https://github.com/readthedocs/readthedocs.org/issues/11615#issuecomment-2371071722

[oleibman]

Description

The following code:

php -r "file_get_contents('https://phpspreadsheet.readthedocs.io/en/latest/topics/images/01-03-filter-icon-1.png');"

The command above is issued on the command line, but the same result will happen within a program.

Resulted in this output:

Warning: file_get_contents(https://phpspreadsheet.readthedocs.io/en/latest/topics/images/01-03-filter-icon-1.png): Failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden
 in Command line code on line 1

Call Stack:
    0.0007     473600   1. {main}() Command line code:0
    0.0013     473632   2. file_get_contents($filename = 'https://phpspreadsheet.readthedocs.io/en/latest/topics/images/01-03-filter-icon-1.png') Command line code:1

But I expected this output instead:

// no warning/error message

We have been using this code for years. It works with latest versions of Php8.0 (8.0.30) and Php8.1 (8.1.28), but not 8.2 (8.2.18) nor 8.3 (8.3.6) (problem showed up yesterday for the first time, I had not applied any Php maintenance since its last successful run). I raised an issue with readthedocs (readthedocs/readthedocs.org#11615), but they think it is a problem with Php, not with their server. We have set allow_url_fopen to true in php.ini in all of 8.0/8.1/8.2/8.3.

PHP Version

PHP 8.2.18, PHP 8.3.6

Operating System

Windows, Ubuntu

[cmb69]

Try

$ctx = stream_context_create(["ssl" => ["crypto_method"=>STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT]]);
file_get_contents('https://phpspreadsheet.readthedocs.io/en/latest/topics/images/01-03-filter-icon-1.png', false, $ctx)

[oleibman]

@cmb69 Thank you, that does appear to work. Can you give a bit more explanation? In particular, why would my original code suddenly stop working without any changes to Php (at my end) or the website? Is it safe to assume that this code is not needed for Php8.1, but is required for Php8.2/8.3?

[oleibman]

Also, is the code required for protocols other than https, in particular, is it needed for http?

[cmb69]

In particular, why would my original code suddenly stop working without any changes to Php (at my end) or the website? Is it safe to assume that this code is not needed for Php8.1, but is required for Php8.2/8.3?

I think that is not really related to the PHP version, but rather to the OpenSSL version used. Official Windows prior to PHP 8.2.0 use OpenSSL 1.1, but as of PHP 8.2.0, they use OpenSSL 3.0. Not sure what exactly changed.

Also, is the code required for protocols other than https, in particular, is it needed for http?

No (only if the http site would redirect to https). See also https://www.php.net/manual/en/context.php.

[damianwadley]

A 403 in response to a bad SSL version? I would have expected the connection to be rejected in that case...

My guess would be they instituted an IP address and/or user agent block. The domain is backed by Cloudflare, after all...

[cmb69]

Good point, @damianwadley! However, I could repro the 403 with the default stream context, but with the explicit context the download worked.