Bug #80559 [Com]: xmlrpc has no PECL releases to download

Edit report at https://bugs.php.net/bug.php?id=80559&edit=1 ID: 80559 Comment by: giunta dot gaetano at gmail dot com Reported by: giunta dot gaetano at gmail dot com Summary: xmlrpc has no PECL releases to download Status: Re-Opened Type: Bug Package: XMLRPC-EPI related Operating System: ubuntu PHP Version: 7.4.13 Assigned To: cmb Block user comment: N Private report: N New Comment: @cmb thanks. As the developer behind polyfill-xmlrpc, I personally would use the ability to grab the xmlrpc-extension from PECL for just one thing: to install it on top of php 8 and run in that environment the compatibility tests for the polyfill. In the meantime I managed to automate the installation of the extension from the pecl git master branch, so not having a release is less of an inconvenience. I also added a link to polyfill-xmlrpc in a note in one page of the php manual, so there's that. Last but not least: I am not aware of any security issue with the xmlrpc extension, but oh boy, writing a testsuite to make sure it's properly emulated in all corner cases made me find out that its handling of unexpected values is buggy as hell. I am not sure that polyfill-xmlrpc will ever reach an 'acceptable' level of compatibility... :-( Previous Comments: ------------------------------------------------------------------------ [2020-12-30 00:29:24] cmb@php.net From the respective RFC[1]: | We are not doing users a favor by having an extension which relies | on an unmaintained library, which may have serious issues and | maybe even vulnerabilites, without signalling that issue. Since | the problem with xmlrpc does not appear to be its functionality or | API, but rather the lack of maintainance, a deprecation does not | seem appropriate. Moving the extension to PECL is supposed to give | users that signal, so they can reevaluate their use of the | extension. That said, I'll do a release ASAP, but I strongly suggest that everybody who is still using this extension, to look out for an alternative, perhaps <https://github.com/gggeek/polyfill-xmlrpc>. [1] <https://wiki.php.net/rfc/unbundle_xmlprc> ------------------------------------------------------------------------ [2020-12-29 19:21:55] requinix@php.net > I know that the xmlrpc extension has been removed from php 8 and is thus > probably in a strict 'maintenance only' mode, but would it make sense to try to > make it easier for end users to install the non-buggy version from PECL? @cmb? ------------------------------------------------------------------------ [2020-12-29 10:16:50] giunta dot gaetano at gmail dot com Indeed I experienced this bug on Ubuntu's native php version, which uses a shared library for libxmlrpc-epi. The problem has been reported upstream to Debian, and has been lingering in their bug tracker for a while :-( see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883747 Also, I managed to dig out the original bug report which led to this issue being fixed within php's source code: https://bugs.php.net/bug.php?id=28597 I know that the xmlrpc extension has been removed from php 8 and is thus probably in a strict 'maintenance only' mode, but would it make sense to try to make it easier for end users to install the non-buggy version from PECL? ------------------------------------------------------------------------ [2020-12-28 22:25:33] requinix@php.net *does not work (note the if c >= 10) ------------------------------------------------------------------------ [2020-12-28 22:25:03] requinix@php.net Upstream bug. Bundled libxmlrpc-epi is good http://git.php.net/?p=pecl/networking/xmlrpc.git;a=blob;f=libxmlrpc/xml_element.c;h=16787593516d492fcf720b0d3eea22934bae02f0;hb=refs/heads/master#l279 but this version on SourceForge does https://sourceforge.net/p/xmlrpc-epi/git/ci/master/tree/src/xml_element.c#l290 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=80559 -- Edit this bug report at https://bugs.php.net/bug.php?id=80559&edit=1