# [VOTE] 5.4 features vote - Thread: https://externals.io/message/53793 - Original archive: https://news-web.php.net/php.internals/53793 - Started by Stas Malyshev on 2011-07-09T06:30:56+00:00 - Messages: 41 - Page 1 of 2: messages 1 to 25 (25 per page, add `?page=N` to the URL) - Next page: https://externals.io/message/53793.md?page=2 - Reply by email to internals@lists.php.net - More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt --- ## #53793 — Stas Malyshev — 2011-07-09T06:30:56+00:00 URL: https://externals.io/message/53793#53793 Hi! I've created a voting page for the features in 5.4 TODO list for which we need to find consensus. Please go there: https://wiki.php.net/todo/php54/vote and vote! See also links to relevant RFCs on the TODO page: https://wiki.php.net/todo/php54 If something is unclear or you notice a mistake, please write me. Thanks, -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227 --- ## #53794 — Laruence — 2011-07-09T13:47:20+00:00 URL: https://externals.io/message/53793#53794 · In reply to: #53793 Hi: can we add "Foreach supporting `T_LIST` token" into this vote? RFC: https://wiki.php.net/rfc/foreachlist thanks 2011/7/9 Stas Malyshev : > Hi! > > I've created a voting page for the features in 5.4 TODO list for which we > need to find consensus. Please go there: > https://wiki.php.net/todo/php54/vote > and vote! > > See also links to relevant RFCs on the TODO page: > https://wiki.php.net/todo/php54 > If something is unclear or you notice a mistake, please write me. > > Thanks, > -- > Stanislav Malyshev, Software Architect > SugarCRM: http://www.sugarcrm.com/ > (408)454-6900 ext. 227 > > -- > > > > -- Laruence  Xinchen Hui http://www.laruence.com/ --- ## #53795 — Lars Strojny — 2011-07-09T17:03:59+00:00 URL: https://externals.io/message/53793#53795 · In reply to: #53793 Hi Stas, Do you feel this is the somewhat final list for 5.4 or is will there be some room for new RFCs (I¹m thinking of Annotations, were an updated RFC was promised). With regards, Lars Am 09.07.11 08:30 schrieb "Stas Malyshev" unter : >Hi! > >I've created a voting page for the features in 5.4 TODO list for which >we need to find consensus. Please go there: >https://wiki.php.net/todo/php54/vote >and vote! > >See also links to relevant RFCs on the TODO page: >https://wiki.php.net/todo/php54 >If something is unclear or you notice a mistake, please write me. > >Thanks, >-- >Stanislav Malyshev, Software Architect >SugarCRM: http://www.sugarcrm.com/ >(408)454-6900 ext. 227 --- ## #53803 — Stas Malyshev — 2011-07-10T19:38:29+00:00 URL: https://externals.io/message/53793#53803 · In reply to: #53794 Hi! > Hi: > > can we add "Foreach supporting `T_LIST` token" into this vote? > > RFC: https://wiki.php.net/rfc/foreachlist If the author thinks it's mature enough he can put it up to the vote. One aspect I see that is not covered is if the references would work in the list and if so - how. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227 --- ## #53829 — Laruence — 2011-07-11T04:04:45+00:00 URL: https://externals.io/message/53793#53829 · In reply to: #53803 Hi: okey, I have updated the vote wiki page. thanks 2011/7/11 Stas Malyshev : > Hi! > > > > […] > > If the author thinks it's mature enough he can put it up to the vote. > One aspect I see that is not covered is if the references would work in the > list and if so - how. > -- > Stanislav Malyshev, Software Architect > SugarCRM: http://www.sugarcrm.com/ > (408)454-6900 ext. 227 > -- Laruence  Xinchen Hui http://www.laruence.com/ --- ## #53907 — Philip Olson — 2011-07-12T00:09:36+00:00 URL: https://externals.io/message/53793#53907 · In reply to: #53793 > Hi! > > I've created a voting page for the features in 5.4 TODO list for which we need to find consensus. Please go there: > https://wiki.php.net/todo/php54/vote > and vote! > > See also links to relevant RFCs on the TODO page: https://wiki.php.net/todo/php54 > If something is unclear or you notice a mistake, please write me. Greetings, I removed the \"remove magic quotes\" RFC link from this todo/vote page because this previously accepted RFC is not about removing magic quotes. And I'm the author of said RFC. It deals with PHP 5.3 which removed get_magic_quotes_*() so this old RFC restored them into both PHP 5.3+ and PHP 6. Regards, Philip --- ## #53908 — Stas Malyshev — 2011-07-12T00:20:19+00:00 URL: https://externals.io/message/53793#53908 · In reply to: #53907 Hi! > this previously accepted RFC is not about removing magic quotes. And I'm the > author of said RFC. It deals with PHP 5.3 which removed get_magic_quotes_*() > so this old RFC restored them into both PHP 5.3+ and PHP 6. Yes, it's not exactly what is being talked about here. It's more like this RFC: https://wiki.php.net/rfc/removal-of-deprecated-features slightly modifying the patch there according to your proposal (not emit `E_DEPRECATED` on gets). -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227 --- ## #53925 — Philip Olson — 2011-07-13T15:55:15+00:00 URL: https://externals.io/message/53793#53925 · In reply to: #53908 > Hi! > > > > […] > > Yes, it's not exactly what is being talked about here. It's more like this RFC: > https://wiki.php.net/rfc/removal-of-deprecated-features > slightly modifying the patch there according to your proposal (not emit `E_DEPRECATED` on gets). But this topic (removing magic quotes from 5.4) was not proposed on this list, so the vote feels premature. The only related RFC on the matter involves PHP 6, and it isn't specific to MQ. Granted we all don't like MQ, but this "security" feature is enabled by default today so skipping discussion to a simple vote for removal feels wrong. Regards, Philip --- ## #53926 — Stas Malyshev — 2011-07-13T15:57:38+00:00 URL: https://externals.io/message/53793#53926 · In reply to: #53925 Hi! > But this topic (removing magic quotes from 5.4) was not proposed on > this list, so the vote feels premature. The only related RFC on the > matter involves PHP 6, and it isn't specific to MQ. Granted we all > don't like MQ, but this "security" feature is enabled by default > today so skipping discussion to a simple vote for removal feels > wrong. It was proposed 2 weeks ago, along with other items. If you have anything to add now, please do so. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227 --- ## #53933 — Ferenc Kovacs — 2011-07-13T18:11:16+00:00 URL: https://externals.io/message/53793#53933 · In reply to: #53926 > Hi! > > > > […] > > It was proposed 2 weeks ago, along with other items. If you have anything to > add now, please do so. for the record, we had a lenghtly discussion back in november: http://www.mail-archive.com/internals@lists.php.net/msg48407.html the general reception was toward removing it for 5.4, but there were serious concerns about removing it also. I would also change my vote, I would go with keeping it deprecated, but turning it off by default (currently it isn't done, but the suggested development/production inis have this turned off), and remove it with the next minor version bump. if we have minor releases in the same timeframe as between 5.3 and 5.4, I'm fine with this. hopefully the security documentation will be in the better shape and we can figure out how to communicate such changes better to minimalize the impact. -- Ferenc Kovács @Tyr43l - http://tyrael.hu --- ## #53935 — Stas Malyshev — 2011-07-13T18:21:02+00:00 URL: https://externals.io/message/53793#53935 · In reply to: #53933 Hi! > I would also change my vote, I would go with keeping it deprecated, > but turning it off by default (currently it isn't done, but the > suggested development/production inis have this turned off), and > remove it with the next minor version bump. Which basically means doing nothing, as the effective default is the recommended INIs, where it's off. So what would change before now and then that makes it inacceptable to remove it now but acceptable to remove it then? > hopefully the security documentation will be in the better shape and > we can figure out how to communicate such changes better to minimalize > the impact. Our abilities to communicate will probably be in 1 year exactly as they are now, unless there's some big project to improve it that I'm not aware of. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227 --- ## #53937 — Ferenc Kovacs — 2011-07-13T18:35:37+00:00 URL: https://externals.io/message/53793#53937 · In reply to: #53935 > Hi! > > > > […] > > Which basically means doing nothing, as the effective default is the > recommended INIs, where it's off. So what would change before now and then > that makes it inacceptable to remove it now but acceptable to remove it > then? tyrael@thor:~/checkouts$ php -n -r 'echo PHP_VERSION."\n";echo ini_get("magic_quotes_gpc")."\n";' 5.3.6-6~dotdeb.1 1 tyrael@chronos:~/checkouts/php/src/php/php-src/branches/PHP_5_4$ ./sapi/cli/php -n -r 'echo PHP_VERSION."\n";echo ini_get("magic_quotes_gpc")."\n";' 5.4.0alpha2-dev 1 it's still on by default (if you don't use a php.ini which disables it), so you won't get the deprecated message, as it is only ommited when you change that ini, or call the magic_quotes methods. AFAIK > > > […] > > Our abilities to communicate will probably be in 1 year exactly as they are > now, unless there's some big project to improve it that I'm not aware of. where did you get the 1 year? I mentioned the next minor version, I thinks thats about 2-3 years from now. I talked with a few people about the improvement of the current security docs, and it was brough up also, that we would need a better way to introduce our suggested/introduced changes before rolling out an RC or a golden release. the new php.net will be there also, so I'm positive about that we will have more channels to communicate with the community. -- Ferenc Kovács @Tyr43l - http://tyrael.hu --- ## #53939 — Stas Malyshev — 2011-07-13T19:14:04+00:00 URL: https://externals.io/message/53793#53939 · In reply to: #53937 Hi! > tyrael@thor:~/checkouts$ php -n -r 'echo PHP_VERSION."\n";echo > ini_get("magic_quotes_gpc")."