# PHP 5.2.7 + magic_quotes_gpc broken - Thread: https://externals.io/message/42128 - Original archive: https://news-web.php.net/php.internals/42128 - Started by Scott MacVicar on 2008-12-06T20:35:42+00:00 - Messages: 20 - Reply by email to internals@lists.php.net - More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt --- ## #42128 — Scott MacVicar — 2008-12-06T20:35:42+00:00 URL: https://externals.io/message/42128#42128 Hey, There have been several bug reports about magic_quotes_gpc being broken, at the moment in 5.2.7 the escaping is not performed even when enabled. So any applications that attempt to undo the work of magic_quotes_gpc will end up with problems. I've backed out the bug that broke this #42718 Since this is a relative serious issue from a security stand point if people rely on it being enabled and a potential data loss for those trying to undo it, I'd like to see a release packaged asap. If Ilia agrees then could fixes to the 5.2 branch be restricted to build fixes only. Scott --- ## #42133 — crrodriguez@suse.de — 2008-12-07T04:24:03+00:00 URL: https://externals.io/message/42128#42133 · In reply to: #42128 Scott MacVicar escribió: > Since this is a relative serious issue from a security stand point if > people rely on it being enabled and a potential data loss for those > trying to undo it, I'd like to see a release packaged asap. Please dont release a new package, but a new php version (5.2.8 or 5.2.7.1) -- "We have art in order not to die of the truth" - Friedrich Nietzsche Cristian Rodríguez R. Platform/OpenSUSE - Core Services SUSE LINUX Products GmbH Research & Development http://www.opensuse.org/ --- ## #42135 — Marcus Boerger — 2008-12-07T13:47:49+00:00 URL: https://externals.io/message/42128#42135 · In reply to: #42128 Hello Ilia, Ilia, this is ultimately your call but I suggest we drop 5.2.7, explain that people shouldn't use it on php.net news and then provide 5.2.8. marcus Saturday, December 6, 2008, 9:35:42 PM, you wrote: > Hey, > There have been several bug reports about magic_quotes_gpc being > broken, at the moment in 5.2.7 the escaping is not performed even when > enabled. So any applications that attempt to undo the work of > magic_quotes_gpc will end up with problems. > I've backed out the bug that broke this #42718 > Since this is a relative serious issue from a security stand point if > people rely on it being enabled and a potential data loss for those > trying to undo it, I'd like to see a release packaged asap. > If Ilia agrees then could fixes to the 5.2 branch be restricted to > build fixes only. > Scott Best regards, Marcus --- ## #42136 — Ilia Alshanetsky — 2008-12-07T18:16:43+00:00 URL: https://externals.io/message/42128#42136 · In reply to: #42128 I will be re-branching 5.2.7 with this revert for the purpose of 5.2.8 this week. This will allow the normal 5.2 bug fixing to continue as normal. > Hey, > > There have been several bug reports about magic_quotes_gpc being > broken, at the moment in 5.2.7 the escaping is not performed even > when enabled. So any applications that attempt to undo the work of > magic_quotes_gpc will end up with problems. > > I've backed out the bug that broke this #42718 > > Since this is a relative serious issue from a security stand point > if people rely on it being enabled and a potential data loss for > those trying to undo it, I'd like to see a release packaged asap. > > If Ilia agrees then could fixes to the 5.2 branch be restricted to > build fixes only. > > Scott Ilia Alshanetsky --- ## #42137 — Marcus Boerger — 2008-12-07T18:33:42+00:00 URL: https://externals.io/message/42128#42137 · In reply to: #42136 Hello Ilia, brilliant :-) Sunday, December 7, 2008, 7:16:43 PM, you wrote: > I will be re-branching 5.2.7 with this revert for the purpose of 5.2.8 > this week. This will allow the normal 5.2 bug fixing to continue as > normal. > > > […] > Ilia Alshanetsky Best regards, Marcus --- ## #42138 — mike — 2008-12-07T20:46:54+00:00 URL: https://externals.io/message/42128#42138 · In reply to: #42136 In the meantime shouldn't this be posted on php.net? Uninformed people are thinking that 5.2.7 is good to go. > I will be re-branching 5.2.7 with this revert for the purpose