Commit Graph

805 Commits

Author SHA1 Message Date
Nikita Popov
9bc2cacf7f Remove special treatment of strings in asserts
This was deprecated in PHP 7.2 as part of
https://wiki.php.net/rfc/deprecations_php_7_2.
2019-01-29 09:42:59 +01:00
Nikita Popov
97df99a6d7 Add UPGRADING entries for removed functionality 2019-01-28 16:05:02 +01:00
Christoph M. Becker
3d15a6f86b Remove deprecated INTL_IDNA_VARIANT_2003
Cf. <https://wiki.php.net/rfc/deprecate-and-remove-intl_idna_variant_2003>
2019-01-28 15:18:01 +01:00
Christoph M. Becker
e973663882 Remove deprecated png2wbmp() and jpeg2wbmp()
Cf. <https://wiki.php.net/rfc/deprecate-png-jpeg-2wbmp>
2019-01-28 14:50:52 +01:00
Christoph M. Becker
dfa6c2046a Remove deprecated image2wbmp()
Cf. <https://wiki.php.net/rfc/image2wbmp>.
2019-01-28 14:29:06 +01:00
Nikita Popov
e118151139 Clear NEWS, UPGRADING and UPGRADING.INTERNALS 2019-01-28 11:17:30 +01:00
Andreas Treichel
b1e9c73b27 Allow strip_tags with an array of allowed tagnames 2019-01-24 15:56:32 +01:00
Nikita Popov
89a4c172e2 Remove the "o" serialization format
We never generate the "o" format during serialization, so let's not
keep this unnecessary attack surface around.
2019-01-22 18:09:49 +01:00
Nikita Popov
a50198d0fe Implement ??= operator
RFC: https://wiki.php.net/rfc/null_coalesce_equal_operator

$a ??= $b is $a ?? ($a = $b), with the difference that $a is only
evaluated once, to the degree that this is possible. In particular
in $a[foo()] ?? $b function foo() is only ever called once.
However, the variable access themselves will be reevaluated.
2019-01-22 11:12:04 +01:00
Christoph M. Becker
36c825575e [ci skip] Note preloading and ext/ffi in UPGRADING 2019-01-21 15:58:02 +01:00
Christoph M. Becker
570d4311b6 Use pkg-config to detect and configure for system libgd
Formerly, a single option `--with-gd` was sufficient to enable the
extension, and to determine whether to use the system or the bundled
libgd depending on whether a directory was passed.  Since pkg-config
determines the path automatically, we now offer `--enable-gd` (whether
the extension should be build) and `--with-external-gd` (whether to use
the system libgd).
2019-01-21 14:01:34 +01:00
Tyson Andre
58a2ced052 [ci skip] Fix typos in UPGRADING 2019-01-19 17:46:03 +01:00
Nikita Popov
48ca2c0833 Document pkg-config related changes
Creating a separate section in UPGRADING for this, as there are a
lot of these, and there's going to be more of them.
2019-01-15 10:15:05 +01:00
Nikita Popov
e219ec144e Implement typed properties
RFC: https://wiki.php.net/rfc/typed_properties_v2

This is a squash of PR #3734, which is a squash of PR #3313.

Co-authored-by: Bob Weinand <bobwei9@hotmail.com>
Co-authored-by: Joe Watkins <krakjoe@php.net>
Co-authored-by: Dmitry Stogov <dmitry@zend.com>
2019-01-11 15:49:06 +01:00
Sammy Kaye Powers
74c0e580ef Improve openssl_random_pseudo_bytes()
CSPRNG implementations should always fail closed. Now
openssl_random_pseudo_bytes() will fail closed by throwing an
`\Exception` in fail conditions.

RFC: https://wiki.php.net/rfc/improve-openssl-random-pseudo-bytes
2019-01-11 11:16:05 +01:00
Andreas Treichel
3c9af3095c Preserve aspect ratio for width or height 2019-01-05 13:39:49 +01:00
Nikita Popov
a9e6667817 Detect invalid uses of parent:: during compilation
We already detect the case where we're entirely outside a class --
now also check whether there actually is a parent.

