cvs: phpweb / ChangeLog-4.php downloads.php index.php release_4_4_1.php releases.php

derick Mon Oct 31 07:13:35 2005 EDT Added files: /phpweb release_4_4_1.php Modified files: /phpweb ChangeLog-4.php downloads.php index.php releases.php Log: - Release 4.4.1.

http://cvs.php.net/diff.php/phpweb/ChangeLog-4.php?r1=1.61&r2=1.62&ty=u Index: phpweb/ChangeLog-4.php diff -u phpweb/ChangeLog-4.php:1.61 phpweb/ChangeLog-4.php:1.62 --- phpweb/ChangeLog-4.php:1.61 Mon Jul 11 10:49:44 2005 +++ phpweb/ChangeLog-4.php Mon Oct 31 07:13:29 2005 @@ -1,5 +1,5 @@ <?php -// $Id: ChangeLog-4.php,v 1.61 2005/07/11 14:49:44 derick Exp $ +// $Id: ChangeLog-4.php,v 1.62 2005/10/31 12:13:29 derick Exp $ $_SERVER['BASE_PAGE'] = 'ChangeLog-4.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4 ChangeLog"); @@ -11,6 +11,60 @@ <hr /> +<a name="4.4.1"></a> +<h3>Version 4.4.1</h3> +<b>31-Oct-2005</b> +<ul> +<li>Added missing safe_mode checks for image* functions and cURL.</li> +<li>Added missing safe_mode/open_basedir checks for file uploads.</li> +<li>Fixed a memory corruption bug regarding included files.</li> +<li>Fixed possible INI setting leak via virtual() in Apache 2 sapi.</li> +<li>Fixed possible crash and/or memory corruption in import_request_variables().</li> +<li>Fixed potential GLOBALS overwrite via import_request_variables().</li> +<li>Fixed possible GLOBALS variable override when register_globals are ON.</li> +<li>Fixed possible register_globals toggle via parse_str().</li> +<li>Added "new_link" parameter to mssql_connect(). Bug #34369.</li> +<li><?php bugfix(34850); ?> (--program-suffix and --program-prefix not included in man page names).</li> +<li><?php bugfix(34790); ?> (preg_match_all(), named capturing groups, variable assignment/return =&gt; crash).</li> +<li><?php bugfix(34742); ?> (ftp wrapper failures caused from segmented command transfer).</li> +<li><?php bugfix(34704); ?> (Infinite recursion due to corrupt JPEG).</li> +<li><?php bugfix(34645); ?> (ctype corrupts memory when validating large numbers).</li> +<li><?php bugfix(34565); ?> (mb_send_mail does not fetch mail.force_extra_parameters).</li> +<li><?php bugfix(34557); ?> (php -m exits with "error" 1).</li> +<li><?php bugfix(34456); ?> (Possible crash inside pspell extension).</li> +<li><?php bugfix(34311); ?> (unserialize() crashes with chars above 191 dec).</li> +<li><?php bugfix(34307); ?> (on_modify handler not called to set the default value if setting from php.ini was invalid).</li> +<li><?php bugfix(34302); ?> (date('W') do not return leading zeros for week 1 to 9).</li> +<li><?php bugfix(34277); ?> (array_filter() crashes with references and objects).</li> +<li><?php bugfix(34191); ?> (ob_gzhandler does not enforce trailing \0).</li> +<li><?php bugfix(34156); ?> (memory usage remains elevated after memory limit is reached).</li> +<li><?php bugfix(34148); ?> (+,- and . not supported as parts of scheme).</li> +<li><?php bugfix(34137); ?> (assigning array element by reference causes binary mess). </li> +<li><?php bugfix(34068); ?> (Numeric string as array key not cast to integer in wddx_deserialize()).</li> +<li><?php bugfix(34064); ?> (arr[] as param to function is allowed only if function receives argument by reference).</li> +<li><?php bugfix(33989); ?> (extract($GLOBALS,EXTR_REFS) crashes PHP).