\n";' > 5.3.6-6~dotdeb.1 > 1 Nobody runs PHP with -n, who would you do that? INIs are the recommended setting, if you ignore that, you do it at your own peril. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227 --- ## #53944 — Pierre Joye — 2011-07-13T19:28:01+00:00 URL: https://externals.io/message/53793#53944 · In reply to: #53939 > Hi! > > > > […] > > Nobody runs PHP with -n, who would you do that? INIs are the recommended > setting, if you ignore that, you do it at your own peril. I do in many situations while testing and debugging and that's why the default values exist. Cheers, -- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org --- ## #53946 — Ferenc Kovacs — 2011-07-13T19:31:56+00:00 URL: https://externals.io/message/53793#53946 · In reply to: #53944 > > > […] > > I do in many situations while testing and debugging and that's why the > default values exist. > > Cheers, > -- > Pierre > > @pierrejoye | http://blog.thepimp.net | http://www.libgd.org > and our own tools use that also: pear and run-tests.php at least. -- Ferenc Kovács @Tyr43l - http://tyrael.hu --- ## #53947 — Stas Malyshev — 2011-07-13T19:39:48+00:00 URL: https://externals.io/message/53793#53947 · In reply to: #53944 Hi! > I do in many situations while testing and debugging and that's why the > default values exist. Can't we keep it on topic? Do you need magic quotes when you're debugging? Do you expect it to have the same value with and without -n? Does your code rely on magic quotes being on? -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227 --- ## #53948 — Ferenc Kovacs — 2011-07-13T19:44:49+00:00 URL: https://externals.io/message/53793#53948 · In reply to: #53947 > Hi! > > > > […] > > Can't we keep it on topic? Do you need magic quotes when you're debugging? > Do you expect it to have the same value with and without -n? Does your code > rely on magic quotes being on? Stas, you are also guilty in the offtopic charge. I just answered you what would I change about the current code. you don't have to agree with me, albeit it is weird, because I was in the impression that we do turn off the default values for the deprecated features, but whatever. sorry for partially hijacking the thread, I expressed what I wanted, can we move along? -- Ferenc Kovács @Tyr43l - http://tyrael.hu --- ## #53949 — Moshe — 2011-07-13T19:50:38+00:00 URL: https://externals.io/message/53793#53949 · In reply to: #53947 I'm sure this has been discussed, but I'm new here, and uncertain as to where to go to get caught up. What's so wrong with magic quotes that they need to be removed from the language entirely? Links of advice would be helpful. Thanks. -----Original Message----- From: Stas Malyshev [mailto:smalyshev@sugarcrm.com] Sent: Wednesday, July 13, 2011 2:40 PM To: Pierre Joye Cc: Ferenc Kovacs; Philip Olson; PHP Internals Subject: Re: [PHP-DEV] [VOTE] 5.4 features vote Hi! > I do in many situations while testing and debugging and that's why the > default values exist. Can't we keep it on topic? Do you need magic quotes when you're debugging? Do you expect it to have the same value with and without -n? Does your code rely on magic quotes being on? -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227 -- To unsubscribe, visit: http://www.php.net/unsub.php --- ## #53951 — Reindl Harald — 2011-07-13T19:55:32+00:00 URL: https://externals.io/message/53793#53951 · In reply to: #53949 Am 13.07.2011 21:50, schrieb Moshe, Sam: > What's so wrong with magic quotes that they need to be removed from the > language entirely? they are idiotic because useless for escaping database inputs and you need to find out this setting to remove them by `stripslashes()` if enabled from some dumb administrator that is why get_magic_quotes-functions are must not removed to avoid breaking clean code - but they magic quotes would never be implemented with a little more thoughts long time ago if you not remove them and they are enabled you get \" in your webpage output, with open eyes you see permanently sites where this happens --- ## #53950 — Ferenc Kovacs — 2011-07-13T20:00:42+00:00 URL: https://externals.io/message/53793#53950 · In reply to: #53949 > I'm sure this has been discussed, but I'm new here, and uncertain as to > where to go to get caught up. > What's so wrong with magic quotes that they need to be removed from the > language entirely? > > Links of advice would be helpful. > Thanks. > for starters: http://php.net/manual/en/security.magicquotes.whynot.php http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string there are 3 major problems: - magic_quotes is magic, it is implicit, you didn't know or care about it, but if your code depends on it, but you didn't check that it is turned on or not, your code will be vulnerable in the new environment. - magic_quotes gives you a false sense of security, as it is uses addslashes, and that doesn't prevent the xss injections for example - addslashes can save you from the sql injection related vulnerabilities, but as it doesn't care about encodings and couldn't possibly know what are you using for you db