The current core/rebuild.php script has
// Clear the APC cache to ensure APC class loader is reset.
if (function_exists('apc_fetch')) {
apc_clear_cache('user');
}
near the top of the file OUTSIDE the access check. This can lead to a DOS situation, where constant GETs of core/rebuild.php will clear the user cache.
Quoting @alexpott
the class map doesn't need clearing in rebuild.php btw
if a class moves it's PSR namespace changes... you get a cache miss - which is not a problem.
Comment | File | Size | Author |
---|---|---|---|
#8 | 2476247.8.patch | 960 bytes | alexpott |
#2 | 2476247.2.patch | 449 bytes | alexpott |
#1 | rebuild_php_clears_apu-2476247-1.patch | 998 bytes | mpdonadio |
Comments
Comment #1
mpdonadioComment #2
alexpottThe run tests part of this part will not work - run-tests.sh runs from cli and can not clear the web server cache. The other part of the patch is critical because of the potential DOS.
Comment #3
BerdirNot so sure about that.
Yes, if the namespace changes, new classes or deleted classes, we're fine.
But our module system allows to move modules around, for example, you might have some_module in profiles/something/modules, and then add a site specific override at /modules/some_module. Then all those classes of that module would now point to the wrong folder.
I'd suggest to move this inside drupal_flush_all_caches()...
Comment #4
alexpottWe can't move it into
drupal_flush_all_caches()
because that will remove the benefits of caching YAML files in APC user cache.Comment #5
Fabianx CreditAttribution: Fabianx commentedI am happy to remove it from core/rebuild.php again or put it after the access check, but what the patch does, does not fly as:
cmdline APC != web APC
That is why it was in rebuild.php in the first place ...
Comment #6
Fabianx CreditAttribution: Fabianx commented#2: Can we just move it after the access check in rebuild.php?
Comment #7
alexpottComment #8
alexpottOkay let's move it and also fix php 5.5+
Comment #9
Fabianx CreditAttribution: Fabianx commentedRTBC, thanks!
Comment #10
catchCommitted/pushed to 8.0.x, thanks!
Comment #12
mpdonadioJust fixing the type in the title...