From 7fc19b62644a605cee8134104ce1334cac22c5b6 Mon Sep 17 00:00:00 2001
From: trav <trav@teafry.me>
Date: Wed, 21 Oct 2026 09:35:10 -0700
Subject: [PATCH] fix: disable session.upload_progress (CERT-EU 2026-018 /
 CVE-2026-109619)

PHP 8.3.35 in wordpress:7.1.3 is vulnerable to CVE-2026-109618 and
CVE-2026-109619. The real fix is the rebuilt official image on PHP
8.3.36; this disables the confirmed session upload-progress exploit
path as defence in depth and bumps the version so operators redeploy
and re-pull the image.
---
 abra.sh                 | 2 +-
 compose.yml             | 2 +-
 tests/test_templates.sh | 4 ++++
 uploads.ini.tmpl        | 4 +++-
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/abra.sh b/abra.sh
index e26e557..d3b53d1 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,4 +1,4 @@
-export PHP_UPLOADS_CONF_VERSION=v4
+export PHP_UPLOADS_CONF_VERSION=v5
 export ENTRYPOINT_CONF_VERSION=v10
 export ENTRYPOINT_MAILRELAY_CONF_VERSION=v2
 export MSMTP_CONF_VERSION=v4
diff --git a/compose.yml b/compose.yml
index 0e446e8..2b05c1d 100644
--- a/compose.yml
+++ b/compose.yml
@@ -63,7 +63,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.replacement=https://${DOMAIN}/$${2}"
         - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectregex.permanent=true"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT}"
-        - "coop-cloud.${STACK_NAME}.version=4.1.1+7.1.3"
+        - "coop-cloud.${STACK_NAME}.version=4.1.2+7.1.3"
 
   db:
     image: "mariadb:13.0"
diff --git a/tests/test_templates.sh b/tests/test_templates.sh
index 12e6a78..153f9f0 100755
--- a/tests/test_templates.sh
+++ b/tests/test_templates.sh
@@ -216,6 +216,10 @@ test_uploads_default() {
         echo "  FAIL  uploads default: expected 30 max_execution_time"
         return 1
     fi
+    if ! echo "$output" | grep -q "session.upload_progress.enabled = Off"; then
+        echo "  FAIL  uploads default: expected session.upload_progress disabled"
+        return 1
+    fi
     echo "  PASS  uploads default"
 }
 
diff --git a/uploads.ini.tmpl b/uploads.ini.tmpl
index 56fed73..35831d7 100644
--- a/uploads.ini.tmpl
+++ b/uploads.ini.tmpl
@@ -8,4 +8,6 @@ upload_max_filesize =  {{ $upload_max_size }}
 post_max_size = {{ $upload_max_size }}
 memory_limit = {{ $upload_max_size }}
 max_execution_time = {{ $upload_max_time }}
-max_input_time = {{ $upload_max_time }}
\ No newline at end of file
+max_input_time = {{ $upload_max_time }}
+
+session.upload_progress.enabled = Off