cvs: phpweb / error.php release_4_1_0.php release_4_1_0_fr.php release_4_1_1.php release_4_1_2_win32.php release_4_2_0.php release_4_2_0_fr.php
release_4_2_1.php release_4_2_1_fr.php release_4_2_2.php release_4_2_2_fr.php release_4_3_0.php release_4_3_0_fr.php release_4_3_1.php
release_4_3_10.php release_4_3_10_fr.php release_4_3_11.php release_4_3_11_fr.php release_4_3_2.php release_4_3_2_fr.php release_4_3_3.php
release_4_3_3_fr.php release_4_3_4.php release_4_3_4_fr.php release_4_3_5.php release_4_3_5_fr.php release_4_3_6.php release_4_3_6_fr.php
release_4_3_7.php release_4_3_7_fr.php release_4_3_8.php release_4_3_9.php release_4_3_9_fr.php release_4_4_0.php release_4_4_1.php release_4_4_2.php
release_4_4_3.php release_4_4_4.php release_5_1_0.php release_5_1_1.php release_5_1_2.php release_5_1_3.php release_5_1_4.php release_5_1_5.php
release_5_1_6.php /releases 4_1_0.php 4_1_0_fr.php 4_1_1.php 4_1_2_win32.php 4_2_0.php 4_2_0_fr.php 4_2_1.php 4_2_1_fr.php 4_2_2.! php 4_2_2_fr.php
4_3_0.php 4_3_0_fr.php 4_3_1.php 4_3_10.php 4_3_10_fr.php 4_3_11.php 4_3_11_fr.php 4_3_2.php 4_3_2_fr.php 4_3_3.php 4_3_3_fr.php 4_3_4.php
4_3_4_fr.php 4_3_5.php 4_3_5_fr.php 4_3_6.php 4_3_6_fr.php 4_3_7.php 4_3_7_fr.php 4_3_8.php 4_3_9.php 4_3_9_fr.php 4_4_0.php 4_4_1.php 4_4_2.php
4_4_3.php 4_4_4.php 5_1_0.php 5_1_1.php 5_1_2.php 5_1_3.php 5_1_4.php 5_1_5.php 5_1_6.php index.php

goba Wed Sep 20 18:43:55 2006 UTC Added files: /phpweb/releases 4_1_0.php 4_1_0_fr.php 4_1_1.php 4_1_2_win32.php 4_2_0.php 4_2_0_fr.php 4_2_1.php 4_2_1_fr.php 4_2_2.php 4_2_2_fr.php 4_3_0.php 4_3_0_fr.php 4_3_1.php 4_3_10.php 4_3_10_fr.php 4_3_11.php 4_3_11_fr.php 4_3_2.php 4_3_2_fr.php 4_3_3.php 4_3_3_fr.php 4_3_4.php 4_3_4_fr.php 4_3_5.php 4_3_5_fr.php 4_3_6.php 4_3_6_fr.php 4_3_7.php 4_3_7_fr.php 4_3_8.php 4_3_9.php 4_3_9_fr.php 4_4_0.php 4_4_1.php 4_4_2.php 4_4_3.php 4_4_4.php 5_1_0.php 5_1_1.php 5_1_2.php 5_1_3.php 5_1_4.php 5_1_5.php 5_1_6.php Removed files: /phpweb release_4_1_0.php release_4_1_0_fr.php release_4_1_1.php release_4_1_2_win32.php release_4_2_0.php release_4_2_0_fr.php release_4_2_1.php release_4_2_1_fr.php release_4_2_2.php release_4_2_2_fr.php release_4_3_0.php release_4_3_0_fr.php release_4_3_1.php release_4_3_10.php release_4_3_10_fr.php release_4_3_11.php release_4_3_11_fr.php release_4_3_2.php release_4_3_2_fr.php release_4_3_3.php release_4_3_3_fr.php release_4_3_4.php release_4_3_4_fr.php release_4_3_5.php release_4_3_5_fr.php release_4_3_6.php release_4_3_6_fr.php release_4_3_7.php release_4_3_7_fr.php release_4_3_8.php release_4_3_9.php release_4_3_9_fr.php release_4_4_0.php release_4_4_1.php release_4_4_2.php release_4_4_3.php release_4_4_4.php release_5_1_0.php release_5_1_1.php release_5_1_2.php release_5_1_3.php release_5_1_4.php release_5_1_5.php release_5_1_6.php Modified files: /phpweb error.php /phpweb/releases index.php Log: utilize the releases folder instead of pseudofoldering with prefixing file names

http://cvs.php.net/viewvc.cgi/phpweb/error.php?r1=1.55&r2=1.56&diff_format=u Index: phpweb/error.php diff -u phpweb/error.php:1.55 phpweb/error.php:1.56 --- phpweb/error.php:1.55 Wed Sep 20 09:51:11 2006 +++ phpweb/error.php Wed Sep 20 18:43:54 2006 @@ -1,6 +1,6 @@ <?php -// $Id: error.php,v 1.55 2006/09/20 09:51:11 goba Exp $ +// $Id: error.php,v 1.56 2006/09/20 18:43:54 goba Exp $ /* @@ -65,12 +65,18 @@ } // ============================================================================ -// BC: News archive moved to folder +// BC: News archive moved to subfolder if (preg_match("!^news-(\\d+)(\\.|$)!", $URI, $array)) { mirror_redirect("/archive/$array[1].php"); } // ============================================================================ +// BC: Release files moved to subfolder +if (preg_match("!^release_([^\\.]+)(\\.php$|$)!", $URI, $array)) { + mirror_redirect("/releases/$array[1].php"); +} + +// ============================================================================ // BC: handle documentation howto moved to the doc.php.net server // (redirect to index page) if (preg_match("!^manual/howto/!", $URI, $array)) { http://cvs.php.net/viewvc.cgi/phpweb/releases/index.php?r1=1.1&r2=1.2&diff_format=u Index: phpweb/releases/index.php diff -u phpweb/releases/index.php:1.1 phpweb/releases/index.php:1.2 --- phpweb/releases/index.php:1.1 Wed Sep 20 09:51:11 2006 +++ phpweb/releases/index.php Wed Sep 20 18:43:55 2006 @@ -1,5 +1,5 @@ <?php -// $Id: index.php,v 1.1 2006/09/20 09:51:11 goba Exp $ +// $Id: index.php,v 1.2 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/index.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; @@ -115,7 +115,7 @@ <ul> <li>Released: 17 Aug 2006</li> - <li>Announcement: <a href="/release_5_1_5.php">English</a></li> + <li>Announcement: <a href="/releases/5_1_5.php">English</a></li> <li><a href="/ChangeLog-5.php#5.1.5">ChangeLog</a></li> <li> Download: @@ -151,7 +151,7 @@ <ul> <li>Released: 04 May 2006</li> - <li>Announcement: <a href="/release_5_1_4.php">English</a></li> + <li>Announcement: <a href="/releases/5_1_4.php">English</a></li> <li><a href="/ChangeLog-5.php#5.1.4">ChangeLog</a></li> <li> Download: @@ -186,7 +186,7 @@ <ul> <li>Released: 12 Jan 2006</li> - <li>Announcement: <a href="/release_5_1_3.php">English</a></li> + <li>Announcement: <a href="/releases/5_1_3.php">English</a></li> <li><a href="/ChangeLog-5.php#5.1.3">ChangeLog</a></li> <li> Download: @@ -204,7 +204,7 @@ <ul> <li>Released: 12 Jan 2006</li> - <li>Announcement: <a href="/release_5_1_2.php">English</a></li> + <li>Announcement: <a href="/releases/5_1_2.php">English</a></li> <li><a href="/ChangeLog-5.php#5.1.2">ChangeLog</a></li> <li> Download: @@ -221,7 +221,7 @@ <ul> <li>Released: 28 Nov 2005</li> - <li>Announcement: <a href="/release_5_1_1.php">English</a></li> + <li>Announcement: <a href="/releases/5_1_1.php">English</a></li> <li><a href="/ChangeLog-5.php#5.1.1">ChangeLog</a></li> <li> Download: @@ -237,7 +237,7 @@ <ul> <li>Released: 24 Nov 2005</li> - <li>Announcement: <a href="/release_5_1_0.php">English</a></li> + <li>Announcement: <a href="/releases/5_1_0.php">English</a></li> <li><a href="/ChangeLog-5.php#5.1.0">ChangeLog</a></li> <li> Download: @@ -350,7 +350,7 @@ <ul> <li>Released: 03 Aug 2006</li> - <li>Announcement: <a href="/release_4.4.3.php">English</a></li> + <li>Announcement: <a href="/releases/4.4.3.php">English</a></li> <li><a href="/ChangeLog-4.php#4.4.3">ChangeLog</a></li> <li> Download: @@ -380,7 +380,7 @@ <ul> <li>Released: 13 Jan 2006</li> - <li>Announcement: <a href="/release_4_4_2.php">English</a></li> + <li>Announcement: <a href="/releases/4_4_2.php">English</a></li> <li><a href="/ChangeLog-4.php#4.4.2">ChangeLog</a></li> <li> Download: @@ -396,7 +396,7 @@ <ul> <li>Released: 31 Oct 2005</li> - <li>Announcement: <a href="/release_4_4_1.php">English</a></li> + <li>Announcement: <a href="/releases/4_4_1.php">English</a></li> <li><a href="/ChangeLog-4.php#4.4.1">ChangeLog</a></li> <li> Download: @@ -412,7 +412,7 @@ <ul> <li>Released: 11 Jul 2005</li> - <li>Announcement: <a href="/release_4_4_0.php">English</a></li> + <li>Announcement: <a href="/releases/4_4_0.php">English</a></li> <li><a href="/ChangeLog-4.php#4.4.0">ChangeLog</a></li> <li> Download: @@ -428,7 +428,7 @@ <ul> <li>Released: 31 Mar 2005</li> - <li>Announcement: <a href="/release_4_3_11.php">English</a></li> + <li>Announcement: <a href="/releases/4_3_11.php">English</a></li> <li><a href="/ChangeLog-4.php#4.3.11">ChangeLog</a></li> <li> Download: @@ -444,7 +444,7 @@ <ul> <li>Released: 15 Dec 2004</li> - <li>Announcement: <a href="/release_4_3_10.php">English</a></li> + <li>Announcement: <a href="/releases/4_3_10.php">English</a></li> <li><a href="/ChangeLog-4.php#4.3.10">ChangeLog</a></li> <li> Download: @@ -460,7 +460,7 @@ <ul> <li>Released: 22 Sep 2004</li> - <li>Announcement: <a href="/release_4_3_9.php">English</a></li> + <li>Announcement: <a href="/releases/4_3_9.php">English</a></li> <li><a href="/ChangeLog-4.php#4.3.9">ChangeLog</a></li> <li> Download: @@ -477,7 +477,7 @@ <ul> <li>Released: 13 July 2004</li> - <li>Announcement: <a href="/release_4_3_8.php">English</a></li> + <li>Announcement: <a href="/releases/4_3_8.php">English</a></li> <li><a href="/ChangeLog-4.php#4.3.8">ChangeLog</a></li> <li> Download: @@ -493,7 +493,7 @@ <ul> <li>Released: 03 June 2004</li> - <li>Announcement: <a href="/release_4_3_7.php">English</a></li> + <li>Announcement: <a href="/releases/4_3_7.php">English</a></li> <li><a href="/ChangeLog-4.php#4.3.7">ChangeLog</a></li> <li> Download: @@ -508,7 +508,7 @@ <ul> <li>Released: 15 April 2004</li> - <li>Announcement: <a href="/release_4_3_6.php">English</a>, <a href="/release_4_3_6_fr.php">French</a></li> + <li>Announcement: <a href="/releases/4_3_6.php">English</a>, <a href="/releases/4_3_6_fr.php">French</a></li> <li><a href="/ChangeLog-4.php#4.3.6">ChangeLog</a></li> <li> Download: @@ -523,7 +523,7 @@ <ul> <li>Released: 26 March 2004</li> - <li>Announcement: <a href="/release_4_3_5.php">English</a>, <a href="/release_4_3_5_fr.php">French</a></li> + <li>Announcement: <a href="/releases/4_3_5.php">English</a>, <a href="/releases/4_3_5_fr.php">French</a></li> <li><a href="/ChangeLog-4.php#4.3.5">ChangeLog</a></li> <li> Download: @@ -539,7 +539,7 @@ <ul> <li>Released: 03 November 2003</li> - <li>Announcement: <a href="/release_4_3_4.php">English</a>, <a href="/release_4_3_4_fr.php">French</a></li> + <li>Announcement: <a href="/releases/4_3_4.php">English</a>, <a href="/releases/4_3_4_fr.php">French</a></li> <li><a href="/ChangeLog-4.php#4.3.4">ChangeLog</a></li> <li> Download: @@ -554,7 +554,7 @@ <ul> <li>Released: 25 August 2003</li> - <li>Announcement: <a href="/release_4_3_3.php">English</a>, <a href="/release_4_3_3_fr.php">French</a></li> + <li>Announcement: <a href="/releases/4_3_3.php">English</a>, <a href="/releases/4_3_3_fr.php">French</a></li> <li><a href="/ChangeLog-4.php#4.3.3">ChangeLog</a></li> <li> Download: @@ -569,7 +569,7 @@ <ul> <li>Released: 29 May 2003</li> - <li>Announcement: <a href="/release_4_3_2.php">English</a>, <a href="/release_4_3_2_fr.php">French</a></li> + <li>Announcement: <a href="/releases/4_3_2.php">English</a>, <a href="/releases/4_3_2_fr.php">French</a></li> <li><a href="/ChangeLog-4.php#4.3.2">ChangeLog</a></li> <li> Download: @@ -585,7 +585,7 @@ <ul> <li>Released: 17 February 2003</li> - <li>Announcement: <a href="/release_4_3_1.php">English</a></li> + <li>Announcement: <a href="/releases/4_3_1.php">English</a></li> <li><a href="/ChangeLog-4.php#4.3.1">ChangeLog</a></li> <li> Download: @@ -600,7 +600,7 @@ <ul> <li>Released: 27 December 2002</li> - <li>Announcement: <a href="/release_4_3_0.php">English</a>, <a href="/release_4_3_0_fr.php">French</a></li> + <li>Announcement: <a href="/releases/4_3_0.php">English</a>, <a href="/releases/4_3_0_fr.php">French</a></li> <li><a href="/ChangeLog-4.php#4.3.0">ChangeLog</a></li> <li> Download: @@ -630,7 +630,7 @@ <ul> <li>Released: 22 July 2002</li> - <li>Announcement: <a href="/release_4_2_2.php">English</a>, <a href="/release_4_2_2_fr.php">French</a></li> + <li>Announcement: <a href="/releases/4_2_2.php">English</a>, <a href="/releases/4_2_2_fr.php">French</a></li> <li><a href="/ChangeLog-4.php#4.2.2">ChangeLog</a></li> <li> Download: @@ -645,7 +645,7 @@ <ul> <li>Released: 13 May 2002</li> - <li>Announcement: <a href="/release_4_2_1.php">English</a>, <a href="/release_4_2_1_fr.php">French</a></li> + <li>Announcement: <a href="/releases/4_2_1.php">English</a>, <a href="/releases/4_2_1_fr.php">French</a></li> <li><a href="/ChangeLog-4.php#4.2.1">ChangeLog</a></li> <li> Download: @@ -660,7 +660,7 @@ <ul> <li>Released: 22 April 2002</li> - <li>Announcement: <a href="/release_4_2_0.php">English</a>, <a href="/release_4_2_0_fr.php">French</a></li> + <li>Announcement: <a href="/releases/4_2_0.php">English</a>, <a href="/releases/4_2_0_fr.php">French</a></li> <li><a href="/ChangeLog-4.php#4.2.0">ChangeLog</a></li> <li> Download: @@ -675,7 +675,7 @@ <ul> <li>Released: 12 March 2002</li> - <li>Announcement: <a href="/release_4_1_2_win32.php">English</a></li> + <li>Announcement: <a href="/releases/4_1_2_win32.php">English</a></li> <li><a href="/ChangeLog-4.php#4.1.2">ChangeLog</a></li> <li> Download: @@ -690,7 +690,7 @@ <ul> <li>Released: 26 Dec 2001</li> - <li>Announcement: <a href="/release_4_1_1.php">English</a></li> + <li>Announcement: <a href="/releases/4_1_1.php">English</a></li> <li><a href="/ChangeLog-4.php#4.1.1">ChangeLog</a></li> <li> Download: @@ -705,7 +705,7 @@ <ul> <li>Released: 10 Dec 2001</li> - <li>Announcement: <a href="/release_4_1_0.php">English</a>, <a href="/release_4_1_0_fr.php">French</a></li> + <li>Announcement: <a href="/releases/4_1_0.php">English</a>, <a href="/releases/4_1_0_fr.php">French</a></li> <li><a href="/ChangeLog-4.php#4.1.0">ChangeLog</a></li> <li> Download: http://cvs.php.net/viewvc.cgi/phpweb/releases/4_1_0.php?view=markup&rev=1.1 Index: phpweb/releases/4_1_0.php +++ phpweb/releases/4_1_0.php <?php // $Id: 4_1_0.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_1_0.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.1.0 Release Announcement"); ?> <h1>PHP 4.1.0 Release Announcement</h1> <p> After a lengthy QA process, PHP 4.1.0 is <a href="/downloads.php">finally out</a>!<br /> [ <a href="/releases/4_1_0_fr.php">Version Fran&ccedil;aise</a> ] </p> <p> PHP 4.1.0 includes several other key improvements:</p> <ul> <li>A new input interface for improved security (read below)</li> <li>Highly improved performance in general</li> <li> Revolutionary performance and stability improvements under Windows. The multithreaded server modules under Windows (ISAPI, Apache, etc.) perform as much as 30 times faster under load! We want to thank Brett Brewer and his team in Microsoft for working with us to improve PHP for Windows. </li> <li> Versioning support for extensions. Right now it's barely being used, but the infrastructure was put in place to support separate version numbers for different extensions. The negative side effect is that loading extensions that were built against old versions of PHP will now result in a crash, instead of in a nice clear message. Make sure you only use extensions built with PHP 4.1.0. </li> <li>Turn-key output compression support</li> <li><strong>LOTS</strong> of fixes and new functions</li> </ul> <p> As some of you may notice, this version is quite historic, as it's the first time in history we actually incremented the middle digit! :) The two key reasons for this unprecedented change were the new input interface, and the broken binary compatibility of modules due to the versioning support. </p> <p> Following is a description of the new input mechanism. For a full list of changes in PHP 4.1.0, see the <a href="ChangeLog-4.php#4.1.0">ChangeLog</a>. </p> <hr /> <h2>SECURITY: NEW INPUT MECHANISM</h2> <p> First and foremost, it's important to stress that regardless of anything you may read in the following lines, PHP 4.1.0 <strong>still supports</strong> the old input mechanisms from older versions. Old applications should go on working fine without modification! </p> <p>Now that we have that behind us, let's move on :)</p> <p> For various reasons, PHP setups which rely on register_globals being on (i.e., on form, server and environment variables becoming a part of the global namespace, automatically) are very often exploitable to various degrees. For example, the piece of code: </p> <?php highlight_php('<?php if (authenticate_user()) { $authenticated = true; }.... ?