Flag a warning during status check if the OpenSSL extension is not enabled

Created on 27 April 2023, over 1 year ago
Updated 3 May 2023, over 1 year ago

Problem/Motivation

Spin-off from πŸ“Œ Harden our HTTPS requirement Fixed , see #6 and #8.

We don't check openssl in any validator. Because automatic_updates_requirements runs the status checks this will inform the site owner as early as possible assuming we do 🌱 [policy, no patch] Should Package Manager require Composer HTTPS? Active

Original summary by @catch

The MR there doesn't check openssl, but I think we should check for it in hook_requirements(), since that will inform the site owner as early as possible that they're not going to be able to run automatic updates, assuming we continue to do 🌱 [policy, no patch] Should Package Manager require Composer HTTPS? Active . Even if we ended up not actually requiring https, we could still check for the extension and warn if it's not there.

Proposed resolution

Rename Package Manager's XdebugValidator to PhpExtensionsValidator, and make it a multi-callback event subscriber that checks xdebug and OpenSSL's status in separate methods, using extension_exists(), and flags warnings during status check if things don't look right. Ensure all possible combinations are tested.

Meanwhile, in Automatic Updates, override the xdebug-specific check to flag an error if the stage is a CronUpdateStage and xdebug is enabled.

Remaining tasks

Follow-up πŸ“Œ Warn about package_manager errors and warning on the status report page Needs work

πŸ“Œ Task
Status

Fixed

Version

3.0

Component

Package Manager

Created by

πŸ‡¬πŸ‡§United Kingdom catch

Live updates comments and jobs are added and updated live.
  • Security improvements

    It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.

Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024