Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83309
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.177 as permitted sender)
MIME-Version: 1.0
Sender: tyra3l@gmail.com
In-Reply-To: <54E748A7.9080107@gmail.com>
References: <CAH-PCH6SMvR5Txp5zseZ6ty45D2QSbPyGacp-2cPTKf1voPC+A@mail.gmail.com>
	<871tllhvad.fsf@margaine.com>
	<CAH-PCH5Enrcf9SBmdFShmhJX-71N3D=D84kWyTgHDGM_O+sitg@mail.gmail.com>
	<54E748A7.9080107@gmail.com>
Date: Fri, 20 Feb 2015 16:17:31 +0100
Message-ID: <CAH-PCH4QTS7mCY_YEwO+g0nRvZe__hED8e9MrSUmeOYeFhngqg@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Florian Margaine <florian@margaine.com>, Stanislav Malyshev <stas@php.net>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c1b424264fb5050f868de4
Subject: Re: [PHP-DEV] PHP 5.6.6 is available
From: tyrael@php.net (Ferenc Kovacs)

--001a11c1b424264fb5050f868de4
Content-Type: text/plain; charset=UTF-8

On Fri, Feb 20, 2015 at 3:45 PM, Stanislav Malyshev <smalyshev@gmail.com>
wrote:

> Hi!
>
> > cc'ing Stas as he was the author for this change.
> > but from my understanding this isn't a problem as we disallow setting
> > multiple headers in a single header() call for years (even though we had
> > a regression at one point).
>
> Well, we allowed multiline headers but it is an extremely exotic feature
> which is now dropped from the HTTP/1.1 standard, and also it causes
> security issues with IE users since IE never supported that feature
> properly. So given that I've decided to remove it even though strictly
> speaking it is a BC break (same goes for the HTTP standard).
>

duh, should have checked the commit first.
so since php 5.1.2 we were disallowing multiple headers to be set in the
same header() call (as in header("Foo: bar\r\nBaz: foo");) but we still
kept the ability to have multiline headers (as in header("Foo: bar\r\n
baz");)
which still caused some problem for some browser, so we had a discussion
about removing multiline header support altogether:
http://comments.gmane.org/gmane.comp.php.devel/88039
so Florian is correct that this is a BC break (albeit in a less
known/discouraged feature which was causing security problems over the
years).

--001a11c1b424264fb5050f868de4--