>');?> <p> May be exploitable, as remote users can simply pass on 'authenticated' as a form variable, and then even if authenticate_user() returns false, $authenticated will actually be set to true. While this looks like a simple example, in reality, quite a few PHP applications ended up being exploitable by things related to this misfeature. </p> <p> While it is quite possible to write secure code in PHP, we felt that the fact that PHP makes it too easy to write insecure code was bad, and we've decided to attempt a far-reaching change, and deprecate register_globals. Obviously, because the vast majority of the PHP code in the world relies on the existence of this feature, we have no plans to actually remove it from PHP anytime in the foreseeable future, but we've decided to encourage people to shut it off whenever possible. </p> <p> To help users build PHP applications with register_globals being off, we've added several new special variables that can be used instead of the old global variables. There are 7 new special arrays: </p> <ul> <li>$_GET - contains form variables sent through GET</li> <li>$_POST - contains form variables sent through POST</li> <li>$_COOKIE - contains HTTP cookie variables</li> <li>$_SERVER - contains server variables (e.g., REMOTE_ADDR)</li> <li>$_ENV - contains the environment variables</li> <li> $_REQUEST - a merge of the GET variables, POST variables and Cookie variables. In other words - all the information that is coming from the user, and that from a security point of view, cannot be trusted. </li> <li>$_SESSION - contains HTTP variables registered by the session module</li> </ul> <p> Now, other than the fact that these variables contain this special information, they're also special in another way - they're automatically global in any scope. This means that you can access them anywhere, without having to 'global' them first. For example: </p> <?php highlight_php('<?php function example1() { print $_GET["name"]; // works, \'global $_GET;\' is not necessary! } ?>');?> <p> would work fine! We hope that this fact would ease the pain in migrating old code to new code a bit, and we're confident it's going to make writing new code easier. Another neat trick is that creating new entries in the $_SESSION array will automatically register them as session variables, as if you called session_register(). This trick is limited to the session module only - for example, setting new entries in $_ENV will <strong>not</strong> perform an implicit putenv(). </p> <p> PHP 4.1.0 still defaults to have register_globals set to on. It's a transitional version, and we encourage application authors, especially public ones which are used by a wide audience, to change their applications to work in an environment where register_globals is set to off. Of course, they should take advantage of the new features supplied in PHP 4.1.0 that make this transition much easier. </p> <p> As of the next semi-major version of PHP, new installations of PHP will default to having register_globals set to off. No worries! Existing installations, which already have a php.ini file that has register_globals set to on, will not be affected. Only when you install PHP on a brand new machine (typically, if you're a brand new user), will this affect you, and then too - you can turn it on if you choose to. </p> <p> Note: Some of these arrays had old names, e.g. $HTTP_GET_VARS. These names still work, but we encourage users to switch to the new shorter, and auto-global versions. </p> <p> Thanks go to Shaun Clowes (shaun at securereality dot com dot au) for pointing out this problem and for analyzing it. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_1_0_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_1_0_fr.php +++ phpweb/releases/4_1_0_fr.php <?php // $Id: 4_1_0_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_1_0_fr.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("Annonce de publication de PHP 4.1.0", array("lang" => "fr")); ?> <h1>Annonce de publication de PHP 4.1.0</h1> <p> Apr&egrave;s un long processus "QA", PHP 4.1.0 <a href="/downloads.php">est enfin sorti</a>!<br /> [ <a href="/releases/4_1_0.php">English Version</a> ] </p> <p> PHP 4.1.0 inclut beaucoup d'am&eacute;liorations importantes: </p> <ul> <li>Une nouvelle interface d'entr&eacute;e en g&eacute;n&eacute;ral (voir plus bas)</li> <li>Perfomance grandement accrue en g&eacute;n&eacute;ral</li> <li> Sous Windows une stabilit&eacute; et une performance r&eacute;volutionnaire. Les modules serveur multi-thread sous windows (ISAPI, Apache, etc...) s'ex&eacute;cute jusqu'&agrave; 30 fois plus rapidement sous la charge! Nous voulons remercier Brett Brewer et son &eacute;quipe chez Microsoft pour son travail avec nous pour am&eacute;liorer PHP pour Windows. </li> <li> Gestion des versions pour les extensions. A l'heure actuelle, ceci est tr&egrave;s peu utilis&eacute;, l'infrastructure &eacute;tait mise en place pour le support s&eacute;par&eacute; des num&eacute;ros de versions pour diff&eacute;rentes extensions. L'effet de bord n&eacute;gatif est que le faite de charger des extensions avec une ancienne version de PHP r&eacute;sultait d'un crash, &agrave; la place d'un message correct et claire. Soyez s&ucirc;rs que vous utilisez seulement des extensions int&eacute;gr&eacute;es &agrave; PHP 4.1.0. </li> <li>Support "Turn-Key" de la compression des sorties</li> <li><strong>BEAUCOUP</strong> de corrections et de nouvelles fonctions</li> </ul> <p> Comme certains l'ont not&eacute;, cette version est quelque peu historique, comme c'est la premi&egrave;re fois dans l'histoire que nous incr&eacute;mentons le num&eacute;ro du milieu ! Les deux principales raisons &agrave; cela sont d'un c&ocirc;t&eacute; les changements sans pr&eacute;c&eacute;dent de la nouvelle interface d'entr&eacute;e, et de l'autre l'incompatibilit&eacute; des modules dus au support des versions. </p> <p> Ce qui suit concerne une description du nouveau m&eacute;canisme d'entr&eacute;e. Pour une liste compl&egrave;te des changements voir le <a href="ChangeLog-4.php#4.1.0">ChangeLog</a>. </p> <hr /> <h2>SECURITE: NOUVEAU MECANISME D'ENTREE</h2> <p> Avant tout, il est important de signaler que, sans tenir compte de ce que vous pourriez lire dans les lignes qui suivent, PHP 4.1.0 <strong>g&egrave;re encore</strong> les anciens m&eacute;canismes d'entr&eacute;e des anciennes versions. D'anciennes applications devraient bien fonctionner sans modifications ! </p> <p>Passsons &agrave; la suite mainenant que cela est dit :)</p> <p> Pour diff&eacute;rentes raisons, PHP qui se repose sur register_globals ON (ex. sur les formulaires, les variables serveur et d'environnement deviennent partie de la port&eacute;e globale d'un script [namespace], et ce automatiquement) sont tr&egrave;s souvent exploitable &agrave; des degr&eacute;s divers. Par exemple le code suivant: </p> <?php highlight_php('<?php if (authenticate_user()) { $authenticated = true; }.... ?>');?> <p> Peut &ecirc;tre exploitable de la mani&egrave;re suivante, des utilisateurs distants peuvent simplement passer 'authenticated' comme variable d'un formulaire et m&ecirc;me si authenticate_user() retourne false, $authentiticated va actuellement contenir true. Ce"la semble etre un exemple tr&egrave;s simple, mais en r&eacute;alit&eacute;, bien des applications PHP sont exploitable par ce dysfonctionnement. </p> <p> Tandis qu'il est parfaitement possible d'&eacute;crire du code PHP s&eacute;curis&eacute;, nous sentions que le fait que PHP permette, de mani&egrave;re beaucoup trop facile, d'&eacute;crire du code PHP non s&eacute;curis&eacute; n'&eacute;tait pas acceptable, et nous avons d&eacute;cid&eacute; de tenter un changement tr&egrave;s grand et de rendre caduque register_globals. Evidemment, &agrave; cause de la grande majorit&eacute; de code PHP dans le monde se reposant sur l'existence de cette fonctionnalit&eacute;, nous ne la supprimerons jamais, mais nous avons d&eacute;cid&eacute;s d'encourager les utilisateurs de ne plus l'utiliser &agrave; chaque fois que cela est possible. </p> <p> Afin d'aider les utilisateurs &agrave; construire des applications PHP avec register_globals &agrave; Off, nous avons ajout&eacute; quelques nouvelles variables sp&eacute;ciales, variables qui peuvent &ecirc;tre utilis&eacute;es &agrave; la place des anciennes variables globales. Il y a 7 nouveaux tableaux sp&eacute;ciaux: </p> <ul> <li>$_GET - contient les variables pass&eacute;es par la m&eacute;thode GET</li> <li>$_POST - contient les variables pass&eacute;es par la m&eacute;thode POST</li> <li>$_COOKIE - contient les variables HTTP cookie</li> <li>$_SERVER - contient les variables serveur (par ex. REMOTE_ADDR)</li> <li>$_ENV - contient les variables d'environnement</li> <li> $_REQUEST - Une fusion des variables GET. POST, COOKIE. En d'autres termes toutes les informations qui arrivent de l'utilisateur, et qui d'un point de vue purement s&eacute;curitaire, ne sont pas s&ucirc;res </li> <li> $_SESSION - contient toutes les variables HTTP enregistr&eacute;es par le module des sessions </li> </ul> <p> Maintenant, entre autre le fait que ces variables contiennent ces informations sp&eacute;ciales, elles sont aussi automatiquement globales dans toutes les port&eacute;es. Cela signifie que vous pouvez y acc&eacute;der de n'importe o&ugrave;, sans avoir &agrave; les d&eacute;clarer en globales. Par exemple: </p> <?php highlight_php('<?php function example1() { print $_GET["name"]; // fonctionne, pas besoin de \'global $_GET;\' ! } ?>');?> <p> va fonctionner tr&egrave;s bien! Nous esp&eacute;rons que cela va faciliter la t&acirc;che durant la migration de vieux code vers le nouveau, et nous sommes s&ucirc;rs que cela vous simplifiera l'&eacute;criture de nouveaux codes. Une autre astuce est que le fait de cr&eacute;er de nouvelles entr&eacute;es dans $_SESSION va automatiquement les enregistrer comme variables de session, comme si vous auriez appel&eacute; session_register(). Cette astuce est limit&eacute;e uniquement au module de gestion de session - par exemple, cr&eacute;er de nouvelles entr&eacute;s dans $_ENV ne va <strong>pas</strong> ex&eacute;cuter un put_env() implicite. </p> <p> PHP 4.1.0 doit toujours avoir register_globals mis a On par d&eacute;faut. C'est une version de transition, et nous encourageons les auteurs d'applications, sp&eacute;cialement les applications publiques qui sont utilis&eacute;es par une large audience, de changer leurs applications pour fonctionner avec un environnement o&ugrave; register_globals est &agrave; Off. Il est clair qu'ils devraient profiter des nouvelles fonctionnalit&eacute;s fournies avec PHP 4.1.0 qui font que cette transition est plus ais&eacute;e. </p> <p> Dans la prochaine version "semi majeure" de PHP, de nouvelles installations de PHP devrait avoir register_globals mis &agrave; Off par d&eacute;faut. Ne vous en faites pas! Les installations existantes, qui ont d&eacute;j&agrave; un fichier php.ini qui a register_globals &agrave; On, ne vont pas &ecirc;tre affect&eacute;es. Cela vous affectera seulement si vous installez PHP sur une nouvelle machine (typiquement si vous &ecirc;tes un nouvel utilisateur), et si vous le d&eacute;sirez vous pourrez toujours le mettre &agrave; On. </p> <p> Note: Certains de ces tableaux ont d'anciens noms, exemple : $HTTP_GET_VARS. Ces noms fonctionnent toujours, mais nous encourageons les utilisateurs de migrer vers le nouveaux noms, plus courts et qui sont des versions automatiquement globales. </p> <p> Les remerciements vont &agrave; Shaun Clowes (shaun at securereality dot com dot au) pour avoir r&eacute;v&eacute;l&eacute; ce probl&egrave;me et avoir aid&eacute; &agrave; l'analyser. </p> <p> French translation is available courtesy of Pierre-Alain Joye (pierre-alain dot joye at wanadoo dot fr). </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_1_1.php?view=markup&rev=1.1 Index: phpweb/releases/4_1_1.php +++ phpweb/releases/4_1_1.php <?php // $Id: 4_1_1.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_1_1.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.1.1 Release Announcement"); ?> <h1>PHP 4.1.1 Release Announcement</h1> <p> Due to a few bugs in PHP 4.1.0, we decided to release PHP 4.1.1. The bugs that were fixed are not major ones but minor ones, which could be annoying if you get bitten by them. </p> <p> Our recommendation is that people who already upgraded to PHP 4.1.0 do <strong>not</strong> upgrade to <a href="/downloads.php">PHP 4.1.1</a>, unless they're experiencing one of the described bugs. </p> <p> <strong>No</strong> new features or security updates are available in this release. </p> <p>Full list of fixes:</p> <ul> <li> Fixed incompatibility with Windows .NET / IIS 6 - may improve stability under other versions of IIS. (Zeev) </li> <li> Fixed bug that caused crashes or error notices on shutdown on threaded platforms. (Zeev) </li> <li>Fixed several crash bugs in the xslt extension. (Markus, Derick)</li> <li> Fixed problem with dbase not returning very large (larger than long) integers properly. (Vlad) </li> <li>Fixed several bugs and memleaks in the domxml extension. (Markus)</li> <li> Fixed bug in gmmktime() which was one hour off during standard time - bug #9878. Patch by bfoddy@mediaone.net. (jmoore) </li> <li>Fixed bug in gmdate() timezone handling on Windows - bug #13885. (jmoore)</li> <li>Fixed several crash bugs in the mcrypt extension. (Derick)</li> <li> Made the mcrypt extension compile with the libmcrypt 2.2 series again. (Sterling) </li> <li> Fixed a bug where the is_file() family of functions would in-correctly give an error when they were given filenames that didn't exist. (Sterling) </li> <li> Fixed a bug in the strtotime() function where it was incorrectly recognizing GMT +0100 and GMT -0100. (Derick) </li> </ul> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_1_2_win32.php?view=markup&rev=1.1 Index: phpweb/releases/4_1_2_win32.php +++ phpweb/releases/4_1_2_win32.php <?php // $Id: 4_1_2_win32.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_1_2_win32.