関数の作成

@@ -135,6 +135,12 @@ PHP 5.4.0 以降で利用可能。 + zend.detect-unicode + NULL + PHP_INI_ALL + Available since PHP 5.4.0 + + zend.signal_check "0" PHP_INI_SYSTEM @@ -147,10 +153,10 @@ PHP 5.0.0 以降で利用可能。PHP 5.3.0 で削除。 - detect_unicode + detect_unicode "1" PHP_INI_ALL - PHP 5.1.0 以降で利用可能。&removed.php.future; + PHP 5.1.0 以降で利用可能。PHP 5.4.0 で名前を zend.detect-unicode に変更。 @@ -424,6 +430,10 @@ マルチバイトエンコーディングで書かれたソースファイルをパースできるようにします。 + zend.multibyte を有効にしないと、マルチバイト文字データの中に特殊文字を含むエンコーディング + (SJIS や BIG5 など) を使えません。 + ISO-8859-1 互換のエンコーディングである UTF-8 や + EUC などを使う場合は、このオプションは不要です。 @@ -438,38 +448,40 @@ この値を使うのは、 declare(encoding=...) ディレクティブがスクリプトの先頭に存在しない場合です。 + ISO-8859-1 非互換のエンコーディングを使う場合は、 + zend.multibyte と zend.script_encoding を両方とも指定する必要があります。 - - + + - zend.signal_check + zend.detect_unicode boolean - 置き換えられたシグナルハンドラを、シャットダウン時にチェックします。 + BOM (Byte Order Mark) を調べ、 + ファイルが有効なマルチバイト文字を含むかどうかを確認します。 + この検出は、 + __halt_compiler の処理より前に行われます。 + Zend Multibyte モードでのみ利用可能です。 - + - detect_unicode + zend.signal_check boolean - BOM (Byte Order Mark) を調べ、 - ファイルが有効なマルチバイト文字を含むかどうかを確認します。 - この検出は、 - __halt_compiler の処理より前に行われます。 - Zend Multibyte モードでのみ利用可能です。 + 置き換えられたシグナルハンドラを、シャットダウン時にチェックします。 - + exit_on_timeout Modified: phpdoc/ja/trunk/appendices/ini.list.xml =================================================================== --- phpdoc/ja/trunk/appendices/ini.list.xml 2014-07-10 19:46:36 UTC (rev 334238) +++ phpdoc/ja/trunk/appendices/ini.list.xml 2014-07-10 23:24:28 UTC (rev 334239) @@ -1,6 +1,6 @@ - +

@@ -631,10 +631,10 @@ PHP 5.4.0 で削除。 - detect_unicode + detect_unicode "1" PHP_INI_ALL - PHP 5.1.0 以降で利用可能。PHP 5.4.0 で削除。 + PHP 5.1.0 以降で利用可能。PHP 5.4.0 では名前を zend.detect_unicode に変更。 disable_classes @@ -3385,7 +3385,7 @@ PHP 4.3.0 以降で利用可能。PHP 5.0.0 で削除。 - zend.detect_unicode + zend.detect_unicode "1" PHP_INI_ALL PHP 5.4.0 以降で利用可能。 Modified: phpdoc/ja/trunk/internals2/funcs/index.xml =================================================================== --- phpdoc/ja/trunk/internals2/funcs/index.xml 2014-07-10 19:46:36 UTC (rev 334238) +++ phpdoc/ja/trunk/internals2/funcs/index.xml 2014-07-10 23:24:28 UTC (rev 334239) @@ -1,6 +1,6 @@ - + 関数の作成 @@ -255,7 +255,7 @@ r resource - char* + zval* s Modified: phpdoc/ja/trunk/reference/pgsql/constants.xml =================================================================== --- phpdoc/ja/trunk/reference/pgsql/constants.xml 2014-07-10 19:46:36 UTC (rev 334238) +++ phpdoc/ja/trunk/reference/pgsql/constants.xml 2014-07-10 23:24:28 UTC (rev 334239) @@ -1,11 +1,33 @@ - + &reftitle.constants; &extension.constants; + + + PGSQL_LIBPQ_VERSION + (string) + + + + 短い形式の libpq バージョン情報。数字とドットだけの形式です。 + + + + + + PGSQL_LIBPQ_VERSION_STR + (string) + + + + 長い形式の libpq バージョン情報。コンパイラの情報も含めます。 + + + PGSQL_ASSOC Modified: phpdoc/ja/trunk/reference/pgsql/functions/pg-result-error.xml =================================================================== --- phpdoc/ja/trunk/reference/pgsql/functions/pg-result-error.xml 2014-07-10 19:46:36 UTC (rev 334238) +++ phpdoc/ja/trunk/reference/pgsql/functions/pg-result-error.xml 2014-07-10 23:24:28 UTC (rev 334239) @@ -1,7 +1,7 @@ - + @@ -56,8 +56,9 @@ &reftitle.returnvalues; + 文字列を返します。エラーがない場合は空文字列を返します。 result パラメータに関連付けられたエラーがある場合は - それを文字列で返し、それ以外の場合は &false; を返します。 + それを文字列で返します。それ以外の場合は &false; を返します。 Modified: phpdoc/ja/trunk/reference/session/security.xml =================================================================== --- phpdoc/ja/trunk/reference/session/security.xml 2014-07-10 19:46:36 UTC (rev 334238) +++ phpdoc/ja/trunk/reference/session/security.xml 2014-07-10 23:24:28 UTC (rev 334239) @@ -1,6 +1,6 @@ - + @@ -9,11 +9,144 @@ 外部リンク: Session fixation + HTTP session management is core of web security. All of mitigation + should be adopted to make sure session security. Developer should + enable/use applicable settings appropriately. + + + + + + session.cookie_lifetime=0. + 0 have special meaning. It tells browsers not to store cookie to + permanent storage. Therefore, when browser is terminated, session + ID cookie is deleted immediately. If developer set other than 0, it may + allow other users to use the session ID. Most applications should + use "0" for this. If auto login