From: Stanislav Malyshev <stas@php.net>
Date: Tue, 29 Sep 2020 04:38:58 +0000 (-0700)
Subject: Update UPGRADING
X-Git-Tag: php-7.3.24RC1~34
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=311922ddbe091afbbf63a344ec7b96e224ecf238;p=php

Update UPGRADING
---

diff --git a/UPGRADING b/UPGRADING
index 7944087c43..2e8d358075 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -151,6 +151,11 @@ Reflection:
   . Reflection export to string now uses `int` and `bool` instead of `integer`
     and `boolean`.
 
+- SAPI:
+  . Starting with 7.3.24, incoming cookie names are not url-decoded. This was never 
+    required by the standard, outgoing cookie names aren't encoded and this leads 
+    to security issues (CVE-2020-7070).
+
 SPL:
   . If an SPL autoloader throws an exception, following autoloaders will not be
     executed. Previously all autoloaders were executed and exceptions were