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.1.2 Windows (Win32) Release Announcement"); ?> <h1>PHP 4.1.2 Windows (Win32) Release Announcement</h1> <p> Due to an issue with the Windows binary allowing any user to read or execute the contents of a file directly from the PHP binary, we have delayed the 4.1.2 release of PHP for Windows to allow for this fix. This release also fixes the file upload security problem. </p> <p> With this new release, we introduce 2 new php.ini settings, which <strong>MUST</strong> be set to make the binary work. It's worth noting, at this point, that this particular fix only applies to the CGI binary. The SAPI module will still work as expected, and it's use is encouraged. </p> <p>The new settings are:</p> <ul> <li><tt>cgi.force_redirect 0|1</tt></li> <li><tt>cgi.redirect_status_env ENV_VAR_NAME</tt></li> </ul> <h2>WebServers affected by this vulnerability</h2> <p> It is known that Apache (any version) and iPlanet servers are vulnerable to this issue, however Microsoft IIS is not. Since cgi.force_redirect takes a value of either 1 or 0, (on or off) you should set it to 1 if you are running Apache or iPlanet servers, and to 0 for IIS. If you are unsure of which you need, set it to 1 and see if your scripts execute. You will need to stop and restart your server when you change your php.ini file, for the changes to have effect. </p> <p> If cgi.force_redirect is turned on, and you are not running under Apache or Netscape (iPlanet) web servers, you MAY need to set an environment variable name that PHP will look for to know it is OK to continue execution. Setting this variable MAY cause security issues, so check what you are doing first. </p> <p> More information can be found <a href="http://security.e-matters.de/advisories/012002.html">here</a> relating to the form upload exploit that caused the release of 4.1.2 initially. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_2_0.php?view=markup&rev=1.1 Index: phpweb/releases/4_2_0.php +++ phpweb/releases/4_2_0.php <?php // $Id: 4_2_0.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_2_0.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.2.0 Release Announcement"); ?> <h1>PHP 4.2.0 Release Announcement</h1> <p> After an orderly QA process, PHP 4.2.0 is <a href="/downloads.php">out</a>!<br /> [ <a href="/release_4_2_0_fr.php">Version Fran&ccedil;aise</a> ] </p> <h2>External variables</h2> <p> The biggest change in PHP 4.2.0 concerns variable handling. <strong>External variables (from the environment, the HTTP request, cookies or the web server) are no longer registered in the global scope by default.</strong> The preferred method of accessing these external variables is by using the new Superglobal arrays, introduced in PHP 4.1.0. More information about this change:</p> <ul> <li><a href="/manual/en/language.variables.predefined.php">PHP Manual: Predefined variables</a></li> <li><a href="/release_4_1_0.php">The PHP 4.1.0 release announcement</a></li> <li><a href="http://www.zend.com/zend/art/art-oertli.php">Thomas Oertli's article on secure programming in PHP</a></li> </ul> <h2>Compatibility</h2> <p> The Apache Software Foundation recently released their first General Availability version of Apache 2. PHP 4.2.0 will have <strong>EXPERIMENTAL</strong> support for this version. You can build a DSO module for Apache 2 with --with-apxs2. We do <strong>not</strong> recommend that you use this in a production environment. </p> <p> PHP 4.2.0 still lacks certain key features on Mac OS X and Darwin, and isn't officially supported by the PHP Group on these platforms. Specifically, building PHP as a dynamically loaded Apache module isn't supported at this time. PHP 4.3.0, due to be released in August, 2002, will be the first PHP release to officially support Mac OS X. It, along with future Mac OS X and Apache releases, will enable full feature parity with other PHP platforms. <strong>Update:</strong> <a href="http://www.entropy.ch/software/macosx/php/">Instructions on overcoming these limitations</a> </p> <h2>Improvements</h2> <p>PHP 4.2.0 includes several improvements:</p> <ul> <li> <strong>External variables (from the environment, the HTTP request, cookies or the web server) are no longer registered as global variables</strong> </li> <li>Overhaul of the sockets extension</li> <li>Highly improved performance with file uploads</li> <li> The satellite and mailparse extensions were moved to PECL and are no longer bundled with the official PHP release </li> <li>The posix extension has been cleaned up</li> <li>iconv handling has been improved</li> <li> Output buffering support, which was introduced in PHP 4.1.0 has been stabilized </li> <li>Improved performance and stability of the domxml extension</li> <li>New multibyte regular expression support</li> <li><strong>LOTS</strong> of fixes and new functions</li> </ul> <p> For a full list of changes in PHP 4.2.0, <a href="/ChangeLog-4.php#4.0.2">see the ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_2_0_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_2_0_fr.php +++ phpweb/releases/4_2_0_fr.php <?php // $Id: 4_2_0_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_2_0_fr.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("Annonce de publication de PHP 4.2.0", array("lang" => "fr")); ?> <h1>Annonce de publication de PHP 4.2.0</h1> <p>[ <a href="/releases/4_2_1.php">English Version</a> ]</p> <p> Apr&egrave;s avoir pass&eacute; avec succ&egrave;s le processus qualit&eacute;, PHP 4.2.0 est officiellement <a href="/downloads.php">publi&eacute;</a>! </p> <h2>Variables externes</h2> <p> Le changement le plus important de PHP 4.2.0 concerne la gestion des variables. Les <strong>variables externes (issues de l'environnement d'ex&eacute;cution, des requ&ecirc;tes HTTP, des cookies ou du serveur web) ne sont plus enregistr&eacute;es dans l'environnement d'ex&eacute;cution global par d&eacute;faut.</strong> La m&eacute;thode recommand&eacute;e pour acc&eacute;der aux variables externes est d'utiliser les nouveaux tableaux globaux, introduits en PHP 4.1.0. Pour plus d'informations sur ces modifications: </p> <ul> <li><a href="http://www.php.net/manual/en/language.variables.predefined.php">PHP Manual : Predefined variables</a></li> <li><a href="http://www.php.net/release_4_1_0.php">Annonce de PHP 4.1.0</a></li> <li><a href="http://www.zend.com/zend/art/art-oertli.php">Article de Thomas Oertli sur la programmation s&eacute;curis&eacute;e en PHP</a></li> <li><a href="http://www.phpinfo.net/?p=articles&rub=globals">Article de Jean Pierre D&eacute;zelus sur les variables globales</a></li> </ul> <h2>Compatibilit&eacute;</h2> <p> L'ASF (Apache Software Foundation) a r&eacute;cemment publi&eacute; sa premi&egrave;re version publique d'Apache 2. PHP 4.2.0 dispose du support <strong>EXPERIMENTAL</strong> d'Apache 2. Vous pouvez compiler un module DSO pour Apache 2 avec l'option --with-apxs2. Nous recommandons de <strong>ne pas</strong> utiliser cette combinaison en environnement de production. </p> <p> Il manque encore &agrave; PHP 4.2.0 des fonctionnalit&eacute;s cl&eacute;s sur MacOSX et sur Darwin. PHP n'est donc pas officiellement support&eacute; par le PHP group sur ces plates-formes. Sp&eacute;cifiquement, compiler PHP comme module Apache dynamiquement charg&eacute; n'est pas encore support&eacute;. PHP 4.3.0, dont la publication est pr&eacute;vue pour Ao&ucirc;t 2002, sera la premi&egrave;re version qui supportera officiellement Mac OS X. Cette version, aussi bien pour les futures versions de Mac OS X et Apache, sera totalement synchronis&eacute; avec les autres plates-formes PHP. </p> <h2>Am&eacute;liorations</h2> <p>PHP 4.2.0 inclut de nombreuses innovations:</p> <ul> <li> <strong>Les variables externes (issues de l'environnement d'ex&eacute;cution, des requ&ecirc;tes HTTP, des cookies ou du serveur web) ne sont plus enregistr&eacute;es dans l'environnement d'ex&eacute;cution global par d&eacute;faut. </strnong> </li> <li>Remise en &eacute;tat g&eacute;n&eacute;rale de l'extension socket</li> <li>Performances r&eacute;volutionnaires des uploads de fichiers</li> <li> Les extensions satellite (corba) et mailparse ont &eacute;t&eacute; plac&eacute;es sous PECL, et ne sont plus fournies directement avec la distribution officielle de PHP. </li> <li>L'extension POSIX a &eacute;t&eacute; nettoy&eacute;e</li> <li>L'extension iconv a &eacute;t&eacute; am&eacute;lior&eacute;e</li> <li> Le support de la bufferisation d'affichage, introduite en PHP 4.1.0, a &eacute;t&eacute; stabilis&eacute;e. </li> <li> Gain de performance notable et am&eacute;lioration de la stabilit&eacute; de l'extension domxml </li> <li>Support des expressions r&eacute;guli&egrave;res multi-octets</li> <li><strong>ENORMMENT</strong> de corrections, et de nouvelles fonctions.</li> </ul> <p> Pour une liste compl&egrave;te de changements en PHP 4.2.0, voyez le fichier <a href="/ChangeLog-4.php#4.2.0">NEWS</a>, dans la distribution. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_2_1.php?view=markup&rev=1.1 Index: phpweb/releases/4_2_1.php +++ phpweb/releases/4_2_1.php <?php // $Id: 4_2_1.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_2_1.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.2.1 Release Announcement"); ?> <h1>PHP 4.2.1 Release Announcement</h1> <p>[ <a href="/releases/4_2_1_fr.php">Version Fran&ccedil;aise</a> ]</p> <h2>Bugfix release</h2> <p> This bug fix release solves a few bugs found in PHP 4.2.0. PHP 4.2.1 includes the following fixes: </p> <ul> <li>Fix for the MySQL extension not be able to connect to a MySQL server.</li> <li>Fix for a crash in the COM extension when using an outproc server.</li> <li>Fix for SID logic in the session extension.</li> <li> Fixes for the mbstring extension, including SJIS directory name handling and mb_output_buffer(). </li> <li> Fix for a bug in socket_select() that could cause unexpected behavior when using a statement like $w = $e = array($sock); </li> <li>Almost full DOM compliance for the domxml extension, and fixes for several functions.</li> <li>Safe_mode checks for show_source(), parse_ini_file() and rmdir().</li> </ul> <p> For a full list of changes in PHP 4.2.1, see the <a href="/ChangeLog-4.php#4.2.1">ChangeLog</a>. </p> <h2>Compatibility</h2> <p> PHP 4.2.1 also has improved (but still experimental) support for Apache version 2. We do <strong>not</strong> recommend that you use this in a production environment, but feel free to test it and report bugs to the <a href="http://bugs.php.net">bug system</a>. </p> <h2>External variables</h2> <p> We would also like to attend you on a big change in PHP 4.2.0 concerning variable handling. <strong>External variables (from the environment, the HTTP request, cookies or the web server) are no longer registered in the global scope by default.</strong> The preferred method of accessing these external variables is by using the new Superglobal arrays, introduced in PHP 4.1.0. More information about this change: </p> <ul> <li><a href="/manual/en/language.variables.predefined.php">PHP Manual: Predefined variables</a></li> <li><a href="/release_4_1_0.php">The PHP 4.1.0 release announcement</a></li> <li><a href="http://www.zend.com/zend/art/art-oertli.php">Thomas Oertli's article on secure programming in PHP</a></li> </ul> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_2_1_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_2_1_fr.php +++ phpweb/releases/4_2_1_fr.php <?php // $Id: 4_2_1_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_2_1_fr.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("Annonce de publication de PHP 4.2.1", array("lang" => "fr")); ?> <h1>Annonce de publication de PHP 4.2.1</h1> <p>[ <a href="/releases/4_2_1.php">English Version</a> ]</p> <h2>Version mineure de correction de bugs</h2> <p> Cette version interm&eacute;diaire corrige quelques bugs trouv&eacute;s dans PHP 4.2.0. PHP 4.2.1 inclut les am&eacute;liorations suivantes: </p> <ul> <li> Correction de l'extension MySQL qui n'arrivait pas &agrave; se connecter au serveur MySQL. </li> <li> Correction de l'extension COM qui crashait lors de l'utilisation d'un serveur outproc. </li> <li>Correction du fonctionnement du SID des sessions.</li> <li> Correction de l'extension mbstring, incluant le support des noms de dossiers SJIS et mb_output_buffer(). </li> <li> Correction d'un bug dans socket_select() qui cause un comportement inattendu lors de commandes comme $w = $e = array($sock); </li> <li> Compatibilit&eacute; presque totale avec l'extension domxml, et corrections de nombreuses fonctions. </li> <li>Le safe mode prot&egrave;ge show_source(), parse_ini_file() et rmdir().</li> </ul> <p> Pour une liste compl&egrave;te des modifications de PHP 4.2.1, voyez le fichier <a href="/ChangeLog-4.php#4.2.1">ChangeLog</a>. </p> <h2>Compatibilit&eacute;</h2> <p> PHP 4.2.1 dispose aussi d'une compatibilit&eacute; am&eacute;lior&eacute;e (mais toujours exp&eacute;rimentale) avec Apache 2. Nous <strong>ne recommandons pas</strong> son utilisation dans un environnement de production. Testez-le intensivement, et rapportez tous les bugs dans le <a href="http://bugs.php.net">syst&egrave;me</a>. </p> <h2>Variables externes</h2> <p> Nous attirons votre attention sur l'&eacute;volution majeure de PHP 4.2.0 concernant l'utilisation des variables. <strong>Les variables externes (celles d'environnement ou du serveur web, les requ&ecirc;tes HTTP, les cookies) ne sont plus enregistr&eacute;es par d&eacute;faut comme variables globales</strong>. La m&eacute;thode recommand&eacute;e pour acc&eacute;der &agrave; ces variables est d'utiliser les super globales, introduits en PHP 4.1.0. Plus d'informations sur ces modifications: </p> <ul> <li><a href="/manual/fr/language.variables.predefined.php">PHP Manuel : Variables pr&eacute;d&eacute;finies</a></li> <li><a href="/release_4_1_0_fr.php">L'annonce de publication de PHP 4.1.0</a></li> <li><a href="http://www.zend.com/zend/art/art-oertli.php">L'article de Thomas Oertli sur la programmation s&eacute;curis&eacute;e</a></li> </ul> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_2_2.php?view=markup&rev=1.1 Index: phpweb/releases/4_2_2.php +++ phpweb/releases/4_2_2.php <?php // $Id: 4_2_2.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_2_2.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.2.2 Release Announcement"); ?