feature is required, implement + your own secure auto login feature. Do not use session ID for it. + + + + + + session.use_cookies=On and + session.use_only_cookies=On. + Although HTTP cookie has some problems, cookie is preferred way to + manage session ID. Use only cookies for session ID management when + it is possible. Most applications should use cookie for session + ID. + + + + + + session.use_strict_mode=On. + This prevents session module to use uninitialized session ID. In + other word, session module only accepts valid session ID generated + by session module. It rejects session ID supplied by + users. Session ID injection could be done by cookie injection via + JavaScript permanently or temporarily. When transparent session is + enabled, session ID could be injected via query string or form + parameter. There is no reason to accept user supplied session ID, + most applications must not accept user supplied uninitialized + session ID. + + + + + + session.cookie_httponly=On. + Disallow access to session cookie by JavaScript. This setting + prevents cookies stolen by JavaScript injection. It is possible + to use session ID as CSRF protection key, but this is not + recommended. For example, HTML source may be saved and sent to + other users. Developer should not write session ID in web pages for + better security. Almost all applications must use httponly attribute for + session ID cookie. + + + + + + session.cookie_secure=On. + Allows access to session ID cookie only when protocol is HTTPS. If + your web site is HTTPS only web site, you must enable this + setting. Use of HSTS should be considered for HTTPS only web site. + + + + + + session.gc_maxlifetime=[choose smallest possible]. + GC is performed by probability. This setting does not guarantee old + session deletion. Some session save handler modules do not use + this setting. Refer to session save handler documentation for + details. Although developer cannot rely on this setting, setting this + to smallest possible value is recommended. Adjust session.gc_probability + and session.gc_divisor so that + obsolete sessions are deleted by appropriate frequency. If auto login + feature is required, implement your own secure auto login feature. + Do not use long life session ID for it. + + + + + + session.use_trans_sid=Off. + Use of transparent session ID management is not prohibited. You + may use it when it is needed. However, disabling transparent + session ID management would improve general session ID security by + removing possibility of session ID injection and session ID leak. + + + + + + session.referer_check=[your originating URL] + When session.use_trans_sid + is enabled, use of this setting is recommended if it is + possible. It reduces risk of session ID injection. If your site is + http://example.com/, set http://example.com/ to it. Note that when + HTTPS is used, browser will not send referrer header. Browser may + not send referrer header by configuration. Therefore, this setting + is not reliable security measure. + + + + + + session.cache_limiter=nocache. + Make sure HTTP contents are not cached for authenticated + session. Allow caching only when contents is not + private. Otherwise, contents may be exposed. "private" may be used + if HTTP content does not include security sensitive data. Note + that "private" may leave private data cached by shared + clients. "public" may be used only when HTTP content does not + contain any private data at all. + + + + + + session.hash_function="sha256". + Stronger hash function will generates stronger session + ID. Although hash collision is unlikely even with MD5 hash, developers + should use SHA-2 or later hash functions for the task. Developers may + use stronger hashes like sha384 and sha512. + + + + + セッションモジュールは、セッションに保存した情報を見ることができるのがそのセッションを作成したユーザーだけであることを保証することができません。セッションの完全性を積極的に守るには、そのセッションに紐づく値に応じた追加措置が必要です。 + セッションに運ばれるデータの重要性を評価し、必要な保護策を講じてください。この対策は、通常は何らかの犠牲を伴うもので、ユーザーの利便性を損なうことになります。 @@ -22,6 +155,8 @@ この場合、ユーザー側でクッキーが常に有効となっていなければならず、有効でない場合はセッションが動作しなくなります。 + + 存在するセッションIDが第三者に洩れる手順は何種類かあります。洩れたセッションIDにより、第三者が特定のIDに関連する全てのリソー @@ -33,6 +168,111 @@ 合、セッションIDはネットワーク上を平文テキストで伝送されます。解決策はサーバー上にSSLを実装し、ユーザーにSSLを必ず使用させることです。 + + + Since PHP 5.5.2, session.use_strict_mode + is available. When it is enabled and save handler module supports + it, uninitialized session ID is rejected and new session ID is + created. This protects attack that force users to use known session + ID. Attacker may paste links or send mail that contains session + ID. e.g. http://example.com/page.php?PHPSESSID=123456789 If session.use_trans_sid is + enabled, victim will start session using attacker provided session + ID. session.use_strict_mode + mitigates the risk. + + + + Even though session.use_strict_mode + mitigates risk of adoptive session management, attacker can force + users to use initialized session ID which is created by + attacker. All attacker has to do is initialize session ID prior to + attack and keep it alive. + + + + Session ID cookie could be set with domain, path, httponly, secure + attributes. There is precedence defined by browsers. By using the + precedence, attacker can set session ID that could be used + permanently. Use of session.use_only_cookies + will not solve this issue. session.use_strict_mode + mitigates this risk. With session.use_strict_mode=On, + uninitialized session ID will not be accepted. Session module + creates new session ID always when session ID is not initialized by + session module. This could result in DoS to victim, but DoS is + better than compromised account. + + + + session.use_strict_mode + is good mitigation, but it is not enough mitigation for + authenticated session. Developer must use + session_regenerate_id for authentication. + session_regenerate_id must be called prior to + set authentication information to + $_SESSION. session_regenerate_id makes sure new + session contains authenticated information stored only in new + session. i.e. Errors during authentication process may save + authenticated flag in old session. + + + + Calling session_regenerate_id function could + result in personal DoS like use_strict_mode=On. However, DoS is + better than compromised account. Session ID should be regenerated + when user is authenticated at least. Session ID regeneration reduces + risk of stolen session ID, thus is should be called periodically. + Developer should not rely on session ID expiration. Attackers may + access victim's session ID periodically to prevent expiration. + Developers must implement their own expiration feature for old sessions. + + + + Note that session_regenerate_id does not delete + old session by default. Old authenticated session may be available + for use. If developer would like to prevent old authenticated session to + be used by anyone, developer must destroy session by setting + delete_old_session to &true;. However, + immediate old session deletion has unwanted side effect. Session + could be vanished when there are concurrent connections to web + application and/or network is unstable. Instead of deleting old + session immediately, you may set short term expiration time in + $_SESSION by yourselves. If user accesses to obsolete + session(expired session), deny access to it. + + + + session.use_only_cookies + and proper use of session_regenerate_id could + cause personal DoS. When this is the case, you may ask users to + remove cookies and warn users that there could be possible security + issues. Attackers may set malicious cookies via vulnerable web + application (i.e. JavaScript injection), vulnerable/malicious + browser plugins, etc. + + + + Developers must not use long life session ID for auto login as it + increases risk of stolen session. Auto login should be implemented + by developer. Use secure one time hash key as auto login key using + cookie. Use secure hash stronger than SHA-2. e.g. SHA-256 or greater + with random data from /dev/urandom or like. If user is not + authenticated, check the one time auto login key is valid or not. If + key is valid, authenticate user and set new secure one time hash + key. Auto login key is long lived authentication key, this key should + be protected as much as possible. Use path/httponly/secure + attributes of cookie to protect. Developer must implement feature that + disables auto login and removes unneeded auto login key cookie for + users. +