feat: webtrees docker build setup with patched PHP 8.4.26 (CVE-2026-109618 / CVE-2026-109619)
This commit is contained in:
@@ -4,10 +4,10 @@
|
||||
</a>
|
||||
</p>
|
||||
|
||||
<h1 align="center">Name des Projekts</h1>
|
||||
<h1 align="center">Webtrees Docker (PHP 8.4 Security Patched)</h1>
|
||||
|
||||
<h4 align="center">
|
||||
Kurzbeschreibung des Projekts/Anwendung, um die es geht
|
||||
Webtrees Docker Image mit gepatchtem PHP 8.4.26 (Schutz vor CVE-2026-109618 / CVE-2026-109619 "PHP2Shell")
|
||||
</h4>
|
||||
|
||||
<h6 align="center">
|
||||
@@ -21,9 +21,115 @@
|
||||
</h6>
|
||||
<br><br>
|
||||
|
||||
## 📌 Übersicht & Hintergrund
|
||||
|
||||
CONTENT BEREICH
|
||||
Dieses Repository stellt vorgefertigte Docker-Images für die führende Open-Source-Genealogie-Software **[webtrees](https://webtrees.net/)** bereit.
|
||||
|
||||
### 🛡️ Warum dieser Fork / Rebuild?
|
||||
Am 21. Oktober 2026 wurde die kritische Zero-Day-Schwachstelle **"PHP2Shell"** ([CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618) & CVE-2026-109619, CVSS 9.2) im PHP-Kern bekannt.
|
||||
|
||||
Da bisherige INI-Workarounds (`session.upload_progress.enabled = Off`) laut Sicherheitsberichten (u. a. Heise Security) unvollständig sind bzw. umgangen werden können, ist der Einsatz der offiziell gepatchten PHP-Binaries zwingend erforderlich.
|
||||
|
||||
Da das beliebte Upstream-Image von [NathanVaughn/webtrees-docker](https://github.com/NathanVaughn/webtrees-docker) nur bei neuen Webtrees-Releases automatisiert baut, wurde dieses Image direkt auf Basis des heute veröffentlichten Upstream-Patches **`php:8.4-apache` (PHP 8.4.26, Build: 21.10.2026 00:32:44 UTC)** gebaut und getestet.
|
||||
|
||||
* **Upstream-Basis:** 1:1 kompatibel zu [NathanVaughn/webtrees-docker](https://github.com/NathanVaughn/webtrees-docker)
|
||||
* **Webtrees-Versionen:** `2.2.6` und `2.2.1`
|
||||
* **PHP-Version:** `PHP 8.4.26` (Offizielles Security-Patched Release vom 21.10.2026)
|
||||
* **Enthaltene Module:** `imagick`, `gd`, `pdo_mysql`, `pdo_pgsql`, `zip`, `intl`, `exif`, `opcache` uvm.
|
||||
|
||||
---
|
||||
|
||||
## 📦 Verfügbare Container Tags
|
||||
|
||||
Die Images können direkt aus der Techniverse Gitea Container Registry bezogen werden:
|
||||
|
||||
```bash
|
||||
# Webtrees 2.2.6 (PHP 8.4.26)
|
||||
docker pull git.techniverse.net/scriptos/webtrees:2.2.6-php8.4.26
|
||||
docker pull git.techniverse.net/scriptos/webtrees:latest-php8.4.26
|
||||
|
||||
# Webtrees 2.2.1 (PHP 8.4.26)
|
||||
docker pull git.techniverse.net/scriptos/webtrees:2.2.1-php8.4.26
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🚀 Schnellstart mit Docker Compose
|
||||
|
||||
Beispiel für eine `docker-compose.yaml`:
|
||||
|
||||
```yaml
|
||||
services:
|
||||
webtrees-app:
|
||||
image: git.techniverse.net/scriptos/webtrees:2.2.6-php8.4.26
|
||||
container_name: webtrees-app
|
||||
restart: unless-stopped
|
||||
depends_on:
|
||||
- webtrees-db
|
||||
environment:
|
||||
PRETTY_URLS: "1"
|
||||
HTTPS: "0"
|
||||
HTTPS_REDIRECT: "0"
|
||||
LANG: "de"
|
||||
TZ: "Europe/Berlin"
|
||||
BASE_URL: "https://stammbaum.deine-domain.de"
|
||||
DB_TYPE: "mysql"
|
||||
DB_HOST: "webtrees-db"
|
||||
DB_PORT: "3306"
|
||||
DB_USER: "webtrees"
|
||||
DB_PASS: "DeinSicheresPasswort"
|
||||
DB_NAME: "webtrees"
|
||||
DB_PREFIX: "wt_"
|
||||
PUID: "33"
|
||||
PGID: "33"
|
||||
PHP_UPLOAD_MAX_FILE_SIZE: "50M"
|
||||
PHP_POST_MAX_SIZE: "50M"
|
||||
PHP_MEMORY_LIMIT: "1024M"
|
||||
ports:
|
||||
- "8080:80"
|
||||
volumes:
|
||||
- ./data/app_data:/var/www/webtrees/data/
|
||||
- ./data/modules_v4:/var/www/webtrees/modules_v4
|
||||
|
||||
webtrees-db:
|
||||
image: mariadb:11
|
||||
container_name: webtrees-db
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
MARIADB_DATABASE: "webtrees"
|
||||
MARIADB_USER: "webtrees"
|
||||
MARIADB_PASSWORD: "DeinSicheresPasswort"
|
||||
MARIADB_ROOT_PASSWORD: "DeinRootPasswort"
|
||||
volumes:
|
||||
- ./data/db_data:/var/lib/mysql
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔍 Verifikation des Sicherheits-Patches
|
||||
|
||||
Im laufenden Container lässt sich der Patch-Stand jederzeit über die PHP-CLI prüfen:
|
||||
|
||||
```bash
|
||||
docker exec webtrees-app php -v
|
||||
```
|
||||
|
||||
Ausgabe:
|
||||
```text
|
||||
PHP 8.4.26 (cli) (built: Oct 21 2026 00:32:44) (NTS)
|
||||
Copyright (c) The PHP Group
|
||||
Built by https://github.com/docker-library/php
|
||||
Zend Engine v4.4.26, Copyright (c) Zend Technologies
|
||||
with Zend OPcache v8.4.26, Copyright (c), by Zend Technologies
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔗 Danksagung & Upstream-Referenzen
|
||||
|
||||
* **webtrees:** Offizielles Projekt unter [https://webtrees.net/](https://webtrees.net/) und auf [GitHub (fisharebest/webtrees)](https://github.com/fisharebest/webtrees)
|
||||
* **Docker Image Vorlage:** Nathan Vaughn ([NathanVaughn/webtrees-docker](https://github.com/NathanVaughn/webtrees-docker))
|
||||
* **PHP Security:** PHP Group ([php.net](https://www.php.net/))
|
||||
|
||||
<br><br>
|
||||
<p align="center">
|
||||
@@ -32,6 +138,6 @@ CONTENT BEREICH
|
||||
|
||||
<p align="center">
|
||||
<sub>
|
||||
© Patrick Asmus · Techniverse Network · <a href="./LICENSE">Lizenz</a>
|
||||
© Patrick Asmus · Techniverse Network · <a href="./LICENSE.gnu">GPL-3.0 Lizenz</a>
|
||||
</sub>
|
||||
</p>
|
||||
</p>
|
||||
|
||||
Reference in New Issue
Block a user