upd(sync): merge 3.5.x fixes into 3.6.x

.github/docker/Dockerfile

@@ -3,7 +3,8 @@
 # The base image is built from evolution-cms/salo2 runtimes/<php version> (Salo
 # is the Evolution CMS flavour of Laravel Sail): php:<version>-apache with gd,
 # zip, pdo and mod_rewrite. sqlite3/pdo_sqlite come enabled in the official php
-# images. The workflow builds 8.3, 8.4 and 8.5 and overrides BASE_IMAGE per leg.
+# images. The workflow builds every version .github/scripts/php-versions.sh lists
+# for the tree (8.3 too below CMS 3.6) and overrides BASE_IMAGE per leg.
 ARG BASE_IMAGE=evo-salo-runtime:8.4
 FROM ${BASE_IMAGE}
 

.github/docker/ci/README.md

@@ -85,8 +85,10 @@ no PHP on it, and what pins the PHP version when a version question is the one
 being investigated.
 
 One PHP version, every database: what the job proves is the installer's database
-paths, which do not vary with the PHP minor. PHP 8.4 and 8.5 are covered by
-the analysis and unit test jobs. The sqlite leg starts no container.
+paths, which do not vary with the PHP minor, and it runs on the lowest one
+`.github/scripts/php-versions.sh` lists. The analysis and unit test jobs cover
+all of them: 8.4 and 8.5, plus 8.3 while the CMS version is below 3.6. The
+sqlite leg starts no container.
 
 The same workflow also builds this image from the official `php:8.6-rc-cli`
 image and runs the unit tests in it. The `8.6-rc` tag follows the latest PHP 8.6

.github/scripts/php-versions.sh

@@ -0,0 +1,45 @@
+#!/bin/sh
+# The PHP versions CI runs a tree on, decided by the CMS version of that tree:
+# 3.6 requires PHP 8.4, the 3.5 line still supports 8.3, and the PHP 8.6 release
+# candidate is a 3.6 concern only. So one set of workflows keeps testing 8.3 on
+# 3.5.x and moves to 8.6 on 3.6.x, whichever branch it was merged to.
+#
+# Usage: php-versions.sh [tree]   (default: the current directory)
+# Writes to $GITHUB_OUTPUT when set, to stdout otherwise:
+#   versions  JSON list for a job matrix, lowest first
+#   lowest    the lowest of them, for jobs that run on one version only
+#   rc        the prerelease version to check as well, empty for none
+set -eu
+
+tree=${1:-.}
+file="$tree/core/factory/version.php"
+version=$(sed -n "s/^[[:space:]]*'version'[[:space:]]*=>[[:space:]]*'\([0-9][0-9.]*\)'.*/\1/p" "$file" | head -n 1)
+if [ -z "$version" ]; then
+    echo "::error file=$file::no 'version' => 'x.y.z' entry" >&2
+    exit 1
+fi
+
+major=${version%%.*}
+rest=${version#*.}
+minor=${rest%%.*}
+if [ "$major" -gt 3 ] || { [ "$major" -eq 3 ] && [ "$minor" -ge 6 ]; }; then
+    set -- 8.4 8.5
+    rc=8.6
+else
+    set -- 8.3 8.4 8.5
+    rc=
+fi
+
+lowest=$1
+versions=$(printf '"%s",' "$@")
+versions="[${versions%,}]"
+
+result="versions=$versions
+lowest=$lowest
+rc=$rc"
+if [ -n "${GITHUB_OUTPUT:-}" ]; then
+    echo "$result" >> "$GITHUB_OUTPUT"
+else
+    echo "$result"
+fi
+echo "CMS $version: PHP $*${rc:+, $rc RC}" >&2

