Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:75181 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 20620 invoked from network); 3 Jul 2014 00:40:27 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 3 Jul 2014 00:40:27 -0000 Authentication-Results: pb1.pair.com header.from=ajf@ajf.me; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=ajf@ajf.me; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain ajf.me designates 192.64.116.207 as permitted sender) X-PHP-List-Original-Sender: ajf@ajf.me X-Host-Fingerprint: 192.64.116.207 imap2-2.ox.privateemail.com Received: from [192.64.116.207] ([192.64.116.207:48275] helo=imap2-2.ox.privateemail.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 9D/6D-47713-A76A4B35 for ; Wed, 02 Jul 2014 20:40:27 -0400 Received: from localhost (localhost [127.0.0.1]) by mail.privateemail.com (Postfix) with ESMTP id 3CB3F8C0080; Wed, 2 Jul 2014 20:40:24 -0400 (EDT) X-Virus-Scanned: Debian amavisd-new at imap2.ox.privateemail.com Received: from mail.privateemail.com ([127.0.0.1]) by localhost (imap2.ox.privateemail.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP id nWLe6kXwYF-R; Wed, 2 Jul 2014 20:40:24 -0400 (EDT) Received: from [192.168.0.15] (unknown [90.210.122.167]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.privateemail.com (Postfix) with ESMTPSA id F27758C007D; Wed, 2 Jul 2014 20:40:21 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\)) In-Reply-To: <20140703003646.GA12662@openwall.com> Date: Thu, 3 Jul 2014 01:40:15 +0100 Cc: PHP internals , D0znpp Content-Transfer-Encoding: quoted-printable Message-ID: References: <20140703003646.GA12662@openwall.com> To: Solar Designer X-Mailer: Apple Mail (2.1878.2) Subject: Re: [PHP-DEV] multiline HTTP headers support in header() From: ajf@ajf.me (Andrea Faulds) On 3 Jul 2014, at 01:36, Solar Designer wrote: > Please drop multiline HTTP headers support from PHP header() Would this be a backwards-compatibility break? We could convert = multi-line headers into single-line headers, I suppose, but surely it = would still break BC? Be that the case, we should probably only do this for PHP 6. Though I = wonder if multi-line headers are obscure enough, and the security = benefits justifiable enough, that we could do it in 5.7. -- Andrea Faulds http://ajf.me/