fix #33597 (setcookie() "expires" date format doesn't comply with RFC)

diff --git a/NEWS b/NEWS
index 787fda0e08d897fdc6244c21f0deda0a384376c6..1acf2b619382fb9da75127b049f6b5c48a5b6811 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,8 @@ PHP                                                                        NEWS
 - Fixed crash inside stream_get_line() when length parameter equals 0. (Ilia)
 - Fixed bug #33605 (substr_compare() crashes with negative offset and length). 
   (Tony)
+- Fixed bug #33597 (setcookie() "expires" date format doesn't comply with RFC).
+  (Tony)
 - Fixed bug #33578 (strtotime() doesn't understand "11 Oct" format). (Derick)
 - Fixed bug #33562 (date("") crashes). (Derick)
 - Fixed bug #33536 (strtotime() defaults to now even on non time string).

diff --git a/ext/standard/head.c b/ext/standard/head.c
index e8e0486cfca7d38f3cde37de3f4a4bfe5fd7ff88..6fe646e8b33b73dfe36e142a5c352e371edd6f2a 100644 (file)
--- a/ext/standard/head.c
+++ b/ext/standard/head.c
@@ -20,6 +20,7 @@
 #include <stdio.h>
 #include "php.h"
 #include "ext/standard/php_standard.h"
+#include "ext/date/php_date.h"
 #include "SAPI.h"
 #include "php_main.h"
 #include "head.h"
@@ -103,15 +104,16 @@ PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, t
                 * pick an expiry date 1 year and 1 second in the past
                 */
                t = time(NULL) - 31536001;
-               dt = php_std_date(t TSRMLS_CC);
-               sprintf(cookie, "Set-Cookie: %s=deleted; expires=%s", name, dt);
+               dt = php_format_date("D, d-M-Y H:i:s", sizeof("D, d-M-Y H:i:s")-1, t, 0);
+               sprintf(cookie, "Set-Cookie: %s=deleted; expires=%s GMT", name, dt);
                efree(dt);
        } else {
                sprintf(cookie, "Set-Cookie: %s=%s", name, value ? encoded_value : "");
                if (expires > 0) {
                        strcat(cookie, "; expires=");
-                       dt = php_std_date(expires TSRMLS_CC);
+                       dt = php_format_date("D, d-M-Y H:i:s", sizeof("D, d-M-Y H:i:s")-1, t, 0);
                        strcat(cookie, dt);
+                       strcat(cookie, " GMT");
                        efree(dt);
                }
        }