those settings in their service calls.

Worth noting that upstream this is addressed in the recaptcha library (commit 145bf9d2), but #2530156-4: reCAPTCHA fails if arg_separator.output is not '&' says fix there is not yet supported in the Drupal recaptcha module.

Related: #2476057: reCaptcha Verification fails when arg_separator.output is not '&', #2530156: reCAPTCHA fails if arg_separator.output is not '&', Known issue with arg_separator.output

@helmo do you think that patch will change these default settings when provisioning Drupal 6 sites? I see you covered that, but I was looking at the patch not your comment :D

Most of those D6 settings date back to a few ancient issues (#18641, #17303) when they were imported from .htaccess overrides. I think they can go, and only questions here are

(1) whether they have Aegir specific relevance since they are gone from Drupal 7+,
(2) how we provision separate settings.php for D6 and D7.

Attempting to answer (1) here by reviewing them because otherwise fear of change might stop us tidying up, but maybe it won't matter (not sure when EOL D6 is from Aegir perspective).

arg_separator.output = &

This is actively causing issues with some contrib modules / external services. Didn't see documentation for why it was added in #18641: INSTALL.txt: Include notes about Drupal subdirectories (a666c7da).

magic_quotes_runtime = 0
magic_quotes_sybase = 0

Deprecated, remove.

session.cache_expire = 200000
session.cookie_lifetime = 2000000
session.gc_maxlifetime = 200000

Default is 180. Added to default.settings.php in #17303: PHP session settings to relocate to support multiple sites, originally proposed in #2974-65: "remember me" doesn't work. Was added to work around "remember me" failing in 2003.

4f79fafb3 moved these settings from .htaccess, most were introduced in 2001 or so

session.cache_limiter = 'none'

Was this a valid value at some point? PHP docs show options "nocache, private, private_no_expire, or public" but not "none".

session.save_handler = 'user'

Previously required for session handling but apparently not needed in settings.php in D7?

session.use_cookies = 1
session.use_only_cookies = 1
session.use_trans_sid = 0

Moved to drupal_environment_initialize(), safe to remove for D7.

url_rewriter.tags = ''

No URL session IDs so no rewriting. Shouldn't be required.