This is a minor BC break, in that code that was never executed
might have previously contained an invalid parent:: reference without
generating an error.
2019-01-04 11:55:41 +01:00
Nikita Popov
f1c0e671e9 Add performance improvement section to UPGRADING
[ci skip]
2018-12-26 22:26:49 +01:00
Eli Schwartz
285a077c12 ext/gd: use --with instead of --enable
By convention it probably makes sense to stick with this even when
dropping the *-dir=DIR part.

See:
https://github.com/php/php-src/pull/3632#discussion_r229474568
https://autotools.io/autoconf/arguments.html
2018-12-26 13:37:39 +01:00
BohwaZ
82af24f2b2 Implement SQLite3Stmt::getSQL method, returning the original statement SQL, eventually expanded 2018-12-15 17:27:33 +01:00
Christoph M. Becker
3b0f051193 Allow empty $escape to eschew escaping CSV
Albeit CSV is still a widespread data exchange format, it has never been
officially standardized.  There exists, however, the “informational” RFC
4180[1] which has no notion of escape characters, but rather defines
`escaped` as strings enclosed in double-quotes where contained
double-quotes have to be doubled.  While this concept is supported by
PHP's implementation (`$enclosure`), the `$escape` sometimes interferes,
so that `fgetcsv()` is unable to correctly parse externally generated
CSV, and `fputcsv()` is sometimes generating non-compliant CSV.  Since
PHP's `$escape` concept is availble for many years, we cannot drop it
for BC reasons (even though many consider it as bug).  Instead we allow
to pass an empty string as `$escape` parameter to the respective
functions, which results in ignoring/omitting any escaping, and as such
is more inline with RFC 4180.  It is noteworthy that this is almost no
userland BC break, since formerly most functions did not accept an empty
string, and failed in this case.  The only exception was `str_getcsv()`
which did accept an empty string, and used a backslash as escape
character then (which appears to be unintended behavior, anyway).

The changed functions are `fputcsv()`, `fgetcsv()` and `str_getcsv()`,
and also the `::setCsvControl()`, `::getCsvControl()`, `::fputcsv()`,
and `::fgetcsv()` methods of `SplFileObject`.

The implementation also changes the type of the escape parameter of the
PHP_APIs `php_fgetcsv()` and `php_fputcsv()` from `char` to `int`, where
`PHP_CSV_NO_ESCAPE` means to ignore/omit escaping.  The parameter
accepts the same values as `isalpha()` and friends, i.e. “the value of
which shall be representable as an `unsigned char` or shall equal the
value of the macro `EOF`.  If the argument has any other value, the
behavior is undefined.”  This is a subtle BC break, since the character
`chr(128)` has the value `-1` if `char` is signed, and so likely would
be confused with `EOF` when converted to `int`.  We consider this BC
break to be acceptable, since it's rather unlikely that anybody uses
`chr(128)` as escape character, and it easily can be fixed by casting
all `escape` arguments to `unsigned char`.

This patch implements the feature requests 38301[2] and 51496[3].

[1] <https://tools.ietf.org/html/rfc4180>
[2] <https://bugs.php.net/bug.php?id=38301>
[3] <https://bugs.php.net/bug.php?id=51496>
2018-12-15 14:38:15 +01:00
Christoph M. Becker
8c781c1c20 Resolve imagecropauto() default $mode quirk
The `$mode` parameter of `imagecropauto()` defaults to `-1`.  However,
`-1` is changed to `GD_CROP_DEFAULT` right away, so basically the
default is `GD_CROP_DEFAULT`, which is rather confusing and
unnecessary.

Therefore, we change the default to `IMG_CROP_DEFAULT`, but still allow
an explicit `-1` to be passed for BC reasons, in which case we trigger
a deprecation notice, so we can rid the `-1` support eventually.
2018-12-12 17:25:37 +01:00
Christoph M. Becker
f0f4ab4b02 [ci skip] Fix names of the constants
`GD_CROP_DEFAULT` and `GD_CROP_SIDES` are names of libgd constants, and
as such they are not relevant for userland developers.  Therefore, we
replace them by the constant names of our wrapper, i.e.
`IMG_CROP_DEFAULT` and `IMG_CROP_SIDES`, respectively.
2018-12-01 23:54:17 +01:00
Christoph M. Becker
dcad13e8c9 Fix #73291: imagecropauto() $threshold differs from external libgd
Since upstream does not appear to move in any way[1], we sync our
behavior.  Even though the BC break is ugly (which is the reason we
target master only), having to deal with different algorithms is even
worse for portable userland code.

