build: replace the bundled xmlrpc library with phpxmlrpc 4

Author: endelwar

CHANGELOG.md

@@ -11,6 +11,7 @@
 - Add correlated structured logging to all MailScanner REST requests
 
 ### Changed
+- Replace the bundled `phpxmlrpc` 3.0.0.beta with the maintained `phpxmlrpc/phpxmlrpc` 4.x from Composer; node-to-node RPC keeps the same wire format, and the deprecation notices the bundled copy emitted on PHP 8.2 and later are gone
 - Move the three REST APIs from legacy `mysqli` access to Doctrine DBAL without changing their versioned contracts
 - Rename terminology from "whitelist/blacklist" to "allowlist/blocklist" throughout the application (database tables, columns, Perl modules, UI) (#1186)
 - Standardised database charset to utf8mb4 with unicode_520_ci collation
@@ -22,6 +23,7 @@
 
 ### Compatibility
 - The minimal PHP version is now 8.3.
+- `ext-xml` is now a declared requirement rather than a suggestion; it was already mandatory at runtime
 - The minimal supported MySQL version is now 5.7.42
 - The minimal supported MariaDB version is now 10.4.34
 

composer.json

@@ -7,8 +7,10 @@
         "php": "8.3.* || 8.4.* || 8.5.*",
         "ext-mysqli": "*",
         "ext-pdo_mysql": "*",
+        "ext-xml": "*",
         "doctrine/dbal": "^4.4",
         "doctrine/migrations": "^3.9",
+        "phpxmlrpc/phpxmlrpc": "^4",
         "psr/log": "^3",
         "symfony/mailer": "^6|^7|^8",
         "symfony/process": "^6|^7|^8",
@@ -32,8 +34,8 @@
     },
     "suggest": {
         "ext-ldap": "For LDAP support",
-        "ext-xml": "For XMLRPC support",
-        "ext-imap": "For IMAP support"
+        "ext-imap": "For IMAP support",
+        "ext-curl": "For node-to-node RPC over HTTPS"
     },
     "autoload": {
         "psr-4": {

composer.lock

@@ -113,8 +113,7 @@
 // Set PHP path to use local PEAR modules only
 set_include_path(
     '.' . PATH_SEPARATOR .
-    MAILWATCH_HOME . '/lib/pear' . PATH_SEPARATOR .
-    MAILWATCH_HOME . '/lib/xmlrpc'
+    MAILWATCH_HOME . '/lib/pear'
 );
 
 // ForceUTF8
@@ -150,9 +149,14 @@
 if (!function_exists('xml_parser_create') && (!ini_get('enable_dl') || true !== @dl('xml.so'))) {
     exit(__('phpxmlnotloaded03'));
 }
-require_once __DIR__ . '/lib/xmlrpc/xmlrpc.inc';
-require_once __DIR__ . '/lib/xmlrpc/xmlrpcs.inc';
-require_once __DIR__ . '/lib/xmlrpc/xmlrpc_wrappers.inc';
+// The compatibility layer of phpxmlrpc 4, which declares the same global
+// names the pages and rpcserver.php have always used. Upstream marks it
+// deprecated: it is here so that a maintained library replaces the vendored
+// 3.0.0.beta without touching a line of protocol code, and it goes when the
+// REST replacement of section 12 does.
+require_once \dirname(__DIR__) . '/vendor/phpxmlrpc/phpxmlrpc/lib/xmlrpc.inc';
+require_once \dirname(__DIR__) . '/vendor/phpxmlrpc/phpxmlrpc/lib/xmlrpcs.inc';
+require_once \dirname(__DIR__) . '/vendor/phpxmlrpc/phpxmlrpc/lib/xmlrpc_wrappers.inc';
 
 include __DIR__ . '/postfix.inc.php';
 include __DIR__ . '/msmail.inc.php';
@@ -3809,7 +3813,7 @@ function is_rpc_client_allowed()
 }
 
 /**
- * @return xmlrpcresp
+ * @return \PhpXmlRpc\Response
  */
 function xmlrpc_wrapper($host, $msg)
 {
@@ -3834,7 +3838,11 @@ function xmlrpc_wrapper($host, $msg)
     $client->setSSLVerifyPeer(false);
     $client->setSSLVerifyHost(0);
 
-    return $client->send($msg, 0, $method);
+    $response = $client->send($msg, 0, $method);
+
+    // The client answers with an array only when it is given several requests
+    // at once, which no caller here does.
+    return \is_array($response) ? reset($response) : $response;
 }
 
 /**