Blesta + Suhosin

[DandyDandy]

Hi,

I write this because over recent weeks I have seen multiple people trying to run Blesta on one of the more latest PHP releases such as PHP 5.4 with the Suhosin PHP hardening patch applied. Because problems are happening with the setup they seem to be blaming Blesta for the issue when actually the issue is residing from the Suhosin PHP patch.

As I write Suhosin barely has support for PHP 5.4 and doesn't even currently support PHP 5.5 at all some providers are now starting to drop the usage of Suhosin and consider it a dead project because the development of the project is no longer moving forward to cater for the changes within PHP.

I can confirm that Blesta will happily run with Suhosin using PHP 5.3 alhough PHP 5.3 is now End Of Life security fixes will still be released into 2014 as they generally keep the security fixes coming for about 1 year once EOL status is declared.

Based on the current status of Suhosin moving forward I wouldn't recommend running it any further in production until it becomes a stable project again with regular releases to keep supporting more current PHP builds.

Am sure this will help those who are facing such issues.

[Paul]

Thanks, I appreciate the testing on 5.3, that all but confirms the people running Suhosin on 5.4 are experiencing a side affect of it not being fully compatible.

[DandyDandy]

Thanks, I appreciate the testing on 5.3, that all but confirms the people running Suhosin on 5.4 are experiencing a side affect of it not being fully compatible.

 

That's right I don't think many understand just how much lacking behind Suhosin has become with the PHP builds it was a nice project but like many of them it's future is in the firing line you could in theory use it for PHP 5.4 because some compatibility is present but there is no point running something that is half baked and it will give you problems with some software's anyway like Blesta.

For those who want to get there hands dirty and start playing with patches and forks there is a Suhosin fork which appears to fix for instance the sessions issue some are facing when running PHP 5.4 along side Suhosin it's something I haven't personally tested yet as my dairy is getting full with other commitments at present but moving past PHP 5.4 to the likes of PHP 5.5 even the forked project doesn't support it yet so it seems. I know some are keen to use official projects but anything that is forked can be done right if it moves forward at a steady pace. I wouldn't attempt this in a production environment without testing it first.