Allow editing how php-fpm is added to the Apache vhost

[bjoern-tantau]

Is your feature request related to a problem? Please describe.

I have a system-wide matomo installation that needs its own php-fpm configuration for the correct directory permissions. This is achieved by adding

Alias /matomo "/var/www/matomo"

<Directory "/var/www/matomo">
  Require all granted
  AllowOverride All
  <FilesMatch \.(php)$>
    SetHandler proxy:unix:/var/lib/apache2/fastcgi/matomo-php-fpm.socket|fcgi://localhost
  </FilesMatch>

</Directory>

to the vhost settings.

But apparently the vhost's global settings take precedence and only the default php-fpm socket is used, leading to incorrect permissions.

Describe the solution you'd like

Easiest for me would be if we could edit how the php-fpm configuration is added to a vhost. Then I could restrict it to the document root. An alternative might be to restrict it to the docroot by default, but I have no idea if that would have unintended side effects for some users.

Describe alternatives you've considered

As a workaround I edited lib/Froxlor/Cron/Http/ApacheFcgi.php to put the php-fpm config into a Directory section.

[d00p]

Could you please validate whether the following patch fixes the issue as expected?

diff --git a/lib/Froxlor/Cron/Http/ApacheFcgi.php b/lib/Froxlor/Cron/Http/ApacheFcgi.php
index 1ebc612b..a5e06ee9 100644
--- a/lib/Froxlor/Cron/Http/ApacheFcgi.php
+++ b/lib/Froxlor/Cron/Http/ApacheFcgi.php
@@ -126,6 +126,9 @@ class ApacheFcgi extends Apache

                                // mod_proxy stuff for apache-2.4
                                if (Settings::Get('system.apache24') == '1' && Settings::Get('phpfpm.use_mod_proxy') == '1') {
+
+                                       $php_options_text .= '  <Directory "' . FileDir::makeCorrectDir($domain['documentroot']) . '">' . "\n";
+
                                        $filesmatch = $phpconfig['fpm_settings']['limit_extensions'];
                                        $extensions = explode(" ", $filesmatch);
                                        $filesmatch = "";
@@ -141,23 +144,19 @@ class ApacheFcgi extends Apache
                                        $php_options_text .= '  </FilesMatch>' . "\n";

                                        $mypath_dir = new Directory($domain['documentroot']);
-
-                                       // only create the require all granted if there is not active directory-protection
+                                       // only create the "require all granted" directive if there is no active directory-protection
                                        // for this path, as this would be the first require and therefore grant all access
                                        if ($mypath_dir->isUserProtected() == false) {
-                                               $php_options_text .= '  <Directory "' . FileDir::makeCorrectDir($domain['documentroot']) . '">' . "\n";
                                                if ($phpconfig['pass_authorizationheader'] == '1') {
                                                        $php_options_text .= '    CGIPassAuth On' . "\n";
                                                }
                                                $php_options_text .= '    Require all granted' . "\n";
                                                $php_options_text .= '    AllowOverride All' . "\n";
-                                               $php_options_text .= '  </Directory>' . "\n";
                                        } elseif ($phpconfig['pass_authorizationheader'] == '1') {
                                                // allow Pass of Authorization header
-                                               $php_options_text .= '  <Directory "' . FileDir::makeCorrectDir($domain['documentroot']) . '">' . "\n";
                                                $php_options_text .= '    CGIPassAuth On' . "\n";
-                                               $php_options_text .= '  </Directory>' . "\n";
                                        }
+                                       $php_options_text .= '  </Directory>' . "\n";
                                } else {
                                        $addheader = "";
                                        if ($phpconfig['pass_authorizationheader'] == '1') {

[bjoern-tantau]

Yes, that fixes it. That's exactly what I had done myself.