PHP 5.6.6 is available

Hi,

Le 20 févr. 2015 14:34, "Ferenc Kovacs" tyrael@php.net a écrit :

On Fri, Feb 20, 2015 at 8:54 AM, Florian Margaine florian@margaine.com
wrote:

Hi Ferenc,

Ferenc Kovacs tyrael@php.net writes:

Hello!

The PHP development team announces the immediate availability of PHP
5.6.6.
This release fixes several bugs and addresses CVE-2015-0235 and
CVE-2015-0273.
All PHP 5.6 users are encouraged to upgrade to this version.

For source downloads of PHP 5.6.6 please visit our
downloads page: http://www.php.net/downloads.php

Windows binaries can be found on http://windows.php.net/download/

The list of changes is recorded in the ChangeLog:
http://www.php.net/ChangeLog-5.php#5.6.6

Taken from the changelog:

Removed support for multi-line headers, as the are deprecated by RFC

Isn't this a BC break?

Ferenc Kovacs & Julien Pauli

Cheers,

Florian Margaine

cc'ing Stas as he was the author for this change.
but from my understanding this isn't a problem as we disallow setting
multiple headers in a single header() call for years (even though we had a
regression at one point).
the current change was made to address
https://bugs.php.net/bug.php?id=68978&edit=1 which was an IE specific
problem which was allowed by header().
maybe we should re-word the NEWS entry to make this a bit more clear.

Fair enough then. The changelog makes it look like a BC break without any
reason.

Cheers,
Florian Margaine

Hi!

cc'ing Stas as he was the author for this change.
but from my understanding this isn't a problem as we disallow setting
multiple headers in a single header() call for years (even though we had
a regression at one point).

Well, we allowed multiline headers but it is an extremely exotic feature
which is now dropped from the HTTP/1.1 standard, and also it causes
security issues with IE users since IE never supported that feature
properly. So given that I've decided to remove it even though strictly
speaking it is a BC break (same goes for the HTTP standard).

Stas Malyshev
smalyshev@gmail.com