Fix phpGH-10648: add check function pointer into mbfl_encoding

Previously, mbstring used the same logic for encoding validation as for
encoding conversion.

However, there are ca

Fix phpGH-10648: add check function pointer into mbfl_encoding

Previously, mbstring used the same logic for encoding validation as for
encoding conversion.

However, there are cases where we want to use different logic for validation
and conversion. For example, if a string ends up with missing input
required by the encoding, or if a character is input that is invalid
as an encoding but can be converted, the conversion should succeed and
the validation should fail.

To achieve this, a function pointer mb_check_fn has been added to
struct mbfl_encoding to implement the logic used for validation.
Also, added implementation of validation logic for UTF-7, UTF7-IMAP,
ISO-2022-JP and JIS.

(The same change has already been made to PHP 8.2 and 8.3; see
6fc8d014df. This commit is backporting the change to PHP 8.1.)

show more ...

add note in UPGRADING

Update Unicode tables to 14.0.0

Closes GH-7502.

typo

Fixed typo

Add UPGRADING for ini parser changes

Missed the "git add" once again...

[ci skip]

Switch default PKCS7/CMS cipher to AES-128-CBC

Switch default cipher for openssl_pkcs7_encrypt() and
openssl_cms_encrypt() from RC2-40 to AES-128-CBC.

The RC2-40 cipher is consi

Switch default PKCS7/CMS cipher to AES-128-CBC

Switch default cipher for openssl_pkcs7_encrypt() and
openssl_cms_encrypt() from RC2-40 to AES-128-CBC.

The RC2-40 cipher is considered insecure and is not loaded by
default in OpenSSL 3, which means that these functions will
always fail with default arguments.

As the used algorithm is embedded in the result (which makes this
different from the openssl_encrypt() case) changing the default
algorithm should be safe.

Closes GH-7357.

show more ...

Lossless conversion for webp

Propagating lossless conversion from libgd to our bundled gd.
Changing "quantization" to "quality" as in libgd.
Adding test.

IMG_WEBP_LOSSLESS i

Lossless conversion for webp

Propagating lossless conversion from libgd to our bundled gd.
Changing "quantization" to "quality" as in libgd.
Adding test.

IMG_WEBP_LOSSLESS is only defined, if lossless WebP encoding is
supported by the libgd used.

Closes GH-7348.

show more ...

NEWS

NEWS

Do not special case export of EC keys

All other private keys are exported in PKCS#8 format, while EC
keys use traditional format. Switch them to use PKCS#8 format as
well.

A

Do not special case export of EC keys

All other private keys are exported in PKCS#8 format, while EC
keys use traditional format. Switch them to use PKCS#8 format as
well.

As the OpenSSL docs say:

> PEM_write_bio_PrivateKey_traditional() writes out a private key
> in the "traditional" format with a simple private key marker and
> should only be used for compatibility with legacy programs.

show more ...

[ci skip] UPGRADING: oci8.old_oci_close_semantics has been deprecated

Implement readonly properties

Add support for readonly properties, for which only a single
initializing assignment from the declaring scope is allowed.

RFC: https://wiki.php.net

Implement readonly properties

Add support for readonly properties, for which only a single
initializing assignment from the declaring scope is allowed.

RFC: https://wiki.php.net/rfc/readonly_properties_v2

Closes GH-7089.

show more ...

Deprecate autovivification on false

Deprecate automatically converting "false" into an empty array
on write operands. Autovivification continues to be supported
for "null" values, as

Deprecate autovivification on false

Deprecate automatically converting "false" into an empty array
on write operands. Autovivification continues to be supported
for "null" values, as well as undefined/uninitialized values.

RFC: https://wiki.php.net/rfc/autovivification_false

Closes GH-7131.

Co-authored-by: Tyson Andre <tysonandre775@hotmail.com>
Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>

show more ...