> <h1> PHP Security Advisory: Vulnerability in PHP versions 4.2.0 and 4.2.1 </h1> <p>[ <a href="/releases/4_2_2_fr.php">Version Fran&ccedil;aise</a> ]</p> <dl> <dt>Issued on:</dt> <dd>July 22, 2002</dd> <dt>Software:</dt> <dd>PHP versions 4.2.0 and 4.2.1</dd> <dt>Platforms:</dt> <dd>All</dd> </dl> <p> The PHP Group has learned of a serious security vulnerability in PHP versions 4.2.0 and 4.2.1. An intruder may be able to execute arbitrary code with the privileges of the web server. This vulnerability may be exploited to compromise the web server and, under certain conditions, to gain privileged access. </p> <h2>Description</h2> <p> PHP contains code for intelligently parsing the headers of HTTP POST requests. The code is used to differentiate between variables and files sent by the user agent in a "multipart/form-data" request. This parser has insufficient input checking, leading to the vulnerability. </p> <p> The vulnerability is exploitable by anyone who can send HTTP POST requests to an affected web server. Both local and remote users, even from behind firewalls, may be able to gain privileged access. </p> <h2>Impact</h2> <p> Both local and remote users may exploit this vulnerability to compromise the web server and, under certain conditions, to gain privileged access. So far only the IA32 platform has been verified to be safe from the execution of arbitrary code. The vulnerability can still be used on IA32 to crash PHP and, in most cases, the web server. </p> <h2>Solution</h2> <p> The PHP Group has released a new PHP version, 4.2.2, which incorporates a fix for the vulnerability. All users of affected PHP versions are encouraged to upgrade to this latest version. <a href="/downloads.php">The downloads page</a> has the new 4.2.2 source tarballs, Windows binaries and source patches from 4.2.0 and 4.2.1 available for download. </p> <h2>Workaround</h2> <p> If the PHP applications on an affected web server do not rely on HTTP POST input from user agents, it is often possible to deny POST requests on the web server. </p> <p> In the Apache web server, for example, this is possible with the following code included in the main configuration file or a top-level .htaccess file: </p> <pre> &lt;Limit POST&gt; Order deny,allow Deny from all &lt;/Limit&gt; </pre> <p> Note that an existing configuration and/or .htaccess file may have parameters contradicting the example given above. </p> <h2>Credits</h2> <p> The PHP Group would like to thank Stefan Esser of e-matters GmbH for discovering this vulnerability. e-matters GmbH has also released an <a href="http://security.e-matters.de/advisories/022002.html">independent advisory</a>, describing the vulnerability in more detail. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_2_2_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_2_2_fr.php +++ phpweb/releases/4_2_2_fr.php <?php // $Id: 4_2_2_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_2_2_fr.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("Annonce de publication de PHP 4.2.2", array("lang" => "fr")); ?> <h1> Alerte de s&eacute;curit&eacute; PHP : Vuln&eacute;rabilit&eacute; dans les versions 4.2.0 et 4.2.1 de PHP </h1> <p>[ <a href="/releases/4_2_2.php">English Version</a> ]</p> <dl> <dt>Date:</dt> <dd>22 Juillet 2002</dd> <dt>Logiciel:</dt> <dd>PHP versions 4.2.0 et 4.2.1</dd> <dt>Plates-formes:</dt> <dd>Toutes</dd> </dl> <p> Le PHP Group a pris connaissance d'un trou de s&eacute;curit&eacute; s&eacute;rieux en PHP version 4.2.0 et 4.2.1. Un intrus pourrait ex&eacute;cuter un code arbitraire sur le serveur, avec les m&ecirc;mes privil&egrave;ges que celui qui ex&eacute;cute le serveur web. Cette vuln&eacute;rabilit&eacute; peut &ecirc;tre exploit&eacute;e pour compromettre le serveur web, et dans certaines circonstances, obtenir des droits sp&eacute;ciaux. </p> <h2>Description</h2> <p> PHP contient du code qui analyse finement les ent&ecirc;tes des requ&ecirc;tes HTTP POST. Le code est utilis&eacute; pour diff&eacute;rencier les variables des fichiers qui sont envoy&eacute;s par le navigateur, avec l'encodage "multipart/form-data". Cet analyseur ne v&eacute;rifie pas suffisamment les donn&eacute;es d'entr&eacute;e, ce qui conduit &agrave; une vuln&eacute;rabilit&eacute;. </p> <p> La vuln&eacute;rabilit&eacute; est exploitable par quiconque peut envoyer des requ&ecirc;tes HTTP POST &agrave; un serveur web utilisant PHP versions 4.2.0 et 4.2.1. Des utilisateurs, locaux ou distants, m&ecirc;me derri&egrave;re un pare-feu, pourraient obtenir des autorisations indues sur la machine. </p> <h2>Impact</h2> <p> Les utilisateurs, tant locaux que distants, peuvent exploiter cette vuln&eacute;rabilit&eacute; pour compromettre le serveur web, et, dans certaines circonstances, obtenir des autorisations indues. Jusqu'&agrave; pr&eacute;sent, seule la plate-forme IA32 a pu passer les tests de s&eacute;curit&eacute;. Cette vuln&eacute;rabilit&eacute; peut &ecirc;tre utilis&eacute;e sous IA32 pour crasher PHP et, dans la plupart des cas, le serveur web. </p> <h2>Solution</h2> <p> Le PHP Group a publi&eacute; une nouvelle version PHP version, 4.2.2, qui inclus une correction pour cette vuln&eacute;rabilit&eacute;. Tous les utilisateurs des versions de PHP affect&eacute;es sont encourag&eacute;s &agrave; passer &agrave; cette nouvelle version. L'URL de t&eacute;l&eacute;chargement est : <a href="http://www.php.net/downloads.php">http://www.php.net/downloads.php</a> sous forme de sources (tarballs), ex&eacute;cutable Windows et source patches pour les versions 4.2.0 et 4.2.1. </p> <h2>Autre solution</h2> <p> Si les applications PHP n'utilisent pas la m&eacute;thode POST sur un serveur affect&eacute;, il est possible de simplement interdire les requ&ecirc;tes POST sur le serveur. </p> <p> Sous Apache, par exemple, il est possible d'utiliser le code suivant dans le fichier de configuration principal, ou avec un fichier .htaccess plac&eacute; suffisamment pr&egrave;s de la racine : </p> <pre> &lt;Limit POST&gt; Order deny,allow Deny from all &lt;/Limit&gt; </pre> <p> Notez qu'une autre configuration ou/et un autre fichier .htaccess avec certains param&egrave;tres, peuvent annuler l'effet de l'exemple ci-dessus. </p> <h2>Cr&eacute;dits</h2> <p> Le PHP Group remercie Stefan Esser de e-matters GmbH pour la d&eacute;couverte de cette vuln&eacute;rabilit&eacute;. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_0.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_0.php +++ phpweb/releases/4_3_0.php <?php // $Id: 4_3_0.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_0.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.0 Release Announcement"); ?> <h1>PHP 4.3.0 Release Announcement</h1> <p>[ <a href="/releases/4_3_0_fr.php">Version Fran&ccedil;aise</a> ]</p> <p> After a long and arduous 8 months of development and testing, PHP 4.3.0 is <a href="/downloads.php">out</a>! With regard to scope, time, and effort, this is the largest 4.x release of PHP, and it further elevates PHP's standing as a serious contender in the general purpose scripting language arena. </p> <h2>Command line interface</h2> <p> This version finalizes the separate command line interface (CLI) that can be used for developing shell and desktop applications (with <a href="http://gtk.php.net/">PHP-GTK</a>). The CLI is always built, but installed automatically only if CGI version is disabled via --disable-cgi switch during configuration. Alternatively, one can use <strong>make install-cli</strong> target. On Windows CLI can be found in <strong>cli</strong> folder. </p> <p> CLI has a number of differences compared to other server APIs. More information can be found in the PHP Manual: <a href="/manual/en/features.commandline.php">Using PHP from the command line</a> </p> <h2>Streams</h2> <p> A very important "under the hood" feature is the streams API. It introduces a unified approach to the handling of files, pipes, sockets, and other I/O resources in the PHP core and extensions. </p> <p> What this means for users is that any I/O function that works with streams (and that is almost all of them) can access built-in protocols, such as HTTP/HTTPS and FTP/FTPS, as well as custom protocols registered from PHP scripts. For more information please see: <a href="/manual/en/wrappers.php">List of Supported Protocols/Wrappers</a> </p> <h2>New build system</h2> <p> This iteration of the build system, among other things, replaces the slow recursive make with one global Makefile and eases the integration of proper dependencies. Automake is only needed for its aclocal tool. The build process is now more portable and less resource-consuming. </p> <h2>Improvements</h2> <p>PHP 4.3.0 has many improvements and enhancements:</p> <ul> <li> <strong> GD library is now bundled with the distribution and it is recommended to always use the bundled version </strong> </li> <li>vpopmail and cybermut extensions are moved to PECL</li> <li> several deprecated extensions (aspell, ccvs, cybercash, icap) and SAPIs (fastcgi, fhttpd) are removed </li> <li>speed improvements in a variety of string functions</li> <li> Apache2 filter is improved, but is still considered experimental (use with PHP in prefork and not worker (thread) model since many extensions based on external libraries are not thread safe) </li> <li>various security fixes (imap, mysql, mcrypt, file upload, gd, etc)</li> <li>new SAPI for embedding PHP in other applications (experimental)</li> <li>much better test suite</li> <li>significant improvements in dba, gd, pcntl, sybase, and xslt extensions</li> <li>debug_backtrace() should help with debugging</li> <li> error messages now contain URLs linking to pages describing the error or function in question </li> <li>Zend Engine has some fixes and minor performance enhancements</li> <li>and <strong>TONS</strong> of other fixes, updates, new functions, etc</li> </ul> <p> For the full list of changes in PHP 4.3.0, see the <a href="/ChangeLog-4.php#4.3.0">ChangeLog</a> file. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_0_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_0_fr.php +++ phpweb/releases/4_3_0_fr.php <?php // $Id: 4_3_0_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_0_fr.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("Annonce de publication de PHP 4.3.0", array("lang" => "fr")); ?> <h1>Annonce de publication de PHP 4.3.0</h1> <p>[ <a href="/releases/4_3_0.php">English version</a> ]</p> <p> Apr&egrave;s un long et difficile 8 mois de d&eacute;veloppement et de test, PHP 4.3.0 est <a href="/downloads.php">publi&eacute;</a>! Au vue des &eacute;volutions, du temps consacr&eacute; et des efforts consentis, cette version est la plus importante version de la s&eacute;rie des PHP 4.x. Elle contribue largement a am&eacute;liorer les capacit&eacute;s de PHP en tant que langage g&eacute;n&eacute;raliste de scripts. </p> <h2>Utilisation en ligne de commande</h2> <p> PHP 4.3.0 ach&egrave;ve la s&eacute;paration du mode d'utilisation en ligne de commande (dit CLI) qui permet de d&eacute;velopper des applications shell ou graphiques (avec <a href="http://gtk.php.net/">PHP-GTK</a>). La version CLI de PHP est toujours compil&eacute;es, mais elle n'est install&eacute;e que si la version CGI est d&eacute;sactiv&eacute;e avec l'option --disable-cgi. De plus, vous pouvez utilisez la commande <strong>make install-cli</strong>. Sous Windows, la version CLI est disponible dans le dossier <strong>cli</strong>. </p> <p> CLI dispose de fonctionnalit&eacute;s diff&eacute;rentes, par rappot &agrave; la version interfac&eacute;e avec les serveurs web. Pour plus de d&eacute;tails, reportez vous &agrave; <a href="http://dev.nexen.net/docs/php/annotee/features.commandline.php">Utiliser PHP en ligne de commande</a> </p> <h2>Fl&ocirc;ts (Streams)</h2> <p> Une nouveaut&eacute; tr&egrave;s importante, mais cach&eacute;e a &eacute;t&eacute; introduite : les fl&ocirc;ts. Les fl&ocirc;ts unifient la gestion des pipes, fichiers, sockets et autres ressources d'entr&eacute;es/sorties du coeur de PHP et de ses extensions. </p> <p> Cela signifie, pour les utilisateurs, est que les fonctions d'entr&eacute;es/sorties fonctionnent d&eacute;sormais avec les fl&ocirc;ts (c'est &agrave; dire presque toutes), peuvent utiliser des protocoles internes tels que HTTP/HTTPS et FTP/FTPS, ainsi que des protocoles personnalis&eacute;s, enregistr&eacute;s comme tels depuis les scripts PHP. Pour plus d'informations, voyez: <a href="http://dev.nexen.net/docs/php/annotee/wrappers.php#wrappers">Liste des protocoles support&eacute;s</a> </p> <h2>Nouveaus syst&egrave;me de compilation</h2> <p> Cette version du syst&egrave;me de compilation de PHP, entre autre choses, remplace la version r&eacute;cursive lente par un Makefile global, et facilite l'int&eacute;gration des librairies connexes. Automake est uniquement n&eacute;cessaire pour l'utilitaire aclocal. Le processus de compilation est rendu plus portable, et moins consommateur de ressources. </p> <h2>Am&eacute;liorations</h2> <p>PHP 4.3.0 propose de nombreuses am&eacute;liorations et &eacute;volutions :</p> <ul> <li> <strong> La librairie GD est d&eacute;sormais distribu&eacute; avec PHP, et il est recommand&eacute; d'utiliser cette version </strong> </li> <li> Les extensions vpopmail et cybermut ont &eacute;t&eacute; d&eacute;plac&eacute;es vers PECL </li> <li> Plusieurs extensions obsol&egrave;tes ont &eacute;t&eacute; supprim&eacute;es (aspell, ccvs, cybercash, icap) et (fastcgi, fhttpd) </li> <li> Acc&eacute;l&eacute;ration des fonctions de traitement des channes de caract&egrave;res </li> <li> Am&eacute;lioration des filtres Apache2 mais le support d'Apache 2 est toujours consid&eacute;r&eacute; comme exp&eacute;rimental (utilisez PHP avec le mode prefork et non le mode worker (thread), car de nombreuses extensions bas&eacute;es sur des librairies externes ne sont pas encore compatibles avec les threads) </li> <li> Plusieurs corrections de s&eacute;curit&eacute; (imap, mysql, mcrypt, t&eacute;l&eacute;chargement de fichiers, gd, etc...) </li> <li> Nouvelle interface SAPI pour inclure PHP dans d'autres applications (exp&eacute;rimental) </li> <li>suite de test nettement am&eacute;lior&eacute;e et compl&eacute;t&eacute;e</li> <li>am&eacute;liorations du support de dba, gd, pcntl, sybase et xslt</li> <li>debug_backtrace() aide nettement pour le d&eacute;bogage</li> <li> les messages d'erreur contiennent des URL faisant r&eacute;f&eacute;rence aux pages du manuel d&eacute;crivant ces erreurs, ou bien aux fonctions utilis&eacute;es </li> <li> Le Zend Engine a regu des corrections et des am&eacute;liorations de performances mineures </li> <li> et des <strong>tonnes</strong> de corrections, am&eacute;liorations et nouvelles fonctions, dors et d&eacute;j&agrave; document&eacute;es et traduites, etc... </li> </ul> <p> Pour la liste compl&egrave;te des modifications de PHP 4.3.0, voyez le fichier d'<a href="/ChangeLog-4.php#4.3.0">historique</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_1.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_1.php +++ phpweb/releases/4_3_1.php <?php // $Id: 4_3_1.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_1.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.1 Release Announcement"); ?