Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:57670 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 31154 invoked from network); 3 Feb 2012 22:22:05 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 3 Feb 2012 22:22:05 -0000 Authentication-Results: pb1.pair.com smtp.mail=pierre.php@gmail.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=pierre.php@gmail.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.170 as permitted sender) X-PHP-List-Original-Sender: pierre.php@gmail.com X-Host-Fingerprint: 209.85.161.170 mail-gx0-f170.google.com Received: from [209.85.161.170] ([209.85.161.170:57133] helo=mail-gx0-f170.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id DD/43-08838-C0E5C2F4 for ; Fri, 03 Feb 2012 17:22:04 -0500 Received: by ggki2 with SMTP id i2so2310767ggk.29 for ; Fri, 03 Feb 2012 14:22:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=cZHBWut5Rs9+mO8xRg32r2eUcAEYV5XVxl4E4TGTPt4=; b=lBiuE4nzTGiJchOeWW5PBIFjZ3EA7bfsUftU6aGz8C+dM3uVM970xzazhDjt/aeti7 V1FYrJzcYT/0mE07ERFzv+nYisMeF+PKSbRUS3G/eeEbpiIsTSo8fVo0PMVq+IDVpiCC 96KZA1u9rSYZL9CKimEH6nSuW/9+6wWB/C82I= MIME-Version: 1.0 Received: by 10.101.10.6 with SMTP id n6mr4264814ani.48.1328307721684; Fri, 03 Feb 2012 14:22:01 -0800 (PST) Received: by 10.146.197.7 with HTTP; Fri, 3 Feb 2012 14:22:01 -0800 (PST) In-Reply-To: <4F2C5388.4030306@thelounge.net> References: <4F2C4743.8070609@gmail.com> <4F2C5388.4030306@thelounge.net> Date: Fri, 3 Feb 2012 23:22:01 +0100 Message-ID: To: Reindl Harald Cc: internals@lists.php.net Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Subject: Re: [PHP-DEV] The case of HTTP response splitting protection in PHP From: pierre.php@gmail.com (Pierre Joye) On Fri, Feb 3, 2012 at 10:37 PM, Reindl Harald wro= te: > > > Am 03.02.2012 21:44, schrieb =C1ngel Gonz=E1lez: >>> If you or anyone else find any problem, please report a bug; otherwise >>> I'll merge to 5.3 and 5.4 once 5.4 is out of code freeze. >>> >> As it's a security patch and of small scope, I would consider it for >> 5.4. Stas, David? > > as it is SECURITY relevant it has to be considered NOW meaning 5.3 and no= t > sometimes in the future! Point is to apply well tested and approved and reviewed fixes to 5.3 or 5.4. Not blindly apply something only because it is related to a security issue. PS: We are not blind so please use lower case only. --=20 Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org