</li> +<li><?php bugfix(33987); ?> (php script as ErrorDocument causes crash in Apache 2). </li> +<li><?php bugfix(33940); ?> (array_map() fails to pass by reference when called recursively).</li> +<li><?php bugfix(33690); ?> (Crash setting some ini directives in httpd.conf).</li> +<li><?php bugfix(33673); ?> (Added detection for partially uploaded files).</li> +<li><?php bugfix(33648); ?> (Using --with-regex=system causes compile failure).</li> +<li><?php bugfix(33558); ?> (Warning with nested calls to functions returning by reference).</li> +<li><?php bugfix(33383); ?> (crash when retrieving empty LOBs).</li> +<li><?php bugfix(33156); ?> (cygwin version of setitimer doesn't accept ITIMER_PROF).</li> +<li><?php bugfix(32937); ?> (open_basedir looses trailing / in the limiter).</li> +<li><?php bugfix(32589); ?> (possible crash inside imap_mail_compose() function).</li> +<li><?php bugfix(32179); ?> (xmlrpc_encode() segfaults with recursive references).</li> +<li><?php bugfix(32160); ?> (copying a file into itself leads to data loss).</li> +<li><?php bugfix(31158); ?> (array_splice on $GLOBALS crashes).</li> +<li><?php bugfix(29983); ?> (PHP does not explicitly set mime type &amp; charset).</li> +<li><?php bugfix(29253); ?> (array_diff with $GLOBALS argument fails).</li> +<li><?php bugfix(21306); ?> (ext/sesssion: catch bailouts of write handler during RSHUTDOWN).</li> +</ul> + +There is a <a href="release_4_4_1.php">separate announcement</a> available for this release.<br /> + +<hr /> + <a name="4.4.0"></a> <h3>Version 4.4.0</h3> <b>11-Jul-2005</b> http://cvs.php.net/diff.php/phpweb/downloads.php?r1=1.245&r2=1.246&ty=u Index: phpweb/downloads.php diff -u phpweb/downloads.php:1.245 phpweb/downloads.php:1.246 --- phpweb/downloads.php:1.245 Sun Oct 30 13:18:10 2005 +++ phpweb/downloads.php Mon Oct 31 07:13:30 2005 @@ -1,5 +1,5 @@ <?php -// $Id: downloads.php,v 1.245 2005/10/30 18:18:10 sniper Exp $ +// $Id: downloads.php,v 1.246 2005/10/31 12:13:30 derick Exp $ $_SERVER['BASE_PAGE'] = 'downloads.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; @@ -115,23 +115,23 @@ <a name="v4"></a> -<h1>PHP 4.4.0</h1> +<h1>PHP 4.4.1</h1> <h2>Complete Source Code</h2> <ul> <li> - <?php download_link('php-4.4.0.tar.bz2','PHP 4.4.0 (tar.bz2)'); ?> - 11 Jul 2005<br /> - <span class="md5sum">md5: e85b606fe48198bfcd785e5a5b1c9613</span> + <?php download_link('php-4.4.1.tar.bz2','PHP 4.4.1 (tar.bz2)'); ?> - 31 Oct 2005<br /> + <span class="md5sum">md5: 6b5726471189f8a1f26dd7cc5e19b442</span> </li> <li> - <?php download_link('php-4.4.0.tar.gz', 'PHP 4.4.0 (tar.gz)'); ?> - 11 Jul 2005<br /> - <span class="md5sum">md5: 4c12d241216e4ca2f2ce2cb7ee5de48b</span> + <?php download_link('php-4.4.1.tar.gz', 'PHP 4.4.1 (tar.gz)'); ?> - 31 Oct 2005<br /> + <span class="md5sum">md5: 83a9d52df96f682cbb88ce87ff10efb5</span> </li> </ul> <p> See the <a href="/ChangeLog-4.php">ChangeLog</a> for a complete list of changes, - or the <a href="/release_4_4_0.php">release notes</a> for more information on + or the <a href="/release_4_4_1.php">release notes</a> for more information on this particular release. Daily snapshots are also available from <a href="http://snaps.php.net/">snaps.php.net</a> (not intended for production use!). </p> @@ -144,19 +144,24 @@ <ul> <li> - <?php download_link('php-4.4.0-Win32.zip', 'PHP 4.4.0 zip package'); ?