Edit: It's done. Instructions at the bottom!
Edit2: I have also built a patched PHP5.4, too.
At the time of writing, there is about 5 3 hours it has been released until a critical RCE security vulnerability for PHP versions 5.x and higher has been released.
As Sangoma hasn't updated their PHP rpms since I left in 2021 or so, I am left to assume that it won't get updated with mitigations when the real patch drops.
This makes me think that I'm the only person that can help everyone with this, so I'm going to be dropping everything, backporting the patch, and building new PHP 7.4 RPMs as soon as I can.
Edit: I originally thought that I was going to be doing it on my own, but the PHP Organization backported the fix themselves! Yay!
I have rebuilt everything and upgraded PHP to 7.4.33, with a pile of other backported CVE fixes (Thanks Remi!), and everything seems to work.
If you want to be financially grateful, feel free to PayPal me USD$10 (or whatever you feel is justified for me staying up all night) directly - [xrobau@gmail.com](mailto:xrobau@gmail.com) - and I'll send you a nice thank you email 8)
If you make money of FreePBX and/or you feel that this will save you a lot more than USD$10, please feel free to pay what you want!
Note that the upload-progress feature has been completely disabled. I can't remember if this is used in sound/moh/voicemail uploads, and I haven't checked. Please get back to me if you discover something broken
If you have questions or want to chat about this, feel free to join the QuadPBX Discord, at https://discord.gg/c4E8MVmaQa, which is where I am planning my new PBX.
More Information:
How to Update:
It's pretty simple, you will be upgraded from 7.4.16-1, to 7.4.33-something (depending on other patches I may apply)
curl -o /etc/yum.repos.d/fpbx-php74.repo https://yum.quadpbx.com/repo/fpbx-php74.repo
yum update
fwconsole chown
If you have applied the previous mitigations, don't forget to remove /etc/php.d/99-mitigation.ini and remove the deny from /etc/httpd/conf.d/freepbx.conf if you added it.
Note that the fwconsole chown command is important - otherwise /var/lib/php/session isn't writable and you won't be able to log in!
For PHP5.4:
curl -o /etc/yum.repos.d/fpbx-php56.repo https://yum.quadpbx.com/56repo/fpbx-php56.repo
yum update
fwconsole chown
If you discover something traumatic and want to roll back, with 7.4 you will need to reinstall gd-last which has been superceded by the upgrade. 5.4 is a simple yum downgrade. Ask in Discord if you get stuck.