o Fixed Bug #12121: chdir and safe_mode
- [ main/safe_mode.h ] added new checkuid mode:
CHECKUID_ALLOW_ONLY_FILE: skips directory check if file check
fails

- [ ex

o Fixed Bug #12121: chdir and safe_mode
- [ main/safe_mode.h ] added new checkuid mode:
CHECKUID_ALLOW_ONLY_FILE: skips directory check if file check
fails

- [ ext/standard/dir.c ] changed php_checkuid() to use
CHECKUID_ALLOW_ONLY_FILE instead of CHECKUID_ALLOW_ONLY_DIR

- [ main/safe_mode.c ] added code for new checkuid mode

o Fixed Bug #12119: safe mode owner check can be bypassed with symlink
- [ main/safe_mode.c ] use VCWD_REALPATH to resolve destination
of symlink before trimming filename

o New Feature: safe_mode_include_dir (php.ini directive)
- Allows bypassing UID/GID checks when including files
from the directory in safe_mode_include_dir and its
subdirectories. (safe_mode must be on, directory must
also be in include_path or full path must be used when
including)

o Fixed Feature: safe_mode_gid (php.ini directive)
- Correctly check (and report) UID/GID bits on directories

o Changed include() fall back to scripts cwd implementation
- CWD added to the (local) search path in php_fopen_with_path()
instead of seperate case. [ main/fopen_wrappers.c ]

show more ...

Fix xmlrpc_error:number handling

Allow errors to be returned as XMLRPC fault packets.

Submitted by: Matt Allen <matt@investigationmarketplace.com>

Add getmygid() and safe_mode_gid ini directive to allow safe mode to do
a gid check instead of a uid check.
@ - Add getmygid() and safe_mode_gid ini directive to allow safe mode to do
@ a

Add getmygid() and safe_mode_gid ini directive to allow safe mode to do
a gid check instead of a uid check.
@ - Add getmygid() and safe_mode_gid ini directive to allow safe mode to do
@ a gid check instead of a uid check. (James E. Flemer, Rasmus)

show more ...

Added new configuration directives:
arg_separator.input and arg_separator.output

- Fix copyright notices with 2001

- Remove the ini_extension_list global
- Switch to delayed loading of Zend extensions

Defer loading of extensions until all configuration entries have been
added to the configuration hash.

- Import Jade Nicoletti's transparent gzip encoding support as an output
handler. Works quite nicely!
- Fix buglets in output buffering
- Add output_handler INI directive

fopen wrappers cleanup
- comfiguration is now done by an ini parameter
instead of a compile time option
- the implementations of the three standard wrappers
now live in se

fopen wrappers cleanup
- comfiguration is now done by an ini parameter
instead of a compile time option
- the implementations of the three standard wrappers
now live in seperate files in ext/standard
- the compiler is happy again, no more warnings

show more ...

More security-related (control) patches:
- Avoid displaying errors during startup, unless display_startup_errors is enabled.
- Implemented post_size_max limit. Defaults to 8MB.
- Impleme

More security-related (control) patches:
- Avoid displaying errors during startup, unless display_startup_errors is enabled.
- Implemented post_size_max limit. Defaults to 8MB.
- Implemented file_uploads on/off directive (defaults to on).

show more ...

Fix ordering

- Remove track_vars - it is now always on
- Make the various $HTTP_*_VARS[] arrays be defined always,
even if they're empty
- Fix Win32 build and warnings

Fix the file upload security problem with no side effects (untested)

Added "html_errors" directive to optionally disable HTML formatting of error
messages. The default is on. (Stig)

Change header protection macros to conform to standard.

Draft 3 of IEEE 1003.1 200x, "2.2 The Compilation Environment"

All identifiers that begin with an underscore and either an

Change header protection macros to conform to standard.

Draft 3 of IEEE 1003.1 200x, "2.2 The Compilation Environment"

All identifiers that begin with an underscore and either an uppercase
letter or another underscore are always reserved for any use by the
implementation.

show more ...

Improve timeout support - ini_get("max_execution_time", ...) works now

@- Made the short_tags, asp_tags and allow_call_time_pass_reference INI directives work
@ on a per-directory basis as well, e.g. from .htaccess files (Zeev)

Fix startup sequence. It should do it this time.

Update the license with the new clause 6

Make error_prepend_string and error_append_string work
@Make error_prepend_string and error_append_string work

@- Fixed a (fairly common) situation where error_reporting values would not be
@ properly restored after a call to error_reporting(), in between requests (Zeev)

- Protect $HTTP_POST_FILES[] as well

@- The various $HTTP_*_VARS[] are now protected, and cannot be manipulated by
@ user input (Zeev)
This patch is untested! I'll only have time to test it thoroughly in a couple of hours...

@- Implemented default_charset and default_mimetype config directives (Stig)
Implemented default_charset and default_mimetype configuration directives.
Started implementing ticks in PHP.