mirror of
https://github.com/php/php-src.git
synced 2024-09-22 02:17:32 +00:00
Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5: Update header handling to RFC 7230
This commit is contained in:
commit
a1c28567c6
2
NEWS
2
NEWS
@ -7,6 +7,8 @@
|
||||
?? Feb 2015, PHP 5.6.6
|
||||
|
||||
- Core:
|
||||
. Removed support for multi-line headers, as the are deprecated by RFC 7230.
|
||||
(Stas)
|
||||
. Fixed bug #68986 (pointer returned by php_stream_fopen_temporary_file
|
||||
not validated in memory.c). (nayana at ddproperty dot com)
|
||||
. Fixed bug #67068 (getClosure returns somethings that's not a closure).
|
||||
|
@ -1,14 +1,15 @@
|
||||
--TEST--
|
||||
Bug #60227 (header() cannot detect the multi-line header with CR), \r before \n
|
||||
--INI--
|
||||
expose_php=0
|
||||
--FILE--
|
||||
<?php
|
||||
header("X-foo: e\n foo");
|
||||
header("X-Foo6: e\rSet-Cookie: ID=123\n d");
|
||||
echo 'foo';
|
||||
?>
|
||||
--EXPECTF--
|
||||
|
||||
Warning: Header may not contain more than a single header, new line detected in %s on line %d
|
||||
foo
|
||||
--EXPECTHEADERS--
|
||||
X-foo: e
|
||||
foo
|
||||
Content-type: text/html; charset=UTF-8
|
||||
|
@ -1,8 +1,9 @@
|
||||
--TEST--
|
||||
Bug #60227 (header() cannot detect the multi-line header with CR), \0 before \n
|
||||
--INI--
|
||||
expose_php=0
|
||||
--FILE--
|
||||
<?php
|
||||
header("X-foo: e\n foo");
|
||||
header("X-Foo6: e\0Set-Cookie: ID=\n123\n d");
|
||||
echo 'foo';
|
||||
?>
|
||||
@ -10,5 +11,4 @@ echo 'foo';
|
||||
Warning: Header may not contain NUL bytes in %s on line %d
|
||||
foo
|
||||
--EXPECTHEADERS--
|
||||
X-foo: e
|
||||
foo
|
||||
Content-type: text/html; charset=UTF-8
|
||||
|
@ -1,8 +1,9 @@
|
||||
--TEST--
|
||||
Bug #60227 (header() cannot detect the multi-line header with CR), CRLF
|
||||
--INI--
|
||||
expose_php=0
|
||||
--FILE--
|
||||
<?php
|
||||
header("X-foo: e\r\n foo");
|
||||
header("X-foo: e\r\nfoo");
|
||||
echo 'foo';
|
||||
?>
|
||||
@ -10,5 +11,4 @@ echo 'foo';
|
||||
Warning: Header may not contain more than a single header, new line detected in %s on line %d
|
||||
foo
|
||||
--EXPECTHEADERS--
|
||||
X-foo: e
|
||||
foo
|
||||
Content-type: text/html; charset=UTF-8
|
||||
|
@ -747,13 +747,8 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
|
||||
/* new line/NUL character safety check */
|
||||
int i;
|
||||
for (i = 0; i < header_line_len; i++) {
|
||||
/* RFC 2616 allows new lines if followed by SP or HT */
|
||||
int illegal_break =
|
||||
(header_line[i+1] != ' ' && header_line[i+1] != '\t')
|
||||
&& (
|
||||
header_line[i] == '\n'
|
||||
|| (header_line[i] == '\r' && header_line[i+1] != '\n'));
|
||||
if (illegal_break) {
|
||||
/* RFC 7230 ch. 3.2.4 deprecates folding support */
|
||||
if (header_line[i] == '\n' || header_line[i] == '\r') {
|
||||
efree(header_line);
|
||||
sapi_module.sapi_error(E_WARNING, "Header may not contain "
|
||||
"more than a single header, new line detected");
|
||||
|
Loading…
Reference in New Issue
Block a user