Fix #81708: UAF due to php_filter_float() failing for ints

We must only release the zval, if we actually assign a new zval.

Fix #61700: FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing

It makes no sense to compare IPv6 address ranges as strings; there are
too many different representation possibilities.

Fix #61700: FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing

It makes no sense to compare IPv6 address ranges as strings; there are
too many different representation possibilities. Instead, we change
`_php_filter_validate_ipv6()` so that it can calculate the IP address
as integer array. We do not rely on `inet_pton()` which may not be
available everywhere, at least IPv6 support may not, but rather parse
the IP address manually. Finally, we compare the integers.

Note that this patch does not fix what we consider as reserved and
private, respectively, but merely tries to keep what we had so far.

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>

Closes GH-7476.

show more ...

Fix warning

(cherry picked from commit 190013787bbc424c240413d914e3a038f974ccef)

Fix #81122: SSRF bypass in FILTER_VALIDATE_URL

We need to ensure that the password detected by parse_url() is actually
a valid password; we can re-use is_userinfo_valid() for that.

Alternative fix for bug 77423

That bug report originally was about `parse_url()` misbehaving, but the
security aspect was actually only regarding `FILTER_VALIDATE_URL`.
Since the cha

Alternative fix for bug 77423

That bug report originally was about `parse_url()` misbehaving, but the
security aspect was actually only regarding `FILTER_VALIDATE_URL`.
Since the changes to `parse_url_ex()` apparently affect userland code
which is relying on the sloppy URL parsing[1], this alternative
restores the old parsing behavior, but ensures that the userinfo is
checked for correctness for `FILTER_VALIDATE_URL`.

[1] <https://github.com/php/php-src/commit/5174de7cd33c3d4fa591c9c93859ff9989b07e8c#commitcomment-45967652>

show more ...

Added range options to the float validation filter

php_filter_int (called via the constant FILTER_VALIDATE_INT) has the options min_range
and max_range. they allow the user to not only t

Added range options to the float validation filter

php_filter_int (called via the constant FILTER_VALIDATE_INT) has the options min_range
and max_range. they allow the user to not only test if a value is a double but also if
the value is inside a specific range. php_filter_float (called via the constant
FILTER_VALIDATE_FLOAT) didn't provide this yet, making validation of numeric but
not-only-int values more complicated for the user.
this commits implements the options min_range and max_range for the function
php_filter_float to fix this inconsistency.

show more ...

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly used by Vim and Emacs editors
yet with recent changes the once working definitions don't work
anymore in Vim without custom plugins or additional configuration.
Neither are these settings synced across the PHP code base.

A simpler and better approach is EditorConfig and fixing code
using some code style fixing tools in the future instead.

This patch also removes the so called modelines for Vim. Modelines
allow Vim editor specifically to set some editor configuration such as
syntax highlighting, indentation style and tab width to be set in the
first line or the last 5 lines per file basis. Since the php test
files have syntax highlighting already set in most editors properly and
EditorConfig takes care of the indentation settings, this patch removes
these as well for the Vim 6.0 and newer versions.

With the removal of local variables for certain editors such as
Emacs and Vim, the footer is also probably not needed anymore when
creating extensions using ext_skel.php script.

Additionally, Vim modelines for setting php syntax and some editor
settings has been removed from some *.phpt files. All these are
mostly not relevant for phpt files neither work properly in the
middle of the file.

show more ...

Remove yearly range from copyright notice

Remove preg_options param from pcre_get_compiled_regex()

This parameter is always zero and not necessary to call pcre2_match.

I'm leaving the parameter behind on the _ex() variant,

Remove preg_options param from pcre_get_compiled_regex()

This parameter is always zero and not necessary to call pcre2_match.

I'm leaving the parameter behind on the _ex() variant, so the preg_flags
are still accessible in some way.

show more ...

Remove HASH_OF uses in ext/filter

It turns out that all of these places ultimately only accept arrays,
not objects, so we can use Z_ARRVAL_P everywhere.

Also add _deref in a few

Remove HASH_OF uses in ext/filter

It turns out that all of these places ultimately only accept arrays,
not objects, so we can use Z_ARRVAL_P everywhere.

Also add _deref in a few places where the hash lookup result is
directly type-checked.

show more ...

Fix typos in code comments

Remove unused Git attributes ident

The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
use

Remove unused Git attributes ident

The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
user who changed it.

In Git this functionality is different and can be done with Git attribute
ident. These need to be defined manually for each file in the
.gitattributes file and are afterwards replaced with 40-character
hexadecimal blob object name which is based only on the particular file
contents.

This patch simplifies handling of $Id$ keywords by removing them since
they are not used anymore.

show more ...

Deprecate explicit use of FILTER_FLAG_SCHEME|HOST_REQUIRED

As of PHP 5.2.1 FILTER_VALIDATE_URL implies FILTER_FLAG_SCHEME_REQUIRED
| FILTER_FLAG_HOST_REQUIRED, which makes these constant

Deprecate explicit use of FILTER_FLAG_SCHEME|HOST_REQUIRED

As of PHP 5.2.1 FILTER_VALIDATE_URL implies FILTER_FLAG_SCHEME_REQUIRED
| FILTER_FLAG_HOST_REQUIRED, which makes these constants useless at
best, if not even misleading. Therefore we deprecate the explicit use
of these constants for FILTER_VALIDATE_URL, to pave the way for their
eventual removal.

See <https://wiki.php.net/rfc/deprecations_php_7_3#filter_flag_scheme_required_and_filter_flag_host_required>.

show more ...

Use zend_string_release_ex() instread of zend_string_release() in places, where we sure about string persistence.

Implement #51368: php_filter_float does not allow custom thousand separators

A set of hard-coded thousand separator characters (presently, `',.`) is
somewhat limited (users may prefer ot

Implement #51368: php_filter_float does not allow custom thousand separators

A set of hard-coded thousand separator characters (presently, `',.`) is
somewhat limited (users may prefer other separators, such as spaces or
underscores), as well as somewhat too liberal (arbitrary combinations
of different thousand separators are presently possible). Therefore we
introduce a `thousand` option analogous to `decimal`, which allows to
define the desired thousand separators as non-empty string, defaulting
to `',.`. While we easily could support empty strings here as well,
that would not make much sense, since this behavior can more easily be
accomplished by not setting the `FILTER_FLAG_ALLOW_THOUSAND` flag in
the first place.

show more ...

year++

year++

year++

Fix remaining signedness warnings

Patch core for PCRE2 support

RFC https://wiki.php.net/rfc/pcre2-migration

Refactor php_url struct to save memory dup in common cases

Fixed wrong usage of old ZPP API.

Update copyright headers to 2017

Update copyright headers to 2017

Update copyright headers to 2017