Bug: `zlib.output_compression` guard rejects valid disabled `Off` value

[memleakd]

PHP Version

8.5

CodeIgniter4 Version

4.7.2

CodeIgniter4 Installation Method

Composer (using codeigniter4/appstarter)

Which operating systems have you tested for this bug?

Linux

Which server did you use?

FrankenPHP Worker Mode

Environment

development

Database

Not database-related

What happened?

Requests can fail during the pre_system event before the controller is reached.

The response is a 500 with:

Your zlib.output_compression ini directive is turned on. This will not work well with output buffers.

The exception is thrown by the app starter’s app/Config/Events.php zlib guard:

if (ini_get('zlib.output_compression')) {
    throw FrameworkException::forEnabledZlibOutputCompression();
}

The issue is that ini_get('zlib.output_compression') may return valid disabled values such as "Off". Since "Off" is a non-empty string, the current loose truthiness check treats it as enabled.

Steps to Reproduce

The relevant PHP behavior can be reproduced directly:

php -r 'ini_set("zlib.output_compression", "Off"); var_dump(ini_get("zlib.output_compression"), (bool) ini_get("zlib.output_compression"));'

Output:

string(3) "Off"
bool(true)

In a CodeIgniter app, if the runtime value is "Off", the app starter guard rejects the request even though zlib.output_compression is disabled.

Expected Output

The zlib guard should reject enabled values, but allow valid disabled values such as:

""
"0"
"Off"

Anything else?

The fix is to parse the ini_get('zlib.output_compression') value.

[michalsn]

FrankenPHP worker mode should not reject requests with the app starter’s normal web-mode zlib.output_compression guard.

Why should worker mode skip this guard?

We still use output buffering during request handling and FrankenPHP worker mode does not change that. In fact, the generated Caddyfile already enables server-level compression with encode zstd br gzip, so PHP-level zlib.output_compression should remain disabled.

[memleakd]

FrankenPHP worker mode should not reject requests with the app starter’s normal web-mode zlib.output_compression guard.

Why should worker mode skip this guard?

We still use output buffering during request handling and FrankenPHP worker mode does not change that. In fact, the generated Caddyfile already enables server-level compression with encode zstd br gzip, so PHP-level zlib.output_compression should remain disabled.

You’re right. I believe I found the root cause after digging into it further.

The narrower issue is that HotReloader disables zlib.output_compression with "Off", and at runtime PHP can keep that exact string. Since "Off" is truthy, a long-running worker can carry that value into a later request and trip the existing app starter guard, even though compression was meant to be disabled.

I’ve reworked the issue and PR around that root cause. The guard stays in place, and the PR now changes HotReloader to use "0" so ini_get('zlib.output_compression') remains falsey.