> <h1> PHP Security Advisory: CGI vulnerability in PHP version 4.3.0 </h1> <dl> <dt>Issued on:</dt> <dd>February 17, 2003</dd> <dt>Software:</dt> <dd>PHP version 4.3.0</dd> <dt>Platforms:</dt> <dd>All</dd> </dl> <p> The PHP Group has learned of a serious security vulnerability in the CGI SAPI of PHP version 4.3.0. </p> <h2>Description</h2> <p> PHP contains code for preventing direct access to the CGI binary with configure option "--enable-force-cgi-redirect" and php.ini option "cgi.force_redirect". In PHP 4.3.0 there is a bug which renders these options useless. </p> <p> NOTE: This bug does NOT affect any of the other SAPI modules. (such as the Apache or ISAPI modules, etc.) </p> <h2>Impact</h2> <p> Anyone with access to websites hosted on a web server which employs the CGI module may exploit this vulnerability to gain access to any file readable by the user under which the webserver runs. </p> <p> A remote attacker could also trick PHP into executing arbitrary PHP code if attacker is able to inject the code into files accessible by the CGI. This could be for example the web server access-logs. </p> <h2>Solution</h2> <p> The PHP Group has released a new PHP version, 4.3.1, which incorporates a fix for the vulnerability. All users of affected PHP versions are encouraged to upgrade to this latest version. <a href="/downloads.php">The downloads page</a> has the new 4.3.1 source tarballs, Windows binaries and source patch from 4.3.0 available for download. You will only need to upgrade if you're using the CGI module of PHP 4.3.0. There are no other bugfixes contained in this release. </p> <h2>Workarounds</h2> <p>None.</p> <h2>Credits</h2> <p> The PHP Group would like to thank Kosmas Skiadopoulos for discovering this vulnerability. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_10.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_10.php +++ phpweb/releases/4_3_10.php <?php // $Id: 4_3_10.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_10.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.10 Release Announcement"); ?> <h1>PHP 4.3.10 Release Announcement</h1> <p>[ <a href="/releases/4_3_10_fr.php">Version Fran&ccedil;aise</a> ]</p> <p> PHP Development Team would like to announce the immediate release of <a href="/downloads.php">PHP 4.3.10</a>. This is a maintenance release that in addition to over 30 non-critical bug fixes addresses several very serious security issues. </p> <p /> These include the following: <p /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1018">CAN-2004-1018</a> - shmop_write() out of bounds memory write access.<br /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1018">CAN-2004-1018</a> - integer overflow/underflow in pack() and unpack() functions.<br /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1019">CAN-2004-1019</a> - possible information disclosure, double free and negative reference index array underflow in deserialization code.<br /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1020">CAN-2004-1020</a> - addslashes() not escaping \0 correctly.<br /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1063">CAN-2004-1063</a> - safe_mode execution directory bypass.<br /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1064">CAN-2004-1064</a> - arbitrary file access through path truncation.<br /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1065">CAN-2004-1065</a> - exif_read_data() overflow on long sectionname.<br /> magic_quotes_gpc could lead to one level directory traversal with file uploads. <p /> All Users of PHP are strongly encouraged to upgrade to this release as soon as possible.<p /> <h2>Bugfix release</h2> <p> Aside from the above mentioned issues this release includes the following important fixes: </p> <ul> <li> Possible crash inside ftp_get().</li> <li> get_current_user() crashes on Windows.</li> <li> Possible crash in ctype_digit() on large numbers.</li> <li> Crash when parsing <i>?getvariable[][</i>.</li> <li> Possible crash in the curl_getinfo() function.</li> <li> Double free when openssl_csr_new fails.</li> <li> Crash when using unknown/unsupported session.save_handler and/or session.serialize_handler.</li> <li> Prevent infinite recursion in url redirection.</li> <li> Ensure that temporary files created by GD are removed.</li> <li> Crash in fgetcsv() with negative length.</li> <li> Improved performance of the foreach() construct.</li> <li> Improved number handling on non-English locales.</li> </ul> <p> For a full list of changes in PHP 4.3.10, see the <a href="/ChangeLog-4.php#4.3.10">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_10_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_10_fr.php +++ phpweb/releases/4_3_10_fr.php <?php // $Id: 4_3_10_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_10.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.10 Release Announcement"); ?> <h1>Annonce de publication de PHP 4.3.10</h1> <p>[ <a href="/releases/4_3_10.php">English Version</a> ]</p> <p> L'&eacute;quipe de d&eacute;veloppement PHP a le plaisir de vous annoncer la publication de <a href="/downloads.php">PHP 4.3.10</a>. C'est une version de maintenance, destin&eacute;e &agrave; corriger une trentaine de bogues non-critiques et ainsi que plusieurs problèmes de sécurité sérieux. </p> <p /> Cela inclut notamment : <p /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1018">CAN-2004-1018</a> - shmop_write() écrit hors des limites de la mémoire.<br /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1018">CAN-2004-1018</a> - dépassement de capacité avec pack() et unpack().<br /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1019">CAN-2004-1019</a> - publication possible d'informations, dépassement de capacité dans les index négatif lors de délinéarisation de données.<br /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1020">CAN-2004-1020</a> - addslashes() ne protège pas correctement \0.<br /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1063">CAN-2004-1063</a> - contournement de la directive de dossier d'exécution.<br /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1064">CAN-2004-1064</a> - accès arbitraire à un fichier via une troncature.<br /> <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1065">CAN-2004-1065</a> - dépassement de capacité avec exif_read_data() sur un long nom de section.<br /> magic_quotes_gpc peut mener à la lecture d'un dossier via le téléchargement de fichiers. <p /> Tous les utilisateurs sont encouragés à utiliser cette version.<p /> <h2>Version de correction de bogues</h2> <p> En plus des fonctionnalités ci-dessus, PHP 4.3.9 contient notamment les corrections, ajouts et am&eacute;liorations suivantes : </p> <ul> <li> Crash possible dans ftp_get().</li> <li> get_current_user() crashe sur Windows.</li> <li> Crash possible avec ctype_digit() pour les grands nombres.</li> <li> Crash lors de l'analyse de <i>?getvariable[][</i>.</li> <li> Crash possible avec curl_getinfo().</li> <li> Double désallocation lorsque openssl_csr_new() échoue.</li> <li> Crash lors de l'utilisation d'un session.save_handler et/ou session.serialize_handler non supporté.</li> <li> Evite les récursions infinies lors des redirections URL.</li> <li> S'assure que les fichiers temporaires de GD sont bien supprimés.</li> <li> Crash avec fgetcsv() et une taille négative.</li> <li> Performances améliorés pour foreach().</li> <li> Amélioration du support des configurations locales non-anglaises.</li> </ul> <p> Pour une liste exhaustive des modifications de PHP 4.3.10, voyez <a href="/ChangeLog-4.php#4.3.10">le ChangeLog</a>, en anglais. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_11.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_11.php +++ phpweb/releases/4_3_11.php <?php // $Id: 4_3_11.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_11.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.11 Release Announcement"); ?> <h1>PHP 4.3.11 Release Announcement</h1> <p>[ <a href="/releases/4_3_11_fr.php">Version Fran&ccedil;aise</a> ]</p> <p> PHP Development Team is would like to announce the immediate release of <a href="/downloads.php">PHP 4.3.11</a>. This is a maintenance release that in addition to over 70 non-critical bug fixes addresses several security issues inside the exif and fbsql extensions as well as the unserialize(), swf_definepoly() and getimagesize() functions. </p> All Users of PHP are strongly encouraged to upgrade to this release.<p /> <h2>Bugfix release</h2> <ul> <li> Crash in bzopen() if supplied path to non-existent file.</li> <li> DOM crashing when attribute appended to Document.</li> <li> unserialize() float problem on non-English locales.</li> <li> Crash in msg_send() when non-string is stored without being serialized.</li> <li> Possible infinite loop in imap_mail_compose().</li> <li> Fixed crash in chunk_split(), when chunklen > strlen.</li> <li> session_set_save_handler crashes PHP when supplied non-existent object ref.</li> <li> Memory leak in zend_language_scanner.c.</li> <li> Compile failures of zend_strtod.c.</li> <li> Fixed crash in overloaded objects &amp; overload() function.</li> <li> cURL functions bypass open_basedir.</li> </ul> <p> For a full list of changes in PHP 4.3.11, see the <a href="/ChangeLog-4.php#4.3.11">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_11_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_11_fr.php +++ phpweb/releases/4_3_11_fr.php <?php // $Id: 4_3_11_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_10.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("Annonce de PHP 4.3.11"); ?> <h1>Annonce de publication de PHP 4.3.11</h1> <p>[ <a href="/releases/4_3_11.php">English Version</a> ]</p> <p> L'&eacute;quipe de d&eacute;veloppement PHP a le plaisir de vous annoncer la publication de <a href="/downloads.php">PHP 4.3.11</a>. C'est une version de maintenance, destin&eacute;e &agrave; corriger environ 70 bogues non-critiques, plusieurs problèmes avec les extensions exif et fbsql ainsi que les fonctions unserialize(), swf_definepoly() et getimagesize(). </p> <p> Tous les utilisateurs sont encouragés à utiliser cette version. </p> <h2>Version de correction de bogues</h2> <ul> <li> Crash avec la fonction bzopen() si le chemin fourni conduit à un fichier inexistant.</li> <li> Crash de DOM lorsqu'un attribut est ajouté à un objet Document.</li> <li> Problème d'unserialize() avec les nombres décimaux pour les configurations non-anglaises.</li> <li> Crash avec msg_send() lorsqu'une variable autre qu'une chaîne est envoyée sans linéarisation.</li> <li> Boucle infinie potentielle dans imap_mail_compose().</li> <li> Crash dans chunk_split(), lorsque chunklen est supérieur à la taille de la ligne.</li> <li> session_set_save_handler fait crasher PHP lorsqu'elle reçoit une référence inexistante sur un objet.</li> <li> Fuite de mémoire dans zend_language_scanner.c.</li> <li> Problèmes de compilation dans zend_strtod.c.</li> <li> Crash dans un objet surchargé avec la fonction overload().</li> <li> Les fonctions cURL outrepassaient open_basedir.</li> </ul> <p> Pour une liste exhaustive des modifications de PHP 4.3.11, voyez <a href="/ChangeLog-4.php#4.3.11">le ChangeLog</a>, en anglais. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_2.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_2.php +++ phpweb/releases/4_3_2.php <?php // $Id: 4_3_2.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_2.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.2 Release Announcement"); ?> <h1>PHP 4.3.2 Release Announcement</h1> <p>[ <a href="/releases/4_3_2_fr.php">Version Fran&ccedil;aise</a> ]</p> <p> After a lengthy QA process, <a href="/downloads.php">PHP 4.3.2</a> is finally out!<br /> This maintenance release solves a lot of bugs found in earlier PHP versions and is a <strong>strongly</strong> recommended upgrade for all users of PHP. </p> <h2>Bugfix release</h2> <p> PHP 4.3.2 contains, among others, following important fixes, additions and improvements: </p> <ul> <li>Fixes several potentially hazardous integer and buffer overflows.</li> <li>Fixes for several 64-bit problems.</li> <li> New Apache 2.0 SAPI module (sapi/apache2handler, enabled with --with-apxs2). </li> <li> New session_regenerate_id() function. (Important feature against malicious session planting). </li> <li>Improvements to dba extension.</li> <li>Improvements to thttpd SAPI module.</li> <li>Dropped support for GDLIB version 1.x.x (php_gd.dll) on Windows.</li> <li>An unix man page for CLI version of PHP.</li> <li> New "disable_classes" php.ini option to allow administrators to disable certain classes for security reasons. </li> <li>..and a <strong>HUGE</strong> amount of other bug fixes!</li> </ul> <p> For a full list of changes in PHP 4.3.2, see the <a href="/ChangeLog-4.php#4.3.2">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_2_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_2_fr.php +++ phpweb/releases/4_3_2_fr.php <?php // $Id: 4_3_2_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_2_fr.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("Annonce de publication de PHP 4.3.2", array("lang" => "fr")); ?> <h1>Annonce de publication de PHP 4.3.2</h1> <p>[ <a href="/releases/4_3_2.php">English version</a> ]</p> <p> Apr&egrave;s une longue &eacute;tape de tests d'assurance Qualit&eacute;, <a href="/downloads.php">PHP 4.3.2</a> est finalement disponible!<br /> Cette version de maintenance r&eacute;sout un grand nombre de bugs trouv&eacute;s dans des versions plus anciennes de PHP, et il est <strong>recommand&eacute;</strong> de faire la mise &agrave; jour pour tous les utilisateurs PHP. </p> <h2>Version mineure, corrections de bugs</h2> <p> PHP 4.3.2 contient notamment les corrections, ajouts et am&eacute;liorations suivantes : </p> <ul> <li> Correction de plusieurs probl&egrave;mes dangereux de d&eacute;passement de capacit&eacute; avec les entiers. </li> <li>Correction de plusieurs probl&egrave;mes li&eacute;s aux plate-formes 64-bits.</li> <li> Nouveau module SAPI Apache 2.0 (sapi/apache2handler, activ&eacute; avec l'option --with-apxs2). </li> <li> Nouvelle fonction session_regenerate_id(). (Fonctionnalit&eacute; importante pour contrer les usurpations de sessions). </li> <li>Am&eacute;liorations de l'extension dba.</li> <li>Am&eacute;lioration du module thttpd SAPI.</li> <li>Abandon de GDLIB version 1.x.x (php_gd.dll) sous Windows.</li> <li>Le manuel man sous Unix pour la version CLI de PHP.</li> <li> Nouvelle option "disable_classes" pour permettre aux administrateurs de d&eacute;sactiver certaines classes pour des raisons de s&eacute;curit&eacute;. </li> </ul> <p> Pour une liste compl&egrave;te des modifications de PHP 4.3.2, reportez-vous au fichier <a href="/ChangeLog-4.php#4.3.2">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_3.