#1575 - Refresh our PHP base line

Identifier #1575
Issue type Feature request or suggestion
Title Refresh our PHP base line
Status Completed
Tags

Risk: Deprecates functionality (custom)

Handling member Chris Graham
Addon core
Description This issue describes changes we can make to our PHP compatibility. We currently support PHP5.1, which is very old now.

These changes cannot be made until our minimum PHP version is raised, which will happen based on a combination of PHP EOL, updates to our written policy, new Composr versions justifying changes, and our updated CQC tooling.

It mainly is an idea dump, that we update as we become aware of improvements we can make at some undefined point in the future, and to help our technology planning.

1) Jump over PHP versions to the latest one that is not EOL.
a) Update our minimum requirements. Consider making it official that we support only PHP versions that aren't EOL, then we automatically remove responsibility for us maintaining old versions after a point. Instead maybe say what versions we officially support up to?
b) To find what code cleanups we can make, look for calls to phpversion, PHP_VERSION, class_exists, defined, and function_exists checks. Review the 'removed features' list in the PHP manual. Some specific improvements listed further down.
c) Update the CQC so all the new PHP features are accepted and checked by it (esp namespaces, PHP short arrays, support for static typed parameters, also new functions for phpstub.php)

2) Raise the documented memory limit to whatever it is in PHPs we support (it's 128MB in PHP5.5, I think actually PHP5.3+). That said, leave the currently 64MB default in the code. The only change is we need the user to find a host that at least gives the default for cases when we choose to raise to that.

3) Remove Magic Quotes support code (gone since PHP 5.4+)

4) Make use of the PHP random bytes feature, drop our openssl usage for that. openssl would no longer be recommended in the hosting tutorial. (PHP7+)

5) We must remove HTTP_RAW_POST_DATA, as we can rely on fopen of input (PHP5.6+).

6) Use PHP __DIR__ constant instead of dirname(__FILE__) (PHP5.3+)

7) We can replace create_function calls with lambda calls (PHP5.3+)

8) Make full use of static typed parameters - turn all our phpdoc headers into proper function signatures via an automated process (PHP7+)

9) Make the PHPdoc compiler complain if there is a mismatch between PHPdoc and argument/return typing (PHP7+)

10) Drop all references to the ocProducts version of PHP (see note ii below). Add a new issue under the "Composr testing platform" to bring it back as an official patch, but likely that issue won't be implemented

11) Drop the 'mysql' database driver (PHP7+)

12) Remove references to PHP safe mode. safe_mode_temp temp directory should be renamed just temp, and a new caches/http directory should be created. (PHP5.4+)

13) Generally review the hosting and security tutorials to see if any recommendations are now implied by the minimum PHP version.


Notes:

i) We are not considered switching to hacklang. PHP7 won the popular battle against HHVM and is competitive on performance. hacklang is a complicated language with a tiny install base, it's not going to be the next version of PHP.

ii) We are dropping our XSS-detector/static-typing version of PHP. Our new approach will be to standardise on CSP to avoid XSS, and use PHP's native (less strict) static typing, and rely on the CQC. It makes me a bit sad, but practically speaking it's good enough, and getting all our PHP developers on a custom PHP build, or maintaining it with new PHP versions, and getting them to truly understand XSS, was not realistic. We could bring it back in the future as a proper maintained PHP patch, if we have megabucks, but it seems unlikely.
Steps to reproduce

Related to

#508 - Support Content Security Policy
Funded? No
The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".

Rating

Unrated