Re: multiline HTTP headers support in header()
| From: | Solar Designer | Date: | Thu, 03 Jul 2014 06:13:01 +0000 |
| Subject: | Re: multiline HTTP headers support in header() | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-75193@lists.php.net to get a copy of this message | ||
On Thu, Jul 03, 2014 at 07:42:14AM +0200, Ferenc Kovacs wrote:
> and for the record, my irc history tells me that Nikita sent an email about
>
> http://lab.onsec.ru/2012/08/php-multiple-headers-bypass-available.html
> to
> security@php.net back in 2012-08-24, so maybe there were some discussion
> there which I'm missing.
I wasn't party to that discussion, but I think the issue was dismissed
as an IE bug at the time. While there's an IE bug involved, I think it
was wrong to dismiss the issue. Relevant tweets from 2012:
https://twitter.com/d0znpp/status/238778122160443392
Alexander