Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:116723
Message-ID: <9ad619f9-2c2f-00b3-ce2c-87e141af801d@gmx.de>
Date: Thu, 23 Dec 2021 00:27:32 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.4.0
Content-Language: de-DE
To: Ayesh Karunaratne <ayesh@php.watch>
Cc: PHP internals <internals@lists.php.net>, Jakub Zelenka <bukka@php.net>
References: <5d2b1d8f-9b7a-558f-8750-cc97b3ad0589@gmx.de>
 <CANLbj-qO7-eAoagQMoFw_sYdvweXFqVRgW+x_8-WPF1-deOMUQ@mail.gmail.com>
In-Reply-To: <CANLbj-qO7-eAoagQMoFw_sYdvweXFqVRgW+x_8-WPF1-deOMUQ@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] header() allows arbitrary status codes
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 21.12.2021 at 20:09, Ayesh Karunaratne wrote:

>> a while ago it has been reported[1] that our header() function actually
>> allows arbitrary status codes, which may even overflow.  Of course, tha=
t
>> makes no sense, since the status code is supposed to be a three digit
>> code.  So this ticket has been followed up by a pull request[2], and
>> Jakub suggested to further restrict the status code to be in range 100 =
-
>> 599.
>>
>> Since this could break some pathological cases, I wanted to ask whether
>> anybody objects to this change for the master branch (i.e. PHP 8.2).
>>
>> [1] <https://bugs.php.net/bug.php?id=3D81645>
>> [2] <https://github.com/php/php-src/pull/7676>
>
> I think it is a useful improvement.  Should we adjust to
> http_response_code to match this behavior?

Oh, good catch!  I think we should.

Christoph