[1] <https://github.com/libgd/libgd/issues/334>
2018-12-01 18:49:30 +01:00
Christoph M. Becker
947ca9f43d Sync behavior of gdImageAutoCrop() with upstream
Since cropping support has been added to our bundled libgd,
`gdImageAutoCrop` differs from upstream in that `GD_CROP_DEFAULT` falls
back on `GD_CROP_SIDES` if there is no transparent color in the image.
While this difference seem to be a useful improvement in our bundled
libgd, upstream has not yet signaled that there willing to back-port
it[1], so we revert it to stay in sync with upstream.

We also remove the additional NULL bailout at the end of the function,
which doesn't appear to be relevant any longer since bug 77198 has been
fixed.

[1] <https://github.com/libgd/libgd/issues/298>
2018-12-01 15:34:10 +01:00
Christoph M. Becker
a757ebb5b5 Require SQLite ≥ 3.7.4 for ext/sqlite3
`SQLite3::readOnly()` uses `sqlite3_stmt_readonly()` which is only
available as of libsqlite 3.7.4.  For older SQLite3 versions we return
always `false`, which can be confusing.  Instead of sticking with this
behavior, or even undefining the method for old SQLite3 versions, we
lift the requirements to SQLite 3.7.4 (released on 2010-12-08),
according to a respective discussion[1].

Since pdo_sqlite doesn't use `sqlite3_stmt_readonly()`, we stick with
the minimum requirement of SQLite 3.5.0.

[1] <https://github.com/php/php-src/pull/3614>
2018-11-29 15:10:39 +01:00
Christoph M. Becker
035de21d77 Deny (un)serialization of SQLite3, SQLite3Stmt and SQLite3Result
Serializing `SQLite3`, `SQLite3Stmt` and `SQLite3Result` instances is
possible but pointless, since unserializing results in uninitialized
instances, which will bail out of any method call.  Therefore, we deny
serialization and unserialization in the first place.
2018-11-29 01:08:03 +01:00
Nikita Popov
28edeb2ba3 User serialize_deny for PDOStatement as well 2018-11-26 13:30:57 +01:00
Nikita Popov
6e4b202694 Switch PDO to use serialize_deny
And remove dummy __sleep/__wakeup. This switches the thrown
exception type from PDOException to Exception.
2018-11-26 13:28:14 +01:00
Nikita Popov
a624c2bd13 Use serialize_deny for CURLFile
Instead of a throwing __wakeup() method.
2018-11-26 13:20:51 +01:00
Nikita Popov
022eea8be1 Check for zero SplPriorityQueue extract flags earlier
Generate an exception during the SplPriorityQueue::setExtracFlags()
call instead of generating E_RECOVERABLE_FATAL all over the place
later.
2018-11-15 21:05:05 +01:00
Peter Kokot
35a9ec1b0d [ci skip] Update UPGRADING 2018-11-15 10:46:48 +01:00
Christoph M. Becker
86c6b3bdcd Support SQLite3 @name notation
Besides the common `:param` notation to designate named parameters in
prepared statements, SQLite3 also supports `@param` and `$param`.
While the latter is mostly to support the Tcl programming language, and
would be confusing for PHP's sqlite3 binding due to the similarity with
string interpolation, the former is common under .NET and raises no
such issue.  Therefore we add support for it.

This patch has been developed in cooperation with @BohwaZ.
2018-11-11 14:55:34 +01:00
Eli Schwartz
2d03197749 ext/gd: Use pkg-config to detect the availability of freetype2
The latest version of freetype2 does not install freetype-config by
default, but pkg-config support has been there for approximately 15
years. In order to reliably detect freetype2, pkg-config *must* be used.