> - 11 Jul 2005<br /> + <?php download_link('php-4.4.1-Win32.zip', 'PHP 4.4.1 zip package'); ?> - 31 Oct 2005<br /> (CGI binary plus server API versions for Apache, Apache2 (experimental), ISAPI, NSAPI, Servlet and Pi3Web. MySQL support built-in, many extensions included, packaged as zip)<br /> - <span class="md5sum">md5: bf5dfbda3cbf90609eaac8865145e052</span> + <span class="md5sum">md5: cd0bc0289c50ec4b7716143978a535df</span> </li> +<!-- <li> - <?php download_link('php-4.4.0-installer.exe', 'PHP 4.4.0 installer'); ?> - 11 Jul 2005<br /> + The Windows installer will follow shortly + </li> +--> + <li> + <?php download_link('php-4.4.1-installer.exe', 'PHP 4.4.1 installer'); ?> - 31 Oct 2005<br /> (CGI only, MySQL support built-in, packaged as Windows installer to install and configure PHP, and automatically configure IIS, PWS and Xitami, with manual configuration for other servers. N.B. no external extensions included)<br /> - <span class="md5sum">md5: 9f8c733be89ea32025ecc64f7aeae60b</span> + <span class="md5sum">md5: b6102c68d0b76ee8de780ef7e0023e10</span> </li> </ul> http://cvs.php.net/diff.php/phpweb/index.php?r1=1.734&r2=1.735&ty=u Index: phpweb/index.php diff -u phpweb/index.php:1.734 phpweb/index.php:1.735 --- phpweb/index.php:1.734 Sun Oct 30 13:15:24 2005 +++ phpweb/index.php Mon Oct 31 07:13:31 2005 @@ -147,9 +147,24 @@ // DO NOT REMOVE THIS COMMENT (the RSS parser is dependant on it) ?> +<h1>PHP 4.4.1 Released</h1> +<p> + <span class="newsdate">[31-Oct-2005]</span> + PHP 4.4.1 is now <a href="/downloads.php#v4">available for download</a>. + This version is a maintenance release, that contains numerous bug fixes, + including a number of security fixes related to the overwriting of the GLOBALS + array. All users of PHP 4.3 and 4.4 are encouraged to upgrade to this version. +</p> +<p> + The full list of changes in PHP 4.4.1 is available in the + <a href="/ChangeLog-4.php#4.1.1">PHP 4 ChangeLog</a>. +</p> + +<hr /> + <?php news_image("http://conf.phpquebec.com/en/conf2006/appel", "conference_php_quebec.gif", "PHP Québec"); ?> -<h1>PHP Québec 2006 : call for speakers</h1> +<h1>PHP Québec 2006: call for speakers</h1> <p> <span class="newsdate">[18-Oct-2005]</span> <a href="http://conf.phpquebec.com/en/conf2006/">PHP Québec</a> is pleased to http://cvs.php.net/diff.php/phpweb/releases.php?r1=1.27&r2=1.28&ty=u Index: phpweb/releases.php diff -u phpweb/releases.php:1.27 phpweb/releases.php:1.28 --- phpweb/releases.php:1.27 Mon Sep 19 02:55:37 2005 +++ phpweb/releases.php Mon Oct 31 07:13:32 2005 @@ -1,5 +1,5 @@ <?php -// $Id: releases.php,v 1.27 2005/09/19 06:55:37 sniper Exp $ +// $Id: releases.php,v 1.28 2005/10/31 12:13:32 derick Exp $ $_SERVER['BASE_PAGE'] = 'releases.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; @@ -73,6 +73,8 @@ <option value="php-4.3.8.tar.gz">4.3.8</option> <option value="php-4.3.9.tar.gz">4.3.9</option> <option value="php-4.3.10.tar.gz">4.3.10</option> + <option value="php-4.3.11.tar.gz">4.3.11</option> + <option value="php-4.4.0.tar.gz">4.4.0</option> <option value="">--------</option> <option value="php-5.0.0.tar.gz">5.0.0</option> <option value="php-5.0.1.tar.gz">5.0.1</option> @@ -234,6 +236,36 @@ <hr /> <a name="v4"></a> +<a name="4.4.0"></a> +<h2>4.4.0</h2> + +<ul> + <li>Released: 11 Jul 2005</li> + <li>Announcement: <a href="/release_4_4_0.php">English</a></li> + <li><a href="/ChangeLog-4.php#4.4.0">ChangeLog</a></li> + <li> + Download: + <ul> + <li> + <?php download_link('php-4.4.0.tar.bz2','PHP 4.4.0 (tar.bz2)'); ?