Skip to content

fix: remove dead Suhosin warning from HomeController#20123

Closed
somethingwithproof wants to merge 0 commit intophpmyadmin:masterfrom
somethingwithproof:fix/remove-suhosin-warning
Closed

fix: remove dead Suhosin warning from HomeController#20123
somethingwithproof wants to merge 0 commit intophpmyadmin:masterfrom
somethingwithproof:fix/remove-suhosin-warning

Conversation

@somethingwithproof
Copy link
Copy Markdown
Contributor

@somethingwithproof somethingwithproof commented Feb 17, 2026

Summary

Test plan

  • Verify home page loads without errors
  • Run phpstan and phpcs to confirm no regressions

Fixes #19912

@kamil-tekiela
Copy link
Copy Markdown
Contributor

I think the setting should be removed too. It was probably the only place it was used and there's no reason to leave an orphaned setting.

@somethingwithproof
Copy link
Copy Markdown
Contributor Author

Good catch — updated to also remove the SuhosinDisableWarning setting from the config. All references cleaned up.

@somethingwithproof somethingwithproof force-pushed the fix/remove-suhosin-warning branch from efd822c to dec0741 Compare February 18, 2026 02:20
Whether to log successful authentication attempts into
:config:option:`$cfg['AuthLog']`.

.. config:option:: $cfg['SuhosinDisableWarning']
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please keep the documentation and add a versionremoved statement

* `suhosin.executor.disable_emodifier <https://suhosin5.suhosin.org/stories/config
uration.html#suhosin-executor-disable-emodifier>`_ should be enabled.

You can also disable the warning using the :config:option:`$cfg['SuhosinDisableWarning']`.
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why remove this and not the entire block?
I'd say remove nearly everything (contents but not header)
and say that it was removed

];
}

/**
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@liviuconcioiu i do not remember how can we suggest to the user to remove a deprecated setting?
could we have an array somewhere?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can show a notice in footer, like Twig does for example.

deprecated

And here is the code that should go in HomeController:

        $deprecatedSettings = [
            'SuhosinDisableWarning' => '6.0.0-dev',
        ];

        foreach ($deprecatedSettings as $key => $version) {
            if (array_key_exists($key, $this->config->settings)) {
                $this->errors[] = [
                    'message' => sprintf(
                        __('Since phpMyAdmin %s: "$cfg[\'%s\']" is deprecated. You can safely remove it.'),
                        $version,
                        $key,
                    ),
                    'severity' => 'notice',
                ];
            }
        }

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@liviuconcioiu I think this code is too generic. Each setting should have it's own message.

@somethingwithproof
Copy link
Copy Markdown
Contributor Author

Makes sense — I'll keep the docs with a versionremoved note, trim the FAQ section instead of deleting it, and add the deprecation notice like @liviuconcioiu showed. Will update the PR.

@somethingwithproof
Copy link
Copy Markdown
Contributor Author

Addressed reviewer feedback:

  • docs/config.rst: Restored SuhosinDisableWarning section with versionremoved:: 6.0.0 directive
  • docs/faq.rst: Kept FAQ reference with removal note instead of deleting entirely
  • HomeController.php: Added deprecation notice using the $deprecatedSettings pattern (per @liviuconcioiu's suggestion) — users with the setting in config.inc.php will see a notice to remove it

All unit tests pass locally (5183 tests, 17280 assertions).

@somethingwithproof somethingwithproof force-pushed the fix/remove-suhosin-warning branch 2 times, most recently from ba5b064 to 0a52adf Compare February 21, 2026 01:30
if (array_key_exists($key, $this->config->settings)) {
$this->errors[] = [
'message' => sprintf(
__('Since phpMyAdmin %s: "$cfg[\'%s\']" is deprecated. You can safely remove it.'),
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please, do not add this. It's out of the scope of this pull request.

docs/config.rst Outdated
Comment on lines +125 to +128
A warning is displayed on the main page if Suhosin is detected.
.. deprecated:: 6.0.0

You can set this parameter to ``true`` to stop this message from appearing.
This setting has been removed. The Suhosin extension is no longer
maintained, and the related warning has been removed from phpMyAdmin.
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please do not remove the original description. Leave it after the removed message.

@somethingwithproof somethingwithproof force-pushed the fix/remove-suhosin-warning branch from 2606196 to 6a2f869 Compare February 22, 2026 21:57
@somethingwithproof
Copy link
Copy Markdown
Contributor Author

Rebased and addressed all three points:

  • Dropped the generic $deprecatedSettings loop — you're right, it's out of scope here.
  • Kept the original description text in docs/config.rst below the versionremoved:: 6.0.0 directive.
  • Updated docs/faq.rst to note the removal rather than deleting the section.

Single clean commit now, only Suhosin-related changes.

@williamdes
Copy link
Copy Markdown
Member

Duplicate of #20167

@williamdes williamdes marked this as a duplicate of #20167 Feb 23, 2026
@williamdes
Copy link
Copy Markdown
Member

Please avoid red creating pull requests. git push --force exists to reset everything

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Feat]: Remove Suhosin support and warnings

5 participants