connection, it can be circumvented: http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string so it is better that nothing, but isn't a 100% safe solution but it prevents the users from learning the proper way to secure their applications. -- Ferenc Kovács @Tyr43l - http://tyrael.hu --- ## #53952 — Moshe — 2011-07-13T20:33:29+00:00 URL: https://externals.io/message/53793#53952 · In reply to: #53951 Great responses, all of them. Thanks everybody for the insight. Apologies if I veered off topic. -----Original Message----- From: Reindl Harald [mailto:h.reindl@thelounge.net] Sent: Wednesday, July 13, 2011 2:56 PM To: internals@lists.php.net Subject: Re: [PHP-DEV] [VOTE] 5.4 features vote Am 13.07.2011 21:50, schrieb Moshe, Sam: > What's so wrong with magic quotes that they need to be removed from > the language entirely? they are idiotic because useless for escaping database inputs and you need to find out this setting to remove them by `stripslashes()` if enabled from some dumb administrator that is why get_magic_quotes-functions are must not removed to avoid breaking clean code - but they magic quotes would never be implemented with a little more thoughts long time ago if you not remove them and they are enabled you get \" in your webpage output, with open eyes you see permanently sites where this happens --- ## #53956 — Hannes Landeholm — 2011-07-14T15:50:57+00:00 URL: https://externals.io/message/53793#53956 · In reply to: #53952 Hello, Is it possible to add Weak References to this todo list? https://bugs.php.net/bug.php?id=52318 I've been waiting over a year now for this feature. It's a critical part of object relational layer mapping and my framework will be broken until it exists. One of our important customer projects also broke down because my current work around (simply using an array) leaks huge amounts of memory due to automatic instance caching similar to the one in the example I typed down below. I'm also considering switching language since PHP lacks this important OOP concept. There does not yet seem to be an RFC for it so I typed down an example that attempts to look like real-word usage here: http://pastebin.com/pCHVK0L8 I esteimate that it's pretty simple to implement the theoretical "SplWeakArray" in the example I wrote if you have a bit of knowledge about the internals of PHP referencing and garbage collection. See the Java "WeakReference" for conceptual reference. http://download.oracle.com/javase/1.4.2/docs/api/java/lang/ref/WeakReference.html A copy of WeakReference would be a partial solution for me since I rather need a dictionary of id's mapped to objects. I don't want to go trough an array all the time and look for indexes that has been set to NULL. That's the GCs job. Hence the SplWeakArray class. ~Hannes --- ## #53958 — Stas Malyshev — 2011-07-14T18:22:07+00:00 URL: https://externals.io/message/53793#53958 · In reply to: #53956 Hi! > Hello, > > Is it possible to add Weak References to this todo list? > https://bugs.php.net/bug.php?id=52318 Probably not for 5.4.0. This looks like a thing that needs an RFC and discussion (and implementation of course ;). -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227 --- ## #53959 — Hannes Landeholm — 2011-07-14T18:43:14+00:00 URL: https://externals.io/message/53793#53959 · In reply to: #53958 Okay, maybe it could be attempted to be squeezed in anyway to 5.4? I really need this feature and apparently others feel the same way. - It would benefit MVC framework design - one of the most common design pattern for web development. - The ticket has been open for over a year now and it has a lot of votes and high score. (High priority.) - It's not especially complex. (Easy to implement.) - It's not a language construct. (Non-controversial.) - It's already implemented in other OOP languages and has been extensivly researched. (Non-controversial.) - It could be implemented by adding a single additional Spl class. (Easy to implement.) ~Hannes > Probably not for 5.4.0. This looks like a thing that needs an RFC and > discussion (and implementation of course ;). > -- > Stanislav Malyshev, Software Architect > SugarCRM: http://www.sugarcrm.com/ > (408)454-6900 ext. 227 --- ## #53960 — Stas Malyshev — 2011-07-14T19:05:09+00:00 URL: https://externals.io/message/53793#53960 · In reply to: #53959 Hi! > Okay, maybe it could be attempted to be squeezed in anyway to 5.4? I > really need this feature and apparently others feel the same way. We don't even have an RFC on it, let alone consensus & implementation, and we'd have a beta in a little more than a month. This makes timeframe for it very hard. There will be other releases, this is not the last one ;) If we could have RFC and have it agreed upon and have reasonably good implementation in a month, then we could talk about it. But I wouldn't rush it. If it's a stand-alone class, it can also got into .1 etc. release maybe. But I'd start with trunk first. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227 --- Next page: https://externals.io/message/53793.md?page=2