trav
7fc19b6264
cc-ci/testme cc-ci: success
PHP 8.3.35 in wordpress:7.1.3 is vulnerable to CVE-2026-109618 and CVE-2026-109619. The real fix is the rebuilt official image on PHP 8.3.36; this disables the confirmed session upload-progress exploit path as defence in depth and bumps the version so operators redeploy and re-pull the image.
14 lines
521 B
Cheetah
14 lines
521 B
Cheetah
{{ $upload_max_size := "256M" }}
|
|
{{ if ne (env "UPLOAD_MAX_SIZE") "" }} {{ $upload_max_size = env "UPLOAD_MAX_SIZE" }} {{ end }}
|
|
{{ $upload_max_time := "30" }}
|
|
{{ if ne (env "UPLOAD_MAX_TIME") "" }} {{ $upload_max_time = env "UPLOAD_MAX_TIME" }} {{ end }}
|
|
|
|
file_uploads = On
|
|
upload_max_filesize = {{ $upload_max_size }}
|
|
post_max_size = {{ $upload_max_size }}
|
|
memory_limit = {{ $upload_max_size }}
|
|
max_execution_time = {{ $upload_max_time }}
|
|
max_input_time = {{ $upload_max_time }}
|
|
|
|
session.upload_progress.enabled = Off
|