> - 11 Jul 2005<br /> + <span class="md5sum">md5: e85b606fe48198bfcd785e5a5b1c9613</span> + </li> + <li> + <?php download_link('php-4.4.0.tar.gz', 'PHP 4.4.0 (tar.gz)'); ?> - 11 Jul 2005<br /> + <span class="md5sum">md5: 4c12d241216e4ca2f2ce2cb7ee5de48b</span> + </li> + <li> + <?php download_link('php-4.4.0-Win32.zip','Windows binary'); ?><br /> + <span class="md5sum">md5: bf5dfbda3cbf90609eaac8865145e052</span> + </li> + <li> + <?php download_link('php-4.4.0-installer.exe','Windows installer'); ?><br /> + <span class="md5sum">md5: 9f8c733be89ea32025ecc64f7aeae60b</span> + </li> + </ul> + </li> +</ul> + <a name="4.3.11"></a> <h2>4.3.11</h2> http://cvs.php.net/co.php/phpweb/release_4_4_1.php?r=1.1&p=1 Index: phpweb/release_4_4_1.php +++ phpweb/release_4_4_1.php <?php // $Id: release_4_4_1.php,v 1.1 2005/10/31 12:13:32 derick Exp $ $_SERVER['BASE_PAGE'] = 'release_4_4_1.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.4.1 Release Announcement"); ?> <h1>PHP 4.4.1. Release Announcement</h1> <p> The PHP Development Team would like to announce the immediate release of <a href="/downloads.php">PHP 4.4.1</a>. </p> <p> This is a bug fix release, which addresses some security problems too. The security issues that this release fixes are: <ul> <li>Fixed a Cross Site Scripting (<a href='http://www.cgisecurity.com/articles/xss-faq.shtml'>XSS</a>) vulnerability in <a href='http://php.net/phpinfo'>phpinfo</a>() that could lead f.e. to cookie exposure, when a phpinfo() script is accidently left on a production server.</li> <li>Fixed multiple safe_mode/open_basedir bypass vulnerabilities in ext/curl and ext/gd that could lead to exposure of files normally not accessible due to safe_mode or open_basedir restrictions.</li> <li>Fixed a possible $GLOBALS overwrite problem in file upload handling, extract() and import_request_variables() that could lead to unexpected security holes in scripts assumed secure. (For more information, see <a href='http://www.hardened-php.net/globals-problem'>here</a>).</li> <li>Fixed a problem when a request was terminated due to memory_limit constraints during certain <a href='http://php.net/parse_str'>parse_str</a>() calls. In some cases this can result in register_globals being turned on.</li> <li>Fixed an issue with trailing slashes in allowed basedirs. They were ignored by open_basedir checks, so that specified basedirs were handled as prefixes and not as full directory names.</li> <li>Fixed an issue with calling <a href='http://php.net/virtual'>virtual</a>() on Apache 2. This allowed bypassing of certain configuration directives like safe_mode or open_basedir.</li> <li>Updated to the latest pcrelib to fix a possible integer overflow vulnerability announced in <a href='http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491'>CAN-2005-2491</a>.</li> </ul> </p> <p> Besides those security issues, this release also fixes 35 other defects. </p> <p> For a full list of changes in PHP 4.4.1, see the <a href="/ChangeLog-4.php#4.4.1">ChangeLog</a>. </p> <?php site_footer(); ?>