[mrrobot47]

What

The v4.13.3 upload-progress migration (20261021120000_site-type-wp_disable_wp_session_upload_progress) reads and writes each site's custom.ini through checked handles, so it can no longer be redirected outside the site's config volume.

Why

The migration still runs on every upgrade from a version before v4.13.3. custom.ini lives in the site's config_php volume, which the php container mounts at /usr/local/etc, so the container can replace custom.ini, conf.d or php/ with a symlink. The migration checked only custom.ini itself (is_link()), then used file_get_contents()/file_put_contents() by path: with a symlinked conf.d it read, rewrote or created custom.ini in whatever host directory the link pointed at, and its rollback deleted a file it had created there.

How

• Reads and writes go through site-command's get_container_file_contents() and put_container_file_contents() (fix(site): stop following symlinks from a site's php config volume in restore, update --php and migrations site-command#522): one checked handle, a regular file in the real conf.d, written in place, nothing created, and a file that changed since it was read is left alone.
• With an older site-command that lacks those helpers, the migration checks that custom.ini is a regular file and that no directory above it is a symlink before each read and write. That closes a link that is already there, not one swapped in during the run.
• A missing custom.ini is no longer created, only warned about with the manual fix, as site-command's re-check migration (fix(restore): keep session upload progress off after restoring an older backup site-command#520) does: PHP can't create a file safely in a directory the container can swap.
• The backup copy is written from the content that was read, not copied by path; a failed write no longer triggers a restore over a file the container changed meanwhile, and the backup is kept (named in the warning) in case putting the old content back failed too. The fallback checks the path again before such a put-back.
• A custom.ini that the two lines would push over the 1 MB read limit is skipped with a warning, so rollback can always read back what was written.

Testing

• Against throwaway site dirs on PHP 7.4 and 8.5, with site-command's helpers and without them: a regular custom.ini gets the Off line and rollback restores it; a missing one is warned about and not created; a symlinked custom.ini and a symlinked conf.d are refused with a warning and the target directory stays byte for byte the same. The released migration fails the last three.
• #520's re-check migration matrix (733 checks) passes with this migration as the v4.13.3 step.
• On a runner with core develop, the migration re-run on a WordPress site whose php container swapped conf.d for a symlink to a host directory: develop's migration writes the Off line into the host directory's custom.ini; this branch's leaves it untouched and warns, with develop's site-command and with site-command#522; after the link is removed, the re-run adds the line at the top. Behat passes with this checkout and site-command#522.

Release order

Works with any site-command; the race-safe path needs EasyEngine/site-command#522 (which needs #519 and #520), so ship them in the same release.

[Copilot]

🟡 Changes recommended

Adding the setting can exceed the fallback's read limit, preventing rollback from restoring an otherwise accepted file.

1 open issue

• Prevent oversized custom.ini from breaking rollback · New

What changed in this PR

This PR hardens the WordPress upload-progress migration against symlink redirection when accessing a site's custom.ini.

Changes:

• Uses checked file helpers when available, with path checks for older site-command versions.
• Stops creating missing configuration files and warns with manual instructions.
• Backs up the content already read and updates write-failure recovery and rollback handling.

File	Description
migrations/​container/​20261021120000_site-type-wp_disable_wp_session_upload_progress.php	Adds guarded configuration access and revises backup and restoration logic.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Privileged host-file writes and race protection that depends on a coordinated site-command release warrant human security review.

No open issues 🎉

1 resolved since last review

• Prevent oversized custom.ini from breaking rollback

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Privileged writes to container-controlled paths, the race-prone compatibility fallback, and coordinated site-command dependencies warrant human security review.

No open issues 🎉

_{Review effort: Balanced}