PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2013, PHP 5.4.19
+?? ??? 2013, PHP 5.5.3
- Core:
- . Fixed bug #65372 (Segfault in gc_zval_possible_root when return reference
- fails). (Laruence)
- . Fixed bug #65304 (Use of max int in array_sum). (Laruence)
- . Fixed bug #65291 (get_defined_constants() causes PHP to crash in a very
- limited case). (Arpad)
- . Improved fix for bug #63186 (compile failure on netbsd). (Matteo)
+ . Fixed bug #62691 (solaris sed has no -i switch). (Chris Jones)
+ . Fixed bug #61345 (CGI mode - make install don't work). (Michael Heimpold)
. Fixed bug #61268 (--enable-dtrace leads make to clobber
Zend/zend_dtrace.d) (Chris Jones)
- . Cherry picked some DTrace build commits (allowing builds on Linux,
- bug 62691, and bug 63706) from PHP 5.5 branch
-- Session:
- . Fixed bug #62129 (rfc1867 crashes php even though turned off). (gxd305 at
- gmail dot com)
- . Fixed bug #50308 (session id not appended properly for empty anchor tags).
- (Arpad)
+- Sessions:
+ . Implemented strict sessions RFC (https://wiki.php.net/rfc/strict_sessions)
+ which protects against session fixation attacks and session collisions.
+ (Yasuo Ohgaki)
. Fixed possible buffer overflow under Windows. Note: Not a security fix.
(Yasuo)
. Changed session.auto_start to PHP_INI_PERDIR. (Yasuo)