See:
https://savannah.nongnu.org/bugs/?53093
https://bugs.php.net/bug.php?id=76324
2018-11-07 13:05:47 +01:00
Christoph M. Becker
0d6490598d Add TIDY_TAG_* constants supported by libtidy 5
Cf. <http://api.html-tidy.org/tidy/tidylib_api_5.0.0/tidyenum_8h.html#ae5b597c0999422ff383f08ab595ef5e8a16d20becf3c3cb022ddabccc83d8c314>.
2018-10-27 16:17:09 +02:00
Peter Kokot
37c329d715 Trim trailing whitespace in source code files 2018-10-13 14:17:28 +02:00
Christoph M. Becker
87392eff1a Require SQLite ≥ 3.5.0 for ext/sqlite3 and ext/pdo_sqlite
It is possible to pass flags when opening an SQLite database.  For
Sqlite < 3.5.0 these are ignored, since `sqlite3_open` doesn't support
flags.  Neither a warning or notice is raised in this case, nor is this
behavior documented in the PHP manual.  Instead of fixing it either
way, we lift the requirement to SQLite 3.5.0 (released on 2007-09-04)
instead of the former SQLite 3.3.9 (released on 2007-01-04).
2018-10-13 12:15:58 +02:00
Nikita Popov
0b6063f331 Restore array_key_exists() compatibility for ArrayObject
Doing this by special-casing array_key_exists() for ArrayObject.
2018-10-11 16:10:22 +02:00
Nikita Popov
5a679341b8 Add UPGRADING notes
[ci skip]
2018-10-10 12:00:57 +02:00
Christoph M. Becker
849a896a5e [ci skip] Update NEWS and UPGRADING wrt. unbundling libsqlite 2018-10-06 12:45:06 +02:00
Anatol Belski
969fdb717a Update UPGRADING [ci skip] 2018-10-03 19:11:31 +02:00
Kalle Sommer Nielsen
bf34442581 Implemented RFC "Always available hash extension" 2018-10-03 08:47:07 +02:00
Remi Collet
3d5fe90e7e NEWS and UPGRADING 2018-10-01 07:24:04 +02:00
Nikita Popov
fc18f44213 Deprecate unbinding of $this of non-static methods
Static calls to non-static methods have been fully deprecated in
PHP 7.0 as part of https://wiki.php.net/rfc/reclassify_e_strict.

A combination of ReflectionMethod::getClosure() ("fake closures")
and Closure::bindTo() etc can be used to achieve the same behavior.
This commit ensures that a deprecation notice will be thrown also
in this case.
2018-09-29 21:01:27 +02:00
Nikita Popov
96da1fe8a9 Fixed bug #76737
Explicitly prohibit serialization and unserialization of reflection
objects.
2018-09-29 14:47:57 +02:00
Nikita Popov
74235ca5f3 Bump minimum libxml version to 2.7.6
Released Oct 2009, part of RHEL 6.
2018-09-23 15:51:09 +02:00
Christoph M. Becker
7b9b398daa Update NEWS and UPGRADING wrt. PR 2760 2018-09-21 15:15:40 +02:00
Nikita Popov
1a55c3607d Drop --without-libzip option from Travis
We need to build against the system libzip now.

Also add an UPGRADING note.
2018-09-18 12:16:55 +02:00
Christoph M. Becker
6da3a1e3ce Revert "Implement #67331: Have parse_ini_file add empty entries"
This reverts commit 3f3e914df3.

The commit broke some tests on Windows, and generally needs more
though.
2018-09-15 17:08:58 +02:00
Christoph M. Becker
3f3e914df3 Implement #67331: Have parse_ini_file add empty entries
Some INI processors allow to specify empty values by just giving the
key without the equals sign, for instance MySQL and Python.  It appears
to be sensible to add this possibility to our INI parser, so that it
can be used for such INI files as well.  We choose NULL as the value of
empty values.

This syntactical enhancement is a (minor) BC break, though, as can be
seen by the necessary change to bug49692.ini.  The “comment” formerly
has been simply ignored, but now it would be parsed as key with an
empty value.

This PR is based on Adam's former patch.
2018-09-15 15:37:01 +02:00