Nikita Popov [Wed, 5 Aug 2020 12:56:15 +0000 (14:56 +0200)]
Unset ai_canonname field in dump
Okay, looks like ai_canonname does not get set on macos even if
AI_CANONNAME is specified, so canonicalize this in the other
direction instead and unset ai_canonname if it is present.
Nikita Popov [Wed, 5 Aug 2020 10:12:24 +0000 (12:12 +0200)]
Merge branch 'PHP-7.4'
* PHP-7.4:
Check ps -p availability in proc_nice test
Set AI_CANONNAME flag in socket_addrinfo test
Add ipv6 skipif to test
Improve privilege check in pcntl_setpriority() test
Nikita Popov [Wed, 5 Aug 2020 08:42:08 +0000 (10:42 +0200)]
Merge branch 'PHP-7.4'
* PHP-7.4:
Suppress warning in pcntl_unshare skipif
Use standard types in fopencookie test
Remove posix_kill() test
Relax error message check
Check whether setlocale -a is available
Nikita Popov [Tue, 4 Aug 2020 13:06:19 +0000 (15:06 +0200)]
Remove posix_kill() test
This test is doing something really dubious. There's a race
condition here that would kill some poor process that happens
to start at just the wrong time.
Nikita Popov [Tue, 4 Aug 2020 13:06:19 +0000 (15:06 +0200)]
Remove posix_kill() test
This test is doing something really dubious. There's a race
condition here that would kill some poor process that happens
to start at just the wrong time.
Dik Takken [Thu, 16 Jul 2020 12:20:41 +0000 (14:20 +0200)]
Deprecate libxml_disable_entity_loader()
This method was used to protect code against XXE processing attacks.
Since PHP now requires libxml >= 2.9.0 external entity loading no longer
needs to be disabled to prevent these attacks. It is disabled by default.
Also, the method has an unwanted side effect that causes a lot of
confusion: Parsing XML data from resources like files is no longer possible.
Dik Takken [Thu, 16 Jul 2020 12:19:40 +0000 (14:19 +0200)]
Bump libxml version requirement 2.7.6 => 2.9.0
Since libxml version 2.9.0 external entity loading is disabled by default.
Bumping the version requirement means that XML processing in PHP is no
longer vulnerable to XXE processing attacks by default.
Jakub Zelenka [Sat, 1 Aug 2020 13:39:33 +0000 (14:39 +0100)]
FPM: Add pm.status_listen option
This option allows getting status from different endpoint (e.g. port
or UDS file) which is useful for getting status when all children are
busy with serving long running requests.
Internally a new shared pool with ondemand process manager is used. It
means that the status requests have reserved resources and should not
be blocked by other requests.
Tyson Andre [Tue, 7 Jul 2020 22:47:52 +0000 (18:47 -0400)]
[RFC] Only unserialize Phar metadata when getMetadata() is called
In other words, don't automatically unserialize when the magic
phar:// stream wrappers are used.
RFC: https://wiki.php.net/rfc/phar_stop_autoloading_metadata
Also, change the signature from `getMetadata()`
to `getMetadata(array $unserialize_options = [])`.
Start throwing earlier if setMetadata() is called and serialization threw.
See https://externals.io/message/110856 and
https://bugs.php.net/bug.php?id=76774
This was refactored to add a phar_metadata_tracker for the following reasons:
- The way to properly copy a zval was previously implicit and undocumented
(e.g. is it a pointer to a raw string or an actual value)
- Avoid unnecessary serialization and unserialization in the most common case
- If a metadata value is serialized once while saving a new/modified phar file,
this allows reusing the same serialized string.
- Have as few ways to copy/clone/lazily parse metadata (etc.) as possible,
so that code changes can be limited to only a few places in the future.
- Performance is hopefully not a concern - copying a string should be faster
than unserializing a value, and metadata should be rare in most cases.
Remove unnecessary skip in a test(Compression's unused)
Add additional assertions about usage of persistent phars
Improve robustness of `Phar*->setMetadata()`
- Add sanity checks for edge cases freeing metadata, when destructors
or serializers modify the phar recursively.
- Typical use cases of php have phar.readonly=1 and would not be affected.
Rowan Tommins [Thu, 11 Jun 2020 18:05:00 +0000 (19:05 +0100)]
Make http stream wrapper advertise HTTP/1.1 by default
In practice, we always act as an HTTP/1.1 client, for compatibility
with servers which ignore protocol version. Sending the version in
the request will avoid problems with servers which don't ignore it.
HTTP/1.0 can still be forced using a stream context option.
* PHP-7.4:
Fix #79877: getimagesize function silently truncates after a null byte
Fix #79797: Use of freed hash key in the phar_parse_zipfile function
Fix #79877: getimagesize function silently truncates after a null byte
Fix #79797: Use of freed hash key in the phar_parse_zipfile function