Preloading support for php-vips in the future?

[futureweb]

Hi!

First of all, thanks for the awesome work on php-vips. I would really like to use php-vips 2 on production systems, but the need to enable FFI globally (due to missing preloading support) is a big concern from a security perspective.

I know that if someone already has PHP access, there are already bigger issues, but I’d still like to minimize risks as much as possible -especially on production environments.

Is there any plan to support FFI preloading in the near future, or any ideas on how this limitation might be solved going forward?

Thanks a lot!

[jcupitt]

Hi @futureweb,

We'd love to support it, someone just needs to volunteer to do the work. I don't think it would be difficult, but it would need a little expertise in php server config and testing (which I don't have).