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_3.php +++ phpweb/releases/4_3_3.php <?php // $Id: 4_3_3.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_3.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.3 Release Announcement"); ?> <h1>PHP 4.3.3 Release Announcement</h1> <p>[ <a href="/releases/4_3_3_fr.php">Version Fran&ccedil;aise</a> ]</p> <p> After a lengthy QA process, <a href="/downloads.php">PHP 4.3.3</a> is finally out!<br /> This maintenance release solves a fair number of bugs found in prior PHP versions and addresses several security issues. All users are <strong>strongly</strong> advised to upgrade to 4.3.3 as soon as possible. </p> <h2>Bugfix release</h2> <p> PHP 4.3.3 contains, among others, following important fixes, additions and improvements: </p> <ul> <li>Improved the engine to use POSIX/socket IO where feasible.</li> <li>Fixed several potentially hazardous integer and buffer overflows.</li> <li>Fixed corruption of multibyte character including 0x5c as second byte in multipart/form-data.</li> <li>Fixed each() to be binary safe for keys.</li> <li>Major improvements to the NSAPI SAPI.</li> <li>Improvements to the IMAP extension.</li> <li>Improvements to the InterBase extension.</li> <li>Added DBA handler 'inifile' to support ini files.</li> <li>Added long options into CLI & CGI (e.g. --version).</li> <li>Added a new parameter to preg_match*() that can be used to specify the starting offset in the subject string to match from.</li> <li>Upgraded the bundled Expat library to version 1.95.6</li> <li>Upgraded the bundled PCRE library to version 4.3</li> <li>Upgraded the bundled GD library to version GD 2.0.15</li> <li>Over 100 various bug fixes!</li> </ul> <p> For a full list of changes in PHP 4.3.3, see the <a href="/ChangeLog-4.php#4.3.3">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_3_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_3_fr.php +++ phpweb/releases/4_3_3_fr.php <?php // $Id: 4_3_3_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_3.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("Annonce de publication de PHP 4.3.3"); ?> <h1>Annonce de publication de PHP 4.3.3</h1> <p>[ <a href="/releases/4_3_3.php">English version</a> ]</p> <p> Apr&egrave;s avoir suivi un long processus qualit&eacute;, <a href="/downloads.php">PHP 4.3.3</a> est disponible!<br /> Cette version de maintenance r&eacute;sout un bon nombre de bugs d&eacute;couverts dans des versions ant&eacute;rieures de PHP. Elle corrige aussi plusieurs probl&egrave;mes de s&eacute;curit&eacute;. Il est <strong>vivement recommand&eacute;</strong> &agrave; tous les utilisateurs d'utiliser cette version aussit&ocirc;t que possible. </p> <h2>Corrections et nouveaut&eacute;s</h2> <p> PHP 4.3.3 contient la liste suivante et non exhaustive de corrections, am&eacute;liorations et ajouts : </p> <ul> <li>Am&eacute;lioration du moteur pour utiliser les entr&eacute;es/sorties Posix et socket lorsque c'est possible.</li> <li>Corrections de plusieurs probl&egrave;mes de d&eacute;passement de capacit&eacute; avec les entiers et buffers.</li> <li>Correction des jeux de caract&egrave;res multi-octets qui incluent le caract&egrave;re 0x5c en tant que second octet des formulaires multipart/form-data.</li> <li>each() est d&eacute;sormais compatible avec les cl&eacute;s binaires.</li> <li>Am&eacute;liorations importantes de NSAPI SAPI.</li> <li>Am&eacute;lioration de l'interface IMAP.</li> <li>Am&eacute;lioration de l'interface Interbase.</li> <li>Ajout d'un gestionnaire DBA 'infile' pour supporter les fichiers .ini.</li> <li>Ajout des options longues pour les versions CLI & CGI (i.e. --version).</li> <li>Ajout de nouveaux param&egrave;tres &agrave; preg_match*() pour indiquer l'offset de d&eacute;part dans la recherche de la cha&icirc;ne.</li> <li>La librairie Expat distribu&eacute;e passe en version 1.95.6</li> <li>La librairie PCRE distribu&eacute;e passe en version 4.3</li> <li>La librairie GD distribu&eacute;e passe en version 2.0.15</li> <li>Plus de 100 corrections de bugs divers.</li> </ul> <p> Pour une liste exhaustive des modifications de PHP 4.3.3, voyez <a href="/ChangeLog-4.php#4.3.3">le changelog</a>, en anglais. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_4.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_4.php +++ phpweb/releases/4_3_4.php <?php // $Id: 4_3_4.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_4.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.4 Release Announcement"); ?> <h1>PHP 4.3.4 Release Announcement</h1> <p>[ <a href="/releases/4_3_4_fr.php">Version Fran&ccedil;aise</a> ]</p> <p> After a lengthy QA process, <a href="/downloads.php">PHP 4.3.4</a> is finally out!<br /> This is a medium size maintenance release, with a fair number of bug fixes. All users are encouraged to upgrade to 4.3.4. </p> <h2>Bugfix release</h2> <p> PHP 4.3.4 contains, among others, following important fixes, additions and improvements: </p> <ul> <li>Fixed disk_total_space() and disk_free_space() under FreeBSD.</li> <li>Fixed FastCGI support on Win32.</li> <li>Fixed FastCGI being unable to bind to a specific IP.</li> <li>Fixed several bugs in mail() implementation on win32.</li> <li>Fixed crashes in a number of functions.</li> <li>Fixed compile failure on MacOSX 10.3 Panther.</li> <li>Over 60 various bug fixes!</li> </ul> <p> For a full list of changes in PHP 4.3.4, see the <a href="/ChangeLog-4.php#4.3.4">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_4_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_4_fr.php +++ phpweb/releases/4_3_4_fr.php <?php // $Id: 4_3_4_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_4.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("Annonce de publication de PHP 4.3.4", array("lang" => "fr")); ?> <h1>Annonce de publication de PHP 4.3.4</h1> <p>[ <a href="/releases/4_3_4.php">English version</a> ]</p> <p> Apr&egrave;s un long processus d'assurance qualit&eacute;, <a href="/downloads.php">PHP 4.3.4</a> est d&eacute;sormais disponible!<br /> C'est une version mineure d'entretien, avec de nombreuses corrections de bogues. Tous les utilisateurs sont invit&eacute;s &agrave; passer &agrave; cette nouvelle version. </p> <h2>Version de correction de bogues</h2> <p> PHP 4.3.4 contient notamment les corrections, ajouts et am&eacute;liorations suivantes : </p> <ul> <li>Correction des fonctions disk_total_space() et disk_free_space() sous FreeBSD.</li> <li>Correction du support FastCGI pour Win32</li> <li>Correction de FastCGI qui ne pouvait pas utiliser certaines IP sp&eacute;cifiques.</li> <li>Correction de nombreux bogues de la fonction mail() sous Windows.</li> <li>Corrections de divers crash pour de nombreuses fonctions.</li> <li>Correction de probl&egrave;mes de compilation pour MacOSX 10.3 Panther.</li> <li>Plus de 60 corrections!</li> </ul> <p> Pour la liste exhaustive des modifications de PHP 4.3.4, voyez <a href="/ChangeLog-4.php#4.3.4">le changelog</a>, en anglais. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_5.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_5.php +++ phpweb/releases/4_3_5.php <?php // $Id: 4_3_5.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_5.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.5 Release Announcement"); ?> <h1>PHP 4.3.5 Release Announcement</h1> <p>[ <a href="/releases/4_3_5_fr.php">Version Fran&ccedil;aise</a> ]</p> <p> PHP Development Team is proud to announce the release of <a href="/downloads.php">PHP 4.3.5</a>. This is primarily a bug fix release, without any new features or additions. PHP 4.3.5 is by far the most stable release of PHP to date and it is recommended that all users upgrade to this release whenever possible. </p> <h2>Bugfix release</h2> <p> PHP 4.3.5 contains, among others, following important fixes, additions and improvements: </p> <ul> <li>Fixed INI leak between Apache virtual hosts.</li> <li>Fixed crashes inside fgetcsv() and make the function binary safe.</li> <li>Fixed compilation with early versions of GCC 3.0.</li> <li>Fixed a bug that prevented feof() from working correctly with sockets.</li> <li>Improved the matching algorithm inside the get_browser() function.</li> <li>Fixed resolving of open_basedir on Win32 systems.</li> <li>Fixed incorrect errors for non-existent directories when safe_mode is enabled.</li> <li>Bundled OpenSSL dlls on Win32 upgraded to 0.9.7c</li> <li>Updated bundled PostgreSQL library to version 7.4 in Windows distribution.</li> <li>Bundled PCRE library upgraded to 4.5</li> <li>Synchronized bundled GD library with GD 2.0.17</li> <li>A number of fixes for 64bit systems.</li> <li>Aside from the above mentioned fixes, this release resolves over 140 various bugs and implementational problems.</li> </ul> <p> For a full list of changes in PHP 4.3.5, see the <a href="/ChangeLog-4.php#4.3.5">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_5_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_5_fr.php +++ phpweb/releases/4_3_5_fr.php <?php // $Id: 4_3_5_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_5.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("Annonce de publication de PHP 4.3.5"); ?> <h1>Annonce de publication de PHP 4.3.5</h1> <p>[ <a href="/releases/4_3_5.php">English Version</a> ]</p> <p> L'&eacute;quipe de d&eacute;veloppement PHP a le plaisir de vous annoncer la publication de <a href="/downloads.php">PHP 4.3.5</a>. C'est une version de maintenance, destin&eacute;e &agrave; corriger des erreurs, et sans aucun ajout de fonctionnalit&eacute;. PHP 4.3.5 est, de loin, la version de PHP la plus stable, et il est recommand&eacute; &agrave; tous les utilisateurs d'adopter cette version d&egrave;s que possible. </p> <h2>Version de correction de bogues</h2> <p> PHP 4.3.5 contient notamment les corrections, ajouts et am&eacute;liorations suivantes : </p> <ul> <li>Correction d'une fuite m&eacute;moire li&eacute;e au fichier INI, sur les h&ocirc;tes virtuels Apache.</li> <li>Correction de crashs avec fgetcsv(). La fonction est d&eacute;sormais compatible avec les donn&eacute;es binaires.</li> <li>Correction de la compilation avec les premi&egrave;res versions de GCC 3.0.</li> <li>Am&eacute;lioration de l'algorithme d'analyse de la fonction get_browser().</li> <li>Correction de open_basedir sur Win32.</li> <li>Correction de messages erron&eacute;s pour les dossiers inexistants, en mode safe_mode.</li> <li>Ajout des DLL OpenSSL sur Win32, en version 0.9.7c.</li> <li>Mise &agrave; jour de la biblioth&egrave;que PostgreSQL en version 7.4 dans la distribution Windows.</li> <li>Mise &agrave; jour de la biblioth&egrave;que PCRE en version 4.5.</li> <li>Mise &agrave; jour de la biblioth&egrave;que GD en version 2.0.17.</li> <li>Corrections de bogues sur les syst&egrave;mes 64 bits.</li> <li>En plus de ces corrections, cette version inclut 140 corrections de bogues et probl&egrave;mes divers.</li> </ul> <p> Pour une liste exhaustive des modifications de PHP 4.3.5, voyez <a href="/ChangeLog-4.php#4.3.5">le changelog</a>, en anglais. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_6.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_6.php +++ phpweb/releases/4_3_6.php <?php // $Id: 4_3_6.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_6.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.6 Release Announcement"); ?> <h1>PHP 4.3.6 Release Announcement</h1> <p>[ <a href="/releases/4_3_6_fr.php">Version Fran&ccedil;aise</a> ]</p> <p> PHP Development Team is proud to announce the release of PHP <a href="/downloads.php">PHP 4.3.6</a>. This is is a bug fix release whose primary goal is to address two bugs which may result in crashes in PHP builds with thread-safety enabled. All users of PHP in a threaded environment (Windows) are strongly encouraged to upgrade to this release. </p> <h2>Bugfix release</h2> <p> Aside from the above mentioned issues this release includes the following important fixes: </p> <ul> <li>Updated bundled PDFLib library to version 5.0.3p1 in Windows distribution.</li> <li>Synchronized bundled GD library with GD 2.0.22.</li> <li>Fixed bugs that prevented building of the GD extension against the external GD library versions 1.2-1.8.</li> <li>Fixed a bugs resulting in leakage of session settings across requests.</li> <li>Fixed several daylight savings bugs inside the mktime and strtotime functions.</li> <li>Fixed a bug that prevented compilation of cURL extension against libcurl 7.11.1</li> <li>Fixed a number of crashes inside domxml and mssql extensions.</li> <li>All in all this release fixes approximately 25 bugs that have been discovered since the 4.3.5 release.</li> </ul> <p> For a full list of changes in PHP 4.3.6, see the <a href="/ChangeLog-4.php#4.3.6">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_6_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_6_fr.php +++ phpweb/releases/4_3_6_fr.php <?php // $Id: 4_3_6_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_6.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("Annonce de publication de PHP 4.3.6"); ?> <h1>Annonce de publication de PHP 4.3.6</h1> <p>[ <a href="/releases/4_3_6.php">English Version</a> ]</p> <p> L'&eacute;quipe de d&eacute;veloppement PHP a le plaisir de vous annoncer la publication de <a href="/downloads.php">PHP 4.3.6</a>. C'est une version de maintenance, destin&eacute;e &agrave; corriger deux bogues qui peuvent conduire &agrave; des crashs de PHP si la s&eacute;curit&eacute; threads est activ&eacute;e. Il est recommand&eacute; &agrave; tous les utilisateurs d'adopter cette version d&egrave;s que possible. </p> <h2>Version de correction de bogues</h2> <p> PHP 4.3.6 contient notamment les corrections, ajouts et am&eacute;liorations suivantes : </p> <ul> <li>Mise &agrave; jour de la biblioth&egrave;que PDFLib en version 5.0.3p1 pour les versions Windows.</li> <li>Mise &agrave; jour de la biblioth&egrave;que GD 2.0.22.</li> <li>Correction d'un bogue qui emp&ecirc;chait la compilation de l'extension GD avec les versions 1.2-1.8 de la librairie externe GD.</li> <li>Correction d'un bogue avec les sessions : les configurations ne se propageaient pas entre les requ&ecirc;tes.</li> <li>Correction de plusieurs bogues li&eacute;s au changement d'heure d'hiver et d'&eacute;t&eacute; dans les fonctions mktime et strtotime.</li> <li>Correction d'un bogue qui emp&ecirc;chait la compilation de l'extension cURL avec libcurl 7.11.1</li> <li>Correction de plusieurs crashs avec les extensions domxml et mssql.</li> <li>Cette version corrige environ 25 bogues qui ont &eacute;t&eacute; d&eacute;couverts depuis la version 4.3.5.</li> </ul> <p> Pour une liste exhaustive des modifications de PHP 4.3.6, voyez <a href="/ChangeLog-4.php#4.3.6">le changelog</a>, en anglais. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_7.