From 64af6e0cdc2c3d5dd122d9415ac5960c774758b5 Mon Sep 17 00:00:00 2001
From: Michael Sanders <michael@fruitcake.nl>
Date: Thu, 1 Oct 2026 11:48:18 +0200
Subject: [PATCH] Sync safe fixes from upstream laravel/valet

Port low-risk, platform-agnostic fixes from laravel/valet v4.12.0:

- server.php: unset Valet internals ($valetConfig, $valetSitePath, etc.)
  before including the front controller, so they no longer leak into the
  user application's global scope.
- server.php / Server.php: use require instead of require_once for the
  front controller and the 404 template, which are meant to run every request.
- ValetDriver: load .valet-env.php with include instead of include_once,
  so a second call returns the variables array rather than int(1).
- CraftValetDriver: unset $_SERVER['argv'] in frontControllerPath() so Craft
  does not mis-detect console mode under the web SAPI.
---
 .../Drivers/Specific/CraftValetDriver.php      |  4 ++++
 cli/Valet/Drivers/ValetDriver.php              |  2 +-
 cli/Valet/Server.php                           |  2 +-
 server.php                                     | 18 +++++++++++++++++-
 4 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/cli/Valet/Drivers/Specific/CraftValetDriver.php b/cli/Valet/Drivers/Specific/CraftValetDriver.php
index 57a68a5..d640bea 100644
--- a/cli/Valet/Drivers/Specific/CraftValetDriver.php
+++ b/cli/Valet/Drivers/Specific/CraftValetDriver.php
@@ -194,6 +194,10 @@ public function frontControllerPath(string $sitePath, string $siteName, string $
         $_SERVER['PHP_SELF'] = $scriptName;
         $_SERVER['DOCUMENT_ROOT'] = $sitePath.'/'.$frontControllerDirectory;
 
+        if (isset($_SERVER['argv'])) {
+            unset($_SERVER['argv']);
+        }
+
         return $indexPath;
     }
 }
diff --git a/cli/Valet/Drivers/ValetDriver.php b/cli/Valet/Drivers/ValetDriver.php
index 4217cf5..7593e7e 100755
--- a/cli/Valet/Drivers/ValetDriver.php
+++ b/cli/Valet/Drivers/ValetDriver.php
@@ -185,7 +185,7 @@ public function loadServerEnvironmentVariables(string $sitePath, string $siteNam
             return;
         }
 
-        $variables = include_once $varFilePath;
+        $variables = include $varFilePath;
 
         $variablesToSet = $variables['*'] ?? [];
 
diff --git a/cli/Valet/Server.php b/cli/Valet/Server.php
index d097e7f..c39b090 100644
--- a/cli/Valet/Server.php
+++ b/cli/Valet/Server.php
@@ -36,7 +36,7 @@ public static function domainFromSiteName(string $siteName): string
     public static function show404()
     {
         http_response_code(404);
-        require_once __DIR__.'/../../cli/templates/404.html';
+        require __DIR__.'/../../cli/templates/404.html';
         exit;
     }
 
diff --git a/server.php b/server.php
index fcdd946..b0427d5 100644
--- a/server.php
+++ b/server.php
@@ -101,6 +101,22 @@
     Server::show404();
 }
 
+/**
+ * Unset our variables to avoid leaking Valet internals into the user's application.
+ */
+unset(
+    $valetConfig,
+    $uriForIpAddressExtraction,
+    $host,
+    $server,
+    $uri,
+    $siteName,
+    $valetSitePath,
+    $valetDriver,
+    $isPhpFile,
+    $staticFilePath,
+);
+
 chdir(dirname($frontControllerPath));
 
-require_once $frontControllerPath;
+require $frontControllerPath;