.github/workflows/build.yml

@@ -44,8 +44,26 @@ env:
   SALO2_REF: master
 
 jobs:
+  php:
+    name: PHP versions
+    runs-on: ubuntu-latest
+    outputs:
+      versions: ${{ steps.php.outputs.versions }}
+      lowest: ${{ steps.php.outputs.lowest }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          sparse-checkout: |
+            .github/scripts
+            core/factory
+
+      # 8.3 below CMS 3.6 only, see the script
+      - id: php
+        run: sh .github/scripts/php-versions.sh
+
   zip:
     name: Installed CMS (zip, sqlite)
+    needs: php
     runs-on: ubuntu-latest
     permissions:
       contents: write # required to publish the nightly release
@@ -58,8 +76,8 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           # Built on the lowest supported version so the vendor tree stays
-          # usable on 8.4 and 8.5 alike.
-          php-version: '8.4'
+          # usable on every version the docker job runs it on.
+          php-version: ${{ needs.php.outputs.lowest }}
           extensions: ctype, dom, exif, fileinfo, filter, iconv, intl, json, mbstring, openssl, pdo, pdo_sqlite, readline, simplexml, sqlite3, tokenizer, xml, xmlreader, zip
           coverage: none
           tools: composer:v2
@@ -72,8 +90,8 @@ jobs:
         uses: actions/cache@v6
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
-          key: composer-${{ runner.os }}-php8.4-build-${{ hashFiles('core/composer.lock') }}
-          restore-keys: composer-${{ runner.os }}-php8.4-build-
+          key: composer-${{ runner.os }}-php${{ needs.php.outputs.lowest }}-build-${{ hashFiles('core/composer.lock') }}
+          restore-keys: composer-${{ runner.os }}-php${{ needs.php.outputs.lowest }}-build-
 
       - name: Install core dependencies
         working-directory: core
@@ -169,7 +187,7 @@ jobs:
 
   docker:
     name: Docker image PHP ${{ matrix.php }} ${{ matrix.server }} (GHCR)
-    needs: zip
+    needs: [php, zip]
     # Pull requests get a read-only token and cannot push packages, so the job is
     # skipped there — including on the run that stays attached to a merged PR.
     # The push to the base branch, and workflow_dispatch, are what build the image.
@@ -183,9 +201,9 @@ jobs:
       # the ones that did build stay usable.
       fail-fast: false
       matrix:
-        # 8.4 is the lowest supported version and the one the vendor tree in the
-        # zip is built on, so it proves the archive is portable upwards.
-        php: ['8.4', '8.5']
+        # The lowest of them is the one the vendor tree in the zip is built on,
+        # so the others prove the archive is portable upwards.
+        php: ${{ fromJSON(needs.php.outputs.versions) }}
         # Three different PHP SAPIs, not three front ends over one PHP: apache
         # runs mod_php, nginx talks FastCGI to php-fpm, and FrankenPHP embeds
         # PHP inside Caddy. They cannot share a base image, so each is a build.

.github/workflows/ci.yml

@@ -18,13 +18,32 @@ env:
   PHP_EXTENSIONS: ctype, dom, exif, fileinfo, filter, iconv, intl, json, mbstring, openssl, pdo, pdo_sqlite, readline, simplexml, tokenizer, xml, xmlreader, zip
 
 jobs:
+  php:
+    name: PHP versions
+    runs-on: ubuntu-latest
+    outputs:
+      versions: ${{ steps.php.outputs.versions }}
+      lowest: ${{ steps.php.outputs.lowest }}
+      rc: ${{ steps.php.outputs.rc }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          sparse-checkout: |
+            .github/scripts
+            core/factory
+
+      # 8.3 below CMS 3.6 only, 8.6 RC from 3.6 only, see the script
+      - id: php
+        run: sh .github/scripts/php-versions.sh
+
   analyze:
     name: Static analysis (PHP ${{ matrix.php }})
+    needs: php
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        php: ['8.4', '8.5']
+        php: ${{ fromJSON(needs.php.outputs.versions) }}
     steps:
       - uses: actions/checkout@v7
 
@@ -59,11 +78,12 @@ jobs:
 
   tests:
     name: Unit tests (PHP ${{ matrix.php }})
+    needs: php
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        php: ['8.4', '8.5']
+        php: ${{ fromJSON(needs.php.outputs.versions) }}
     steps:
       - uses: actions/checkout@v7
 