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_7.php +++ phpweb/releases/4_3_7.php <?php // $Id: 4_3_7.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_7.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.7 Release Announcement"); ?> <h1>PHP 4.3.7 Release Announcement</h1> <p>[ <a href="/releases/4_3_7_fr.php">Version Fran&ccedil;aise</a> ]</p> <p> PHP Development Team is proud to announce the release of PHP <a href="/downloads.php">PHP 4.3.7</a>. This is a maintenance release that in addition to several non-critical bug fixes, addresses an input validation vulnerability in escapeshellcmd() and escapeshellarg() functions on the Windows platform. Users of PHP on Windows are encouraged to upgrade to this release as soon as possible. </p> <h2>Bugfix release</h2> <p> Aside from the above mentioned issues this release includes the following important fixes: </p> <ul> <li>Synchronized bundled GD library with GD 2.0.23.</li> <li>Fixed a bug that prevented compilation of GD extensions against FreeType 2.1.0-2.1.2.</li> <li>Fixed thread safety issue with informix connection id.</li> <li>Fixed incorrect resolving of relative paths by glob() in windows.</li> <li>Fixed mapping of Greek letters to html entities.</li> <li>Fixed a bug that caused an on shutdown crash when using PHP with Apache 2.0.49.</li> <li>Fixed a number of crashes inside pgsql, cpdf and gd extensions.</li> <li>All in all this release fixes over 30 bugs that have been discovered and resolved since the 4.3.6 release.</li> </ul> <p> For a full list of changes in PHP 4.3.7, see the <a href="/ChangeLog-4.php#4.3.7">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_7_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_7_fr.php +++ phpweb/releases/4_3_7_fr.php <?php // $Id: 4_3_7_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_7.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("Annonce de publication de PHP 4.3.7"); ?> <h1>Annonce de publication de PHP 4.3.7</h1> <p>[ <a href="/releases/4_3_7.php">English Version</a> ]</p> <p> L'&eacute;quipe de d&eacute;veloppement PHP a le plaisir de vous annoncer la publication de <a href="/downloads.php">PHP 4.3.7</a>. C'est une version de maintenance, destin&eacute;e &agrave; corriger des bogues non-critiques, corriger une vuln&eacute;rabilit&eacute; de validation dans les fonctions escapeshellcmd() et escapeshellarg() sur la plate-forme Windows. Les utilisateurs de PHP sont encourag&eacute;s à changer de version aussit&ocirc;t que possible. </p> <h2>Version de correction de bogues</h2> <p> PHP 4.3.7 contient notamment les corrections, ajouts et am&eacute;liorations suivantes : </p> <ul> <li>La biblioth&eacute;que GD est maintenant en version 2.0.23.</li> <li>Correction d'un bogue qui emp&ecirc;chait la compilation de GD avec FreeType 2.1.0-2.1.2.</li> <li>Correction d'un probl&eacute;me de s&eacute;curit&eacute; thread avec l'identifiant de connexion informix.</li> <li>Correction de la r&eacute;solution de chemin relatifs avec glob() sous Windows.</li> <li>Correction des entit&eacute;s HTML pour les caract&eacute;res grecs.</li> <li>Correction d'un bug qui causait un crash avec Apache 2.0.49.</li> <li>Correction de nombreux crashs avec PostGreSQL, CPDF et GD.</li> <li>Cette version corrige environ 30 bogues qui ont &eacute;t&eacute; d&eacute;couverts depuis la version 4.3.6.</li> </ul> <p> Pour une liste exhaustive des modifications de PHP 4.3.7, voyez <a href="/ChangeLog-4.php#4.3.7">le changelog</a>, en anglais. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_8.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_8.php +++ phpweb/releases/4_3_8.php <?php // $Id: 4_3_8.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_8.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.8 Release Announcement"); ?> <h1>PHP 4.3.8 Release Announcement</h1> <!-- <p>[ <a href="/releases/4_3_8_fr.php">Version Fran&ccedil;aise</a> ]</p> --> <p> PHP Development Team is would like to announce the immediate availability of <a href="/downloads.php">PHP 4.3.8</a>. This release is made in response to several security issues that have been discovered since the 4.3.7 release. All users of PHP are strongly encouraged to upgrade to PHP 4.3.8 as soon as possible. </p> <h2>Security Fixes release</h2> <p> This release addresses several important security issues. </p> <p> For a full list of changes in PHP 4.3.8, see the <a href="/ChangeLog-4.php#4.3.8">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_9.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_9.php +++ phpweb/releases/4_3_9.php <?php // $Id: 4_3_9.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_9.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.9 Release Announcement"); ?> <h1>PHP 4.3.9 Release Announcement</h1> <p>[ <a href="/releases/4_3_9_fr.php">Version Fran&ccedil;aise</a> ]</p> <p> PHP Development Team is proud to announce the immediate release of PHP <a href="/downloads.php">PHP 4.3.9</a>. This is a maintenance release that in addition to over 50 non-critical bug fixes, addresses a problem with GPC input processing. This release also re-introduces ability to write GIF images via the bundled GD extension. All Users of PHP are encouraged to upgrade to this release as soon as possible. </p> <h2>Bugfix release</h2> <p> Aside from the above mentioned issues this release includes the following important fixes: </p> <ul> <li>Implemented periodic PCRE compiled regexp cache cleanup, to avoid memory exhaustion</li> <li>Fixed strip_tags() to correctly handle '\0' characters.</li> <li>Rewritten UNIX and Windows install help files.</li> <li>Fixed a file-descriptor leak with phpinfo() and other 'special' URLs.</li> <li>Fixed possible crash inside php_shutdown_config().</li> <li>Fixed isset crashes on arrays.</li> <li>Fixed imagecreatefromstring() crashes with external GD library.</li> <li>Fixed fgetcsv() parsing of strings ending with escaped enclosures.</li> <li>Fixed overflow in array_slice(), array_splice(), substr(), substr_replace(), strspn(), strcspn().</li> <li>Fixed '\0' in Authenticate header passed via safe_mode.</li> <li>Allow bundled GD to compile against freetype 2.1.2.</li> <li>All in all this release fixes over 50 bugs that have been discovered and resolved since the 4.3.8 release.</li> </ul> <p> For a full list of changes in PHP 4.3.9, see the <a href="/ChangeLog-4.php#4.3.9">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_3_9_fr.php?view=markup&rev=1.1 Index: phpweb/releases/4_3_9_fr.php +++ phpweb/releases/4_3_9_fr.php <?php // $Id: 4_3_9_fr.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_3_9.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.3.9 Release Announcement"); ?> <h1>Annonce de publication de PHP 4.3.9</h1> <p>[ <a href="/releases/4_3_9.php">English Version</a> ]</p> <p> L'&eacute;quipe de d&eacute;veloppement PHP a le plaisir de vous annoncer la publication de <a href="/downloads.php">PHP 4.3.9</a>. C'est une version de maintenance, destin&eacute;e &agrave; corriger une cinquantaine de bogues non-critiques, et corriger le traitement des valeurs GPC. Cette version inclut aussi la possibilité d'écrire des images GIF via la bibliothèque GD interne. Tous les utilisateurs sont encouragés à utiliser cette version. </p> <h2>Version de correction de bogues</h2> <p> En plus des fonctionnalités ci-dessus, PHP 4.3.9 contient notamment les corrections, ajouts et am&eacute;liorations suivantes : </p> <ul> <li>Implementation d'un nettoyage périodique du cache de regex PCRE, pour éviter les problèmes de mémoire.</li> <li>Correction de strip_tags() pour gérer correctement le caractère '\0'.</li> <li>Réécriture des fichiers d'installation sous UNIX et Windows.</li> <li>Correction d'une fuite mémoire avec phpinfo() et d'autres URL spéciales.</li> <li>Correction d'un crash possible avec php_shutdown_config().</li> <li>Correction d'un crash avec isset() sur les tableaux.</li> <li>Correction d'un crash avec imagecreatefromstring() et la bibliothèque interne GD.</li> <li>Correction de fgetcsv(), lors de l'analyse de chaînes avec des séquences protégées.</li> <li>Correction d'un dépassement de capacité avec array_slice(), array_splice(), substr(), substr_replace(), strspn(), strcspn().</li> <li>Correction de '\0' dans l'entête Authenticate, passé via le safe_mode.</li> <li>Compilation de la GD interne avec freetype 2.1.2.</li> <li>Cette version corrige environ 50 bogues qui ont &eacute;t&eacute; d&eacute;couverts depuis la version 4.3.8.</li> </ul> <p> Pour une liste exhaustive des modifications de PHP 4.3.9, voyez <a href="/ChangeLog-4.php#4.3.9">le ChangeLog</a>, en anglais. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_4_0.php?view=markup&rev=1.1 Index: phpweb/releases/4_4_0.php +++ phpweb/releases/4_4_0.php <?php // $Id: 4_4_0.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_4_0.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.4.0 Release Announcement"); ?> <h1>PHP 4.4. Release Announcement</h1> <p> The PHP Development Team would like to announce the immediate release of <a href="/downloads.php">PHP 4.4.0</a>. </p> <p> This is a maintenance release that addresses a serious memory corruption problem within PHP concerning references. If references were used in a wrong way, PHP would often create memory corruptions which would not always surface or be visible. In other cases it could cause variables and objects to change type or class unexpectedly. If you encountered strange behavior like this, this release might fix it. The increased middle digit was required because the fix that corrected the problem with references changed PHP's internal API, breaking binary compatibility with the PHP 4.3.* series. This means that all binary extension modules need to be recompiled in order to work with this release. </p> <p> As part of the solution for the reference bug, you are very likely to find that your own or third-party PHP scripts, considered 'clean' code under previous versions of PHP, will now throw an E_NOTICE when references are incorrectly used in the script. This is intended to alert developers to minor errors in their approach, and does not affect the script's performance in any other way. </p> <p> Besides the reference problem, this release also fixes numerous other bugs, including a small security problem with our bundled shtool. </p> <h2>Bugfix release</h2> <ul> <li>Memory corruptions with references.</li> <li>Small security problem with bundled shtool.</li> </ul> <p> For a full list of changes in PHP 4.4.0, see the <a href="/ChangeLog-4.php#4.4.0">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_4_1.php?view=markup&rev=1.1 Index: phpweb/releases/4_4_1.php +++ phpweb/releases/4_4_1.php <?php // $Id: 4_4_1.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_4_1.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.4.1 Release Announcement"); ?> <h1>PHP 4.4.1. Release Announcement</h1> <p> The PHP Development Team would like to announce the immediate release of <a href="/downloads.php">PHP 4.4.1</a>. </p> <p> This is a bug fix release, which addresses some security problems too. The security issues that this release fixes are: <ul> <li>Fixed a Cross Site Scripting (<a href='http://www.cgisecurity.com/articles/xss-faq.shtml'>XSS</a>) vulnerability in <a href='http://php.net/phpinfo'>phpinfo</a>() that could lead f.e. to cookie exposure, when a phpinfo() script is accidently left on a production server.</li> <li>Fixed multiple safe_mode/open_basedir bypass vulnerabilities in ext/curl and ext/gd that could lead to exposure of files normally not accessible due to safe_mode or open_basedir restrictions.</li> <li>Fixed a possible $GLOBALS overwrite problem in file upload handling, extract() and import_request_variables() that could lead to unexpected security holes in scripts assumed secure. (For more information, see <a href='http://www.hardened-php.net/globals-problem'>here</a>).</li> <li>Fixed a problem when a request was terminated due to memory_limit constraints during certain <a href='http://php.net/parse_str'>parse_str</a>() calls. In some cases this can result in register_globals being turned on.</li> <li>Fixed an issue with trailing slashes in allowed basedirs. They were ignored by open_basedir checks, so that specified basedirs were handled as prefixes and not as full directory names.</li> <li>Fixed an issue with calling <a href='http://php.net/virtual'>virtual</a>() on Apache 2. This allowed bypassing of certain configuration directives like safe_mode or open_basedir.</li> <li>Updated to the latest pcrelib to fix a possible integer overflow vulnerability announced in <a href='http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491'>CAN-2005-2491</a>.</li> </ul> </p> <p> This release also fixes 35 other defects, where the most important is the the fix that removes a notice when passing a by-reference result of a function as a by-reference value to another function. (Bug #<a href='http://bugs.php.net/33558'>33558</a>). </p> <p> For a full list of changes in PHP 4.4.1, see the <a href="/ChangeLog-4.php#4.4.1">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_4_2.php?view=markup&rev=1.1 Index: phpweb/releases/4_4_2.php +++ phpweb/releases/4_4_2.php <?php // $Id: 4_4_2.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_4_1.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.4.2 Release Announcement"); ?> <h1>PHP 4.4.2. Release Announcement</h1> <p> The PHP Development Team would like to announce the immediate release of <a href="/downloads.php">PHP 4.4.2</a>. </p> <p> This is a bug fix release, which addresses some security problems too. The major points that this release corrects are: <ul> <li>Prevent header injection by limiting each header to a single line.</li> <li>Possible XSS inside error reporting functionality.</li> <li>Missing safe_mode/open_basedir checks into cURL extension.</li> <li>Apache 2 regression with sub-request handling on non-Linux systems.</li> <li>key() and current() regression related to references.</li> </ul> </p> <p> This release also fixes about 30 other defects. </p> <p> For a full list of changes in PHP 4.4.2, see the <a href="/ChangeLog-4.php#4.4.2">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_4_3.php?view=markup&rev=1.1 Index: phpweb/releases/4_4_3.php +++ phpweb/releases/4_4_3.php <?php // $Id: 4_4_3.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_4_3.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.4.3 Release Announcement"); ?> <h1>PHP 4.4.3. Release Announcement</h1> <p> The PHP development team is proud to announce the release of <a href="/downloads.php#v4">PHP 4.4.3</a>. This release combines small number of bug fixes and resolves a number of security issues. All PHP 4.x users are encouraged to upgrade to this release as soon as possible. </p> <p> The security issues resolved include the following: <ul> <li>Disallow certain characters in session names.