Do not disable phar.readonly
dktapps opened this issue · 3 comments
dktapps commented
Disabling phar.readonly
is only useful when using DevTools
to compile a plugin. The rest of the time, disabling it creates security vulnerabilities and potential for the wackiest of bugs.
Case in point: https://discord.com/channels/373199722573201408/480650036972224513/908536847272120372
SOF3 commented
So you are suggesting that we make devtools unusable by default?
dktapps commented
Building a plugin by starting a server was always a stupid idea to begin with.
Building offline is just a case of passing -dphar.readonly=0
to php
.
dktapps commented
In addition, enabling it for everyone just for the minority of users that actually need it makes as little sense as including Composer into the PHP builds, which we already stopped doing a long time ago.