@@ -96,6 +116,8 @@ jobs:
 
   php86-rc:
     name: PHP 8.6 RC compatibility (Docker)
+    needs: php
+    if: needs.php.outputs.rc == '8.6'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -115,6 +137,7 @@ jobs:
 
   install:
     name: Install on ${{ matrix.db }}
+    needs: php
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -156,7 +179,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
+          php-version: ${{ needs.php.outputs.lowest }}
           extensions: ${{ env.PHP_EXTENSIONS }}, pdo_mysql, pdo_pgsql, sqlite3
           ini-values: error_reporting=E_ALL, display_errors=On, display_startup_errors=On, log_errors=On, error_log=/dev/stderr
           coverage: none
@@ -189,6 +212,7 @@ jobs:
 
   audit:
     name: Dependency audit
+    needs: php
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
@@ -198,7 +222,7 @@ jobs:
         with:
           # The audit reads composer.lock and the advisory database; it does not run the code,
           # so one version is enough. Kept at the lowest supported one for consistency.
-          php-version: '8.4'
+          php-version: ${{ needs.php.outputs.lowest }}
           extensions: ${{ env.PHP_EXTENSIONS }}
           coverage: none
           tools: composer:v2

.github/workflows/upgrade.yml

@@ -110,12 +110,25 @@ jobs:
         if: matrix.leg.db != 'sqlite'
         run: docker compose -f "new/$COMPOSE" --profile ${{ matrix.leg.db }} up -d --wait ${{ matrix.leg.db }}
 
-      # 8.4 is the lowest version both trees support, so it is the one that can
-      # run the old installer and the new updater in the same job.
+      # The script comes from this workflow's own commit: a "to" ref may be older
+      # than the script.
+      - name: Check out the CI scripts
+        uses: actions/checkout@v7
+        with:
+          path: ci
+          sparse-checkout: .github/scripts
+
+      # The lowest version the new tree supports (8.3 below CMS 3.6, 8.4 from
+      # 3.6), which the older trees run on too, so one job can run the old
+      # installer and the new updater.
+      - name: PHP version of the new tree
+        id: php
+        run: sh ci/.github/scripts/php-versions.sh new
+
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
+          php-version: ${{ steps.php.outputs.lowest }}
           extensions: ctype, dom, exif, fileinfo, filter, iconv, intl, json, mbstring, openssl, pdo, pdo_mysql, pdo_pgsql, pdo_sqlite, readline, simplexml, sqlite3, tokenizer, xml, xmlreader, zip
           ini-values: error_reporting=E_ALL, display_errors=On, display_startup_errors=On, log_errors=On, error_log=/dev/stderr
           coverage: none

core/functions/session_proxy.php

@@ -270,6 +270,11 @@ private static function migrateLegacySessionIfNeeded($store): void
      */
     private static function readLegacySessionPayload(string $sessionId): ?string
     {
+        // The cookie becomes part of a file name; Windows resolves "sess_\..\" even without a sess_ folder.
+        if (preg_match('/^[A-Za-z0-9,-]{1,256}$/', $sessionId) !== 1) {
+            return null;
+        }
+
         $savePath = session_save_path();
         if (!is_string($savePath) || $savePath === '') {
             $savePath = sys_get_temp_dir();
@@ -282,7 +287,7 @@ private static function readLegacySessionPayload(string $sessionId): ?string
         }
 
         $file = rtrim($path, "/\\") . DIRECTORY_SEPARATOR . 'sess_' . $sessionId;
-        if (!is_readable($file)) {
+        if (!is_file($file) || !is_readable($file)) {
             return null;
         }
 

core/phpunit.xml

@@ -7,6 +7,7 @@
     <testsuites>
         <testsuite name="Test Suite">
             <directory suffix="Test.php">./tests</directory>
+            <!-- Plain PHP scripts with their own stubs; StandaloneScriptsTest runs each in its own process. -->
             <exclude>./tests/standalone</exclude>
         </testsuite>
     </testsuites>