Stop reusing PHP_VALUE for different sites with PHP-FPM
The reason this happens is most likely that "PHP settings passed with php_value or php_flag will overwrite their previous value", as described PHP-FPM documentation.
I assume that in your PHP configuration display_errors
is disabled. Then you visit the .net-page, in which your phpinfo()
confirms that it is disabled.
Then you visit the .com-page and Nginx passes display_errors=1
to your PHP-FPM worker in that same pool. That overwrites the previous value of 0
with the new value 1
. You can confirm that with phpinfo()
.
Now the PHP-FPM pool settings is set to display_errors=1
.
When you visit the .net-page again, phpinfo()
indeed confirms that display_errors=1
because it was overwritten when Nginx passed the value of 1
to the same pool that now handles another of your websites.
The solution is either to move development to another server, as suggested in the comments. Or to create a dedicated PHP-FPM pool for your site, which is the least you should do.
Bonus:
And please don't do this in your Nginx configuration: fastcgi_param PHP_VALUE "display_errors=1";
That ought to be in the php configuration file, preferably in the site's own fpm pool configuration.
But we have a lot of websites on our server, and both solutions mean a lot of routine work to set up. I was wondering if there is an easier way.
You can use the per pool prefix for a quick fix. In any case, putting multiple sites on a single worker pool is a bad idea because I only need to get one of your sites to execute a malicious php script of mine to compromise ALL other sites that use the same worker, without any effort.