Status check about accessible dirs can be slow
This is a followup to https://github.com/civicrm/civicrm-core/pull/26771#issuecomment-1629756698 and https://github.com/civicrm/civicrm-core/pull/26889.
Putting more info than needed in here cuz I already typed it.
I think the speedup in 26889 wasn't quite a "fix", and there was maybe more than one issue there. In general as noted in 26771 servers that only handle one request at a time, synchronously, will have trouble with these checks because of deadlock, i.e.
> (caller) call for status check
=> (server) hello, processing
> call for file
=> hello, hold please
... second caller hangs up eventually ...
> first request can now finish
=> server switches phone line to caller on hold => oh you're not there anymore, ok.
And a gotcha during testing is it's not sufficient to just simulate the second GET using tool X (browser, curl-cli, cv, etc), it needs to be the combo of doing the GET from within code that is triggered by the first GET.
For the php built-in webserver, while the isBrowsable
check could be legit, the status check about isDirAccessible
might give a false positive even if it was working, since .htaccess files don't do anything for the built-in webserver, and there's no nginx-like config you could do to secure it. So maybe it is best to just skip this check for built-in, in which case I would skip it for all php versions not just <8
.
But in general, to make this work with one-request-at-a-time servers seems like it would require an architecture redesign. Using guzzle/curl to specify a timeout makes the time shorter, so is an improvement, but it doesn't seem possible to ever get a correct result for isDirAccessible
on these servers at the moment, and at least for the built-in one, we already know it's not possible to prevent GET'ing files under sites/default/files/civicrm.
I don't know a way to detect if a (potentially remote) server is one-request-at-a-time, without just waiting for a timeout. Ideally the check would be skipped for any such server.
So let's do as much as we can: Use guzzle/curl to set the shorter timeout, and skip for the known built-in server.