[skip-ci] Fixup UPGRADING documents

Some entries were in the wrong section/wrong document.

Don't return bool from Phar::offsetUnset()

This violates the ArrayAccess interface. Use offsetExists() to
check if an entry exists.

Add UPGRADING entry for socket options

[ci skip]

Make syslog() binary safe

Closes GH-7245

Co-authored-by: Nikita Popov <nikita.ppv@googlemail.com>

Allow objects in define()

This was separately discussed in https://externals.io/message/114863,
but also necessary for consistency now that
https://wiki.php.net/rfc/new_in_initialize

Allow objects in define()

This was separately discussed in https://externals.io/message/114863,
but also necessary for consistency now that
https://wiki.php.net/rfc/new_in_initializers has landed.

Closes GH-7149.

show more ...

Add first-class callables

Support acquiring a Closure to a callable using the syntax
func(...), $obj->method(...), etc. This is essentially a
shortcut for Closure::fromCallable().

Add first-class callables

Support acquiring a Closure to a callable using the syntax
func(...), $obj->method(...), etc. This is essentially a
shortcut for Closure::fromCallable().

RFC: https://wiki.php.net/rfc/first_class_callable_syntax

Closes GH-7019.

Co-Authored-By: Nikita Popov <nikita.ppv@gmail.com>

show more ...

Deprecate $num_points parameter of image(open|filled)polygon

Cf. <https://wiki.php.net/rfc/deprecations_php_8_1#num_points_parameter_of_image_open_filled_polygon>.

Co-authored-by: M

Deprecate $num_points parameter of image(open|filled)polygon

Cf. <https://wiki.php.net/rfc/deprecations_php_8_1#num_points_parameter_of_image_open_filled_polygon>.

Co-authored-by: Máté Kocsis <kocsismate@woohoolabs.com>
Co-authored-by: George Peter Banyard <7906688+Girgias@users.noreply.github.com>

Closes GH-6789.

show more ...

Deprecate strftime() and gmstrftime()

These are deprecated in favor of date()/DateTime::format() (for
locale-indendent formatting) and IntlDateFormatter::format()
(for locale-depende

Deprecate strftime() and gmstrftime()

These are deprecated in favor of date()/DateTime::format() (for
locale-indendent formatting) and IntlDateFormatter::format()
(for locale-dependent formatting).

Part of https://wiki.php.net/rfc/deprecations_php_8_1.

show more ...

Deprecate SoapClient ssl_method option

Instead use ssl stream context options instead. The direct
equivalent would be crypto_method, but min_proto_version /
max_proto_version are rec

Deprecate SoapClient ssl_method option

Instead use ssl stream context options instead. The direct
equivalent would be crypto_method, but min_proto_version /
max_proto_version are recommended instead.

Part of https://wiki.php.net/rfc/deprecations_php_8_1.

show more ...

Add limited support for new in initializers

Add support for new expressions inside parameter default values,
static variable initializers, global constant initializers and
attribute

Add limited support for new in initializers

Add support for new expressions inside parameter default values,
static variable initializers, global constant initializers and
attribute arguments.

RFC: https://wiki.php.net/rfc/new_in_initializers

Closes GH-7153.

show more ...

Deprecate filter.default

There's a subtlety here regarding filter.default_flags. The RFC
stated that no separate deprecation warning will be emitted for
it, on the premise that it is

Deprecate filter.default

There's a subtlety here regarding filter.default_flags. The RFC
stated that no separate deprecation warning will be emitted for
it, on the premise that it is only meaningful if filter.default
is set. However, it turns out that even FILTER_UNSAFE_RAW (which
is the "no-op filter") can be combined with stripping flags.
However, this is compensated by the fact that this doesn't actually
work when setting filter.default=unsafe_raw and non-default
filter.default_flags -- the flags are simply ignored in that case.
So everything works out in the end.

Part of https://wiki.php.net/rfc/deprecations_php_8_1.

show more ...