</li> <li>Fixed a buffer overflow inside the wordwrap() function.</li> <li>Prevent jumps to parent directory via the 2nd parameter of the tempnam() function.</li> <li>Improved safe_mode check for the error_log() function.</li> <li>Fixed cross-site scripting inside the phpinfo() function.</li> </ul> </p> <p> The release also includes about 20 bug fixes and an upgraded PCRE library (version 6.6). </p> <p> For a full list of changes in PHP 4.4.3, see the <a href="/ChangeLog-4.php#4.4.3">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/4_4_4.php?view=markup&rev=1.1 Index: phpweb/releases/4_4_4.php +++ phpweb/releases/4_4_4.php <?php // $Id: 4_4_4.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/4_4_4.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 4.4.4 Release Announcement"); ?> <h1>PHP 4.4.4 Release Announcement</h1> <p> This release address a series of locally exploitable security problems discovered since PHP 4.4.3. All PHP users are encouraged to upgrade to this release as soon as possible. </p> <p> This release provides the following security fixes: <ul> <li>Added missing safe_mode/open_basedir checks inside the error_log(), file_exists(), imap_open() and imap_reopen() functions.</li> <li>Fixed overflows inside str_repeat() and wordwrap() functions on 64bit systems.</li> <li>Fixed possible open_basedir/safe_mode bypass in cURL extension.</li> <li>Fixed overflow in GD extension on invalid GIF images.</li> <li>Fixed a buffer overflow inside sscanf() function.</li> <li>Fixed memory_limit restriction on 64 bit system.</li> </ul> </p> <p> In addition to the security fixes, both releases include a small number of non-security related bug fixes. </p> <p> For a full list of changes in PHP 4.4.4, see the <a href="/ChangeLog-4.php#4.4.4">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/5_1_0.php?view=markup&rev=1.1 Index: phpweb/releases/5_1_0.php +++ phpweb/releases/5_1_0.php <?php // $Id: 5_1_0.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/5_1_0.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5.1.0 Release Announcement"); ?> <h1>PHP 5.1.0. Release Announcement</h1> <p> The PHP development team is proud to announce the release of PHP <a href="/downloads.php">PHP 5.1.0</a>.<br /> Some of the key features of PHP <a href="/downloads.php">PHP 5.1.0</a> include: </p> <p> <ul> <li>A complete rewrite of date handling code, with improved timezone support.</li> <li>Significant performance improvements compared to PHP 5.0.X.</li> <li>PDO extension is now enabled by default.</li> <li>Over 30 new functions in various extensions and built-in functionality.</li> <li>Bundled libraries, PCRE and SQLite upgraded to latest versions.</li> <li>Over 400 various bug fixes.</li> <li>PEAR upgraded to version 1.4.5</li> </ul> </p> <p> For a full list of changes in PHP 5.1.0, see the <a href="/ChangeLog-5.php#5.1.0">ChangeLog</a>. </p> <p> In addition to new features, this release includes a number of important security fixes: <ul> <li>Fixed a Cross Site Scripting (<a href='http://www.cgisecurity.com/articles/xss-faq.shtml'>XSS</a>) vulnerability in <a href='http://php.net/phpinfo'>phpinfo</a>() that could lead f.e. to cookie exposure, when a phpinfo() script is accidently left on a production server.</li> <li>Fixed multiple safe_mode/open_basedir bypass vulnerabilities in ext/curl and ext/gd that could lead to exposure of files normally not accessible due to safe_mode or open_basedir restrictions.</li> <li>Fixed a possible $GLOBALS overwrite problem in file upload handling, extract() and import_request_variables() that could lead to unexpected security holes in scripts assumed secure. (For more information, see <a href='http://www.hardened-php.net/globals-problem'>here</a>).</li> <li>Fixed a problem when a request was terminated due to memory_limit constraints during certain <a href='http://php.net/parse_str'>parse_str</a>() calls. In some cases this can result in register_globals being turned on.</li> <li>Fixed an issue with trailing slashes in allowed basedirs. They were ignored by open_basedir checks, so that specified basedirs were handled as prefixes and not as full directory names.</li> <li>Fixed an issue with calling <a href='http://php.net/virtual'>virtual</a>() on Apache 2. This allowed bypassing of certain configuration directives like safe_mode or open_basedir.</li> <li>Updated to the latest pcrelib to fix a possible integer overflow vulnerability announced in <a href='http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491'>CAN-2005-2491</a>.</li> <li>Possible header injection in mb_send_mail() function via the &quot;To&quot; address, the first parameter of the function.</li> </ul> </p> <p> All users of PHP 5.0 and early adopters of 5.1 betas are strongly advised to upgrade to 5.1 as soon as possible. Furthermore, 5.1 branch obsoletes the 5.0 PHP branch. </p> <p><a href="README_UPGRADE_51.php">Upgrading Guide</a> is available to ease the transition from prior PHP versions.</p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/5_1_1.php?view=markup&rev=1.1 Index: phpweb/releases/5_1_1.php +++ phpweb/releases/5_1_1.php <?php // $Id: 5_1_1.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/5_1_1.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5.1.1 Release Announcement"); ?> <h1>PHP 5.1.1. Release Announcement</h1> <p> The PHP Development Team would like to announce the immediate release of <a href="/downloads.php">PHP 5.1.1</a>. </p> <p> This is a regression correction release aimed at addressing several issues that may cause issues for certain applications. The main fixes found in this release include the following: <ul> <li>Native date class is withdrawn to prevent namespace conflict with PEAR's date package.</li> <li>Fixed fatal parse error when the last line of the script is a PHP comment.</li> <li>eval() hangs when the code being evaluated ends with a comment.</li> <li>Usage of \{$var} in PHP 5.1.0 resulted in the output of {$var} instead of the $var variable's value enclosed in {}.</li> <li>Fixed inconsistency in the format of PHP_AUTH_DIGEST between Apache 1 and 2 sapis.</li> <li>Improved safe_mode/open_basedir checks inside the cURL extension.</li> </ul> </p> <p> For a full list of changes in PHP 5.1.1, see the <a href="/ChangeLog-5.php#5.1.1">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/5_1_2.php?view=markup&rev=1.1 Index: phpweb/releases/5_1_2.php +++ phpweb/releases/5_1_2.php <?php // $Id: 5_1_2.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/5_1_2.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5.1.2 Release Announcement"); ?> <h1>PHP 5.1.2. Release Announcement</h1> <p> The PHP development team is proud to announce the release of <a href="/downloads.php">PHP 5.1.2</a>. This release combines small feature enhancements with a fair number of bug fixes and addresses three security issues. All PHP 5 users are encouraged to upgrade to this release. </p> <p> The security issues resolved include the following: <ul> <li>HTTP Response Splitting has been addressed in ext/session and in the header() function. Header() can no longer be used to send multiple response headers in a single call. </li> <li>Format string vulnerability in ext/mysqli.</li> <li>Possible cross-site scripting problems in certain error conditions.</li> </ul> </p> <p> The feature enhancements include the following notables: <ul> <li>Hash extension was added to core and is now enabled by default. This extension provides support for most common hashing algorithms without reliance on 3rd party libraries.</li> <li>XMLWriter was added and enabled by default.</li> <li>New OCI8 extension that includes numerous fixes.</li> <li>PNG compression support added to the GD extension.</li> <li>Added --enable-gcov configure option to enable C-level code coverage.</li> <li>getNamespaces() and getDocNamespaces() methods added to SimpleXML extension.</li> </ul> </p> <p> The release also includes over 85 bug fixes with a focus on: <ul> <li>Correction of the many regressions in the strtotime() function.</li> <li>Fixes of several crashes, leaks and memory corruptions found in the imap, pdo, gd, mysqli, mcrypt and soap extensions.</li> <li>Corrected problems with the usage of SSI and virtual() in the Apache2 SAPI.</li> <li>Build fixes for iconv and sybase_ct extensions.</li> <li>Fixed the previously broken Sun(rise|set) functions.</li> <li>SQLite libraries upgraded to 2.8.17 and 3.2.8 <li>Win32 binaries now include libxml2-2.6.22 and libxslt-1.1.15.</li> </ul> </p> <p> For a full list of changes in PHP 5.1.2, see the <a href="/ChangeLog-5.php#5.1.2">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/5_1_3.php?view=markup&rev=1.1 Index: phpweb/releases/5_1_3.php +++ phpweb/releases/5_1_3.php <?php // $Id: 5_1_3.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/5_1_3.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5.1.3 Release Announcement"); ?> <h1>PHP 5.1.3. Release Announcement</h1> <p> The PHP development team is proud to announce the release of <a href="/downloads.php">PHP 5.1.3</a>. This release combines small number of feature enhancements with a significant amount of bug fixes and resolves a number of security issues. All PHP users are encouraged to upgrade to this release as soon as possible. </p> <p> The security issues resolved include the following: <ul> <li>Disallow certain characters in session names.</li> <li>Fixed a buffer overflow inside the wordwrap() function.</li> <li>Prevent jumps to parent directory via the 2nd parameter of the tempnam() function.</li> <li>Enforce safe_mode for the source parameter of the copy() function.</li> <li>Fixed cross-site scripting inside the phpinfo() function.</li> <li>Fixed offset/length parameter validation inside the substr_compare() function.</li> <li>Fixed a heap corruption inside the session extension.</li> <li>Fixed a bug that would allow variable to survive unset().</li> </ul> </p> <p> The feature enhancements include the following notables: <ul> <li>The use of the var keyword to declare properties no longer raises a deprecation E_STRICT.</li> <li>FastCGI interface was completely reimplemented.</li> <li>Multitude of improvements to the SPL, SimpleXML, GD, CURL and Reflection extensions.</li> <li>Support for many additional date formats added to the strtotime() function.</li> <li>A number of performance improvements added to the engine and the core extensions.</li> <li>Added imap_savebody() that allows message body to be written to a file.</li> <li>Added lchown() and lchgrp() to change user/group ownership of symlinks.</li> <li>Upgraded bundled PCRE library to version 6.6</li> </ul> </p> <p> The release also includes over 120 bug fixes with a focus on: <ul> <li>Make auto_globals_jit work without too many INI changes.</li> <li>Fixed tiger hash algorithm generating wrong results on big endian platforms.</li> <li>Fixed a number of errors in the SOAP extension.</li> <li>Fixed recursion handling in the serialize() functionality.</li> <li>Make is_*() function account of open_basedir restrictions.</li> <li>Fixed a number of crashes in the DOM and PDO extensions.</li> <li>Addressed a number of regressions in the strtotime() function.</li> <li>Make memory_limit work in Win32 systems.</li> <li>Fixed a deadlock in the sqlite extension caused by the sqlite_fetch_column_types() function.</li> <li>Fixed memory leaks in the realpath() cache.</li> </ul> </p> <p> For a full list of changes in PHP 5.1.3, see the <a href="/ChangeLog-5.php#5.1.3">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/5_1_4.php?view=markup&rev=1.1 Index: phpweb/releases/5_1_4.php +++ phpweb/releases/5_1_4.php <?php // $Id: 5_1_4.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/5_1_4.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5.1.4 Release Announcement"); ?> <h1>PHP 5.1.4 Release Announcement</h1> <p> A critical bug with file uploads as well as the fastcgi sapi has been discovered in PHP 5.1.3 and a new PHP release 5.1.4 has been made available to address these two issues. All PHP users are encouraged to upgrade to this release as soon as possible. </p> <p> This release provides fixes for the following bugs: <ul> <li>Fixed problems with file uploads and the $_POST array handling.</li> <li>Resolved multiple problems with the FastCGI sapi.</li> <li>Fixed possible crash in highlight_string().</li> <li>Fixed cloning of DOM Documents and Noded.</li> <li>Several fixes to PDO ODBC driver.</li> </ul> </p> <p> For a full list of changes in PHP 5.1.4, see the <a href="/ChangeLog-5.php#5.1.4">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/5_1_5.php?view=markup&rev=1.1 Index: phpweb/releases/5_1_5.php +++ phpweb/releases/5_1_5.php <?php // $Id: 5_1_5.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/5_1_5.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5.1.5 Release Announcement"); ?> <h1>PHP 5.1.5 Release Announcement</h1> <p> This release address a series of locally exploitable security problems discovered since PHP 5.1.4. All PHP users are encouraged to upgrade to this release as soon as possible. </p> <p> This release provides the following security fixes: <ul> <li>Added missing safe_mode/open_basedir checks inside the error_log(), file_exists(), imap_open() and imap_reopen() functions.</li> <li>Fixed overflows inside str_repeat() and wordwrap() functions on 64bit systems.</li> <li>Fixed possible open_basedir/safe_mode bypass in cURL extension and with realpath cache.</li> <li>Fixed overflow in GD extension on invalid GIF images.</li> <li>Fixed a buffer overflow inside sscanf() function.</li> <li>Fixed an out of bounds read inside stripos() function.</li> <li>Fixed memory_limit restriction on 64 bit system.</li> </ul> </p> <p> In addition to the security fixes, both releases include a small number of non-security related bug fixes. </p> <p> For a full list of changes in PHP 5.1.5, see the <a href="/ChangeLog-5.php#5.1.5">ChangeLog</a>. </p> <?php site_footer(); ?> http://cvs.php.net/viewvc.cgi/phpweb/releases/5_1_6.php?view=markup&rev=1.1 Index: phpweb/releases/5_1_6.php +++ phpweb/releases/5_1_6.php <?php // $Id: 5_1_6.php,v 1.1 2006/09/20 18:43:55 goba Exp $ $_SERVER['BASE_PAGE'] = 'releases/5_1_6.php'; include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; site_header("PHP 5.1.6 Release Announcement"); ?> <h1>PHP 5.1.6 Release Announcement</h1> <p> This release is a re-release of PHP 5.1.5, which was missing the fix for memory_limit restriction on 64 bit systems. If you rely on this functionality and use 64bit machines, you are advised to upgrade. </p> <p> For a full list of changes in PHP 5.1.6, see the <a href="/ChangeLog-5.php#5.1.6">ChangeLog</a>. </p> <?php site_footer(); ?>