Bug #67720 [Wfx->Opn]: Backport security and usability fixes to PHP 5.3

Edit report at https://bugs.php.net/bug.php?id=67720&edit=1 ID: 67720 Updated by: requinix@php.net Reported by: neweracracker at gmail dot com Summary: Backport security and usability fixes to PHP 5.3 -Status: Wont fix +Status: Open Type: Bug Package: *General Issues Operating System: Irrelevant PHP Version: 5.3 Assigned To: johannes Block user comment: N Private report: N New Comment: Alright. When I checked the patches I only saw changes to type checks, warning messages, and year calculations. Meanwhile the two bugs didn't mention potential security problems: a Y2K bug that would expire future certs and an incorrect warning about valid dates. I'll flip this back to open so there's no confusion about why it's wontfix. Previous Comments: ------------------------------------------------------------------------ [2014-07-30 20:55:21] neweracracker at gmail dot com That's correct nikic. ------------------------------------------------------------------------ [2014-07-30 20:06:54] nikic@php.net @requinix: At least the second patch may be classified as a security fix (same as the phpingo one). And if I understood correctly, the first patch fixes problems (maybe a BC break?) introduced by another security patch. Assigning johannes so he can check whether or not these should be included. ------------------------------------------------------------------------ [2014-07-30 17:40:09] requinix@php.net PHP 5.3 is EOL, however it will have one final release for some security fixes. No usability fixes, no warning fixes. http://markmail.org/thread/hqzeneo77i35pn5z ------------------------------------------------------------------------ [2014-07-30 17:21:16] neweracracker at gmail dot com Description: ------------ I noticed security related bugfixes were backported to PHP 5.3 branch: http://git.php.net/?p=php-src.git;a=shortlog;h=refs/heads/PHP-5.3 It is my opinion that there are more two bugfixes to be backported. One is a usability fix for the SSL certificates using GeneralizedTime format, see bugs #65698 and #66636. Another one is for issues related with type confusion: http://git.php.net/?p=php-src.git;a=commit;h=b4a4db467b6a1e90131705832f1a3613a60c4259 I have made the following patches, adapted from git commits, against PHP 5.3.28 source tar and there maybe some changes in the current code I have not accounted for. I would like to see this backported to PHP 5.3 branch. And, when time comes right, a final release for PHP 5.3 (PHP 5.3.29). Thanks for all the hard work. Regards, NewEraCracker ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=67720&edit=1