of 5.2.8 this > week. This will allow the normal 5.2 bug fixing to continue as normal. > > > > > > […] > > Ilia Alshanetsky --- ## #42145 — Ilia Alshanetsky — 2008-12-08T14:15:11+00:00 URL: https://externals.io/message/42128#42145 · In reply to: #42137 Should the 5.3 release be re-branched perhaps as well, since it too has this problem? > Hello Ilia, > > brilliant :-) > > Sunday, December 7, 2008, 7:16:43 PM, you wrote: > > > […] > > > > […] > > > […] > > > […] > > > > > > > > > Best regards, > Marcus > Ilia Alshanetsky --- ## #42146 — Pierre Joye — 2008-12-08T14:24:13+00:00 URL: https://externals.io/message/42128#42146 · In reply to: #42145 hi, > Should the 5.3 release be re-branched perhaps as well, since it too has this > problem? I do not think it is necessary for 5.3. It is an alpha release after all and seriously, anyone who plans to move to 5.3.0 and still relies on magic quotes gpc is likely to have more issues as well. Cheers, -- Pierre http://blog.thepimp.net | http://www.libgd.org --- ## #42147 — Hannes Magnusson — 2008-12-08T15:06:10+00:00 URL: https://externals.io/message/42128#42147 · In reply to: #42146 > hi, > > > > […] > > I do not think it is necessary for 5.3. It is an alpha release after > all and seriously, anyone who plans to move to 5.3.0 and still relies > on magic quotes gpc is likely to have more issues as well. Time to turn it off by default then? -Hannes --- ## #42148 — Pierre Joye — 2008-12-08T15:08:49+00:00 URL: https://externals.io/message/42128#42148 · In reply to: #42147 On Mon, Dec 8, 2008 at 4:06 PM, Hannes Magnusson wrote: > > > […] > > Time to turn it off by default then? I would even like to drop it (and the other things as well) in 5.3.0 :) -- Pierre http://blog.thepimp.net | http://www.libgd.org --- ## #42186 — Lukas Kahwe Smith — 2008-12-08T15:30:10+00:00 URL: https://externals.io/message/42128#42186 · In reply to: #42148 > On Mon, Dec 8, 2008 at 4:06 PM, Hannes Magnusson > wrote: > > […] > > I would even like to drop it (and the other things as well) in > 5.3.0 :) the drop was planned for 6.0 for a reason. i also do not think we need to make a 5.3 release just for this. lets focus on getting feedback on namespaces and the other changes and have this fixed on beta1 early 2009. regards, Lukas Kahwe Smith mls@pooteeweet.org --- ## #42187 — Lukas Kahwe Smith — 2008-12-08T15:33:44+00:00 URL: https://externals.io/message/42128#42187 · In reply to: #42148 > On Mon, Dec 8, 2008 at 4:06 PM, Hannes Magnusson > wrote: > > […] > > I would even like to drop it (and the other things as well) in > 5.3.0 :) the drop was planned for 6.0 for a reason. i also do not think we need to make a 5.3 release just for this. lets focus on getting feedback on namespaces and the other changes and have this fixed on beta1 early 2009. regards, Lukas Kahwe Smith mls@pooteeweet.org --- ## #42149 — Kalle Sommer Nielsen — 2008-12-08T15:43:41+00:00 URL: https://externals.io/message/42128#42149 · In reply to: #42148 2008/12/8 Pierre Joye : > On Mon, Dec 8, 2008 at 4:06 PM, Hannes Magnusson > wrote: > > […] > > I would even like to drop it (and the other things as well) in 5.3.0 :) I'll like to see it dropped aswell, seems like a bad legacy just keep BC and in the end hurts us more (like just seen with 5.2.7) -- Kalle Sommer Nielsen --- ## #42152 — johannes@php.net — 2008-12-08T15:52:08+00:00 URL: https://externals.io/message/42128#42152 · In reply to: #42145 > Should the 5.3 release be re-branched perhaps as well, since it too > has this problem? The 5.3 alpha release is hopefully not used in production by anybody so I don't think it's critical there. Maybe it motivates somebody to think about magic_quotes then it's even a good thing ;-) I'd prefer having a beta soon, though. johannes --- ## #42156 — Marcus Boerger — 2008-12-08T16:18:16+00:00 URL: https://externals.io/message/42128#42156 · In reply to: #42148 Hello Pierre, Monday, December 8, 2008, 4:08:49 PM, you wrote: > On Mon, Dec 8, 2008 at 4:06 PM, Hannes Magnusson > wrote: > > […] > I would even like to drop it (and the other things as well) in 5.3.0 :) +1 Best regards, Marcus --- ## #42161 — crrodriguez@suse.de — 2008-12-08T16:28:05+00:00 URL: https://externals.io/message/42128#42161 · In reply to: #42148 Pierre Joye escribió: > I would even like to drop it (and the other things as well) in 5.3.0 :) Yes, please :) but throw an error when use is detected. -- "We have art in order not to die of the truth" - Friedrich Nietzsche Cristian Rodríguez R. Platform/OpenSUSE - Core Services SUSE LINUX Products GmbH Research & Development http://www.opensuse.org/ --- ## #42185 — Lukas Kahwe Smith — 2008-12-08T21:40:19+00:00 URL: https://externals.io/message/42128#42185 · In reply to: #42148 > On Mon, Dec 8, 2008 at 4:06 PM, Hannes Magnusson > wrote: > > […] > > I would even like to drop it (and the other things as well) in > 5.3.0 :) the drop was planned for 6.0 for a reason. i also do not think we need to make a 5.3 release just for this. lets focus on getting feedback on namespaces and the other changes and have this fixed on beta1 early 2009. adding an E_DEPRECATE (actually i guess we should check the PHP6 NEWS file for other stuff as well), does make sense. disabling by default (if not yet done) too. regards, Lukas Kahwe Smith mls@pooteeweet.org --- ## #42188 — mike — 2008-12-08T23:20:30+00:00 URL: https://externals.io/message/42128#42188 · In reply to: #42185 Mon, Dec 8, 2008 at 1:40 PM, Lukas Kahwe Smith wrote: > the drop was planned for 6.0 for a reason. > i also do not think we need to make a 5.3 release just for this. > lets focus on getting feedback on namespaces and the other changes and have > this fixed on beta1 early 2009. > > adding an E_DEPRECATE (actually i guess we should check the PHP6 NEWS file > for other stuff as well), does make sense. > disabling by default (if not yet done) too. agreed. for php6, disable by default, add in a warning (that is higher than E_NOTICE? so people see it) for php5, keep business as usual. i don't think many people would think that 5.2 -> 5.3 would disable/remove such a major thing. if anything, add in an `E_NOTICE` perhaps saying "magic quotes is active/enabled, PHP 6 will be disabling this, now is time to start fixing the code" while i would love to see it go, i think that is too drastic for a "minor" version. PHP 6 will be totally different already so backwards compatibility isn't as important. changes will most likely be required at that point. - $0.02 --- ## #42189 — Pierre Joye — 2008-12-08T23:28:09+00:00 URL: https://externals.io/message/42128#42189 · In reply to: #42188 > Mon, Dec 8, 2008 at 1:40 PM, Lukas Kahwe Smith wrote: > > > > […] > > agreed. > > for php6, disable by default, add in a warning (that is higher than > E_NOTICE? so people see it) > > for php5, keep business as usual. i don't think many people would > think that 5.2 -> 5.3 would disable/remove such a major thing. if > anything, add in an `E_NOTICE` perhaps saying "magic quotes is > active/enabled, PHP 6 will be disabling this, now is time to start > fixing the code" > > while i would love to see it go, i think that is too drastic for a > "minor" version. PHP 6 will be totally different already so backwards > compatibility isn't as important. changes will most likely be required > at that point. > note to all: Can you read all replies before any other answers/votes/comments please? thanks :) tip: it is already removed from php6 Cheers, -- Pierre http://blog.thepimp.net | http://www.libgd.org --- ## #42194 — Hannes Magnusson — 2008-12-09T07:51:36+00:00 URL: https://externals.io/message/42128#42194 · In reply to: #42185 > > > > > […] > > > the drop was planned for 6.0 for a reason. > i also do not think we need to make a 5.3 release just for this. > lets focus on getting feedback on namespaces and the other changes and have > this fixed on beta1 early 2009. > > adding an E_DEPRECATE (actually i guess we should check the PHP6 NEWS file > for other stuff as well), does make sense. > disabling by default (if not yet done) too. http://phpfi.com/386386 Removed stuff (in 6) disabled by default and throws `E_DEPRECATED` when activated. set_magic_quotes_runtime() and its evil twin magic_quotes_runtime() already use PHP_DEP_FE/_FALIAS. The getters (get_magic_quotes_gpc() and get_magic_quotes_runtime()) should IMO not spew `E_DEPRECATED` warnings (and they do not currently, nor after the patch above). Any objections? -Hannes