search

marcantondahmen / automad

A flat-file content management system and template engine
https://automad.org
MIT License
632 stars 37 forks source link

Internal corruption of phar error #96

Closed thyssentishman closed 4 months ago

thyssentishman commented 4 months ago

I just installed Automad on OpenBSD 7.5-current and with the change I suggested in #34, Automad seems to be working as intended. However, everytime I'm in the Dashboard I get a notification on the top right corner with the following error (domain replaced with example.com):

internal corruption of phar "/tmp/automad/example.com-29720c876f1de8a42480519b468e61af7fe2272f/composer/2.5.1/be48ea6f9fe0976b24aafb1fddce071d5c0f2db7c0aa3311bbf927ed95e7f715/composer.phar" (truncated entry)

Not sure what is causing this error or how to fix it. I'm using Automad 2 master.

marcantondahmen commented 4 months ago

Hi, does the error persist after removing the temp files for your installation in /tmp? A second option would be to clear the cache in the dashboard and see if that helps.

thyssentishman commented 4 months ago

If you mean a tmp directory inside the webroot e.g. /var/www/htdocs/example.com/tmp then that directory doesn't exist. If you mean the servers /tmp directory then I believe OpenBSD chroots the webserver to the webroot and doesn't allow it to write files outside it for security reasons. That is probably what's causing the problem. I must say that I agree with this behaviour as I don't want the webserver to access the rest of my system. Is there a way to specify another tmp directory?

EDIT: I can confirm that httpd does chroot the webserver to /var/www by default as seen here.

thyssentishman commented 4 months ago

Also, I'm not sure if it's related to this issue, but when I open the Packages tab in Automad's Dashboard, the list is empty and searching for something returns no packages. Is this intended?

marcantondahmen commented 4 months ago

I mean the system /tmp. This one is on all systems writable. It might be an alias, which is ok. Also from the error you posted above it is clear that the file and directories exist in /tmp which proofs that it is writable. Also whenever /tmp is not writable, you will see a very clear error message and the dashboard will not even render. It might be that PHP has a base dir restriction in place. It totally depends on your PHP config. You should then see a big error screen saying so and the temporary files would not exists, because they can't. So we can exclude that.

Regarding security, I strongly believe it is much more secure to write sensitive data outside the web root whenever possible. Cached data and temporary tokens should not be served publicly without proper protection.

The fact that /var/www is chrooted is the standard but not relevant for this issue, because I assume that you followed the installation guide and set up proper permissions for the actual installation directory which should be inside of /var/www, right?

However, it would be great to know the actual web server in use and the installed Automad version. In the latest Automad v2 alpha, which I assume you are using, you can define AM_DIR_TMP in the config to change the temporary directory location.

thyssentishman commented 4 months ago

I mean the system /tmp. This one is on all systems writable. It might be an alias, which is ok. Also from the error you posted above it is clear that the file and directories exist in /tmp which proofs that it is writable. Also whenever /tmp is not writable, you will see a very clear error message and the dashboard will not even render. It might be that PHP has a base dir restriction in place. It totally depends on your PHP config. You should then see a big error screen saying so and the temporary files would not exists, because they can't. So we can exclude that.

You're right. I've found the /tmp directory under the chrooted directory (/var/www/tmp). Everything under this directory is owned by the www user and is writable by the webserver.

The fact that /var/www is chrooted is the standard but not relevant for this issue, because I assume that you followed the installation guide and set up proper permissions for the actual installation directory which should be inside of /var/www, right?

Well I installed it under /var/www/htdocs/example.com which is where the webserver looks for the websites files by default and that seems to work. Everything under that directory is owned by the www user.

However, it would be great to know the actual web server in use and the installed Automad version. In the latest Automad v2 alpha, which I assume you are using, you can define AM_DIR_TMP in the config to change the temporary directory location.

The webserver is called httpd and is included with OpenBSD and yes I'm using Automad 2.0.0-alpha.4. Regarding the AM_DIR_TMP variable, where should I set it?

EDIT: I forgot to mention that I removed everything under the /var/www/tmp folder and the error persisted.

marcantondahmen commented 4 months ago

Ah good to know. So after deleting the cache, you saw the same error? You can edit the config/config.php inside the installation directory in order to define another temp directory.

Alternatively it would also be a great option to use Docker. That would make things a lot easier since it comes with a working web server out of the box.

thyssentishman commented 4 months ago

Ah good to know. So after deleting the cache, you saw the same error?

Yep.

You can edit the config/config.php inside the installation directory in order to define another temp directory.

I just did this and while the temporary files are now correctly written into the new path specified by AM_DIR_PATH, I'm still getting the same error.

Alternatively it would also be a great option to use Docker. That would make things a lot easier since it comes with a working web server out of the box.

This is not really an option as docker doesn't yet work on OpenBSD. I could use Linux, but I'd prefer to stick to OpenBSD. I think it'd be also great for Automad to work in other non-Linux platforms.

marcantondahmen commented 4 months ago

Can you use the .phar file or is it just empty. Does your PHP version supports cURL?

thyssentishman commented 4 months ago

Can you use the .phar file or is it just empty. Does your PHP version supports cURL?

That seems to have been the issue. By default, PHP is not allowed to make network connections on OpenBSD. Allowing this as per the documentation made the error go away.

Thank you very much for your support and patience @marcantondahmen. Closing this as completed.