Commit graph

175 commits

Author SHA1 Message Date
Stanislav Malyshev
e8c64b62da Merge branch 'PHP-8.1' into PHP-8.2 2023-02-12 21:34:10 -07:00
Stanislav Malyshev
85d9278db2 Merge branch 'PHP-8.0' into PHP-8.1 2023-02-12 21:33:39 -07:00
Tim Düsterhus
a92acbad87 crypt: Fix possible buffer overread in php_crypt() 2023-02-12 20:46:51 -07:00
Go Kudo
4d8dd8d258
Implement Random Extension
https://wiki.php.net/rfc/rng_extension
https://wiki.php.net/rfc/random_extension_improvement
2022-07-19 10:27:38 +01:00
George Peter Banyard
5171cb435a Fix [-Wundef] warnings in standard extension 2022-04-01 15:48:41 +01:00
KsaR
01b3fc03c3
Update http->https in license (#6945)
1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |
2021-05-06 12:16:35 +02:00
Nikita Popov
3e01f5afb1 Replace zend_bool uses with bool
We're starting to see a mix between uses of zend_bool and bool.
Replace all usages with the standard bool type everywhere.

Of course, zend_bool is retained as an alias.
2021-01-15 12:33:06 +01:00
Nikita Popov
032f862133 Drop support for crypt() without explicit salt
crypt() without salt generates a weak $1$ MD5 hash. It has been
throwing a notice since 2013 and we provide a much better alternative
in password_hash() (which can auto-generate salts for strong
password hashes), so keeping this is just a liability.
2020-09-07 15:43:26 +02:00
Max Semenik
2b5de6f839
Remove proto comments from C files
Closes GH-5758
2020-07-06 21:13:34 +02:00
Alex Dowad
19d3e29bf5 Clean house in cryptographic hashing code
- Remove dead code from php_crypt_r.c

  This code has been commented out since the file was added in 2008. It's safe to say
  that no-one is ever going to use it.

- Fix typo in comment in php_crypt_r.c

- Remove redundant Windows-only implementation of php_md5_crypt_r

  There is a portable implementation in the same file, which is selected if not
  building for Windows. But why should Windows have its own special implementation
  of this function at all? There doesn't seem to be any good reason.

  Better to use the portable implementation on all platforms.

- Don't define useless __CONST macro in php_crypt_r.h

  This preprocessor macro is not used anywhere.

- Add comment on functions for encoding data as Base64

- Remove dead code from crypt_blowfish.h

- Remove unneeded junk comments from crypt_freesec.c

- Remove dead code from crypt_blowfish.c

  This function has been commented out since 2011.
2020-06-24 13:40:27 +02:00
Nikita Popov
187d7f05c2 Fix potential use-after-scope if crypt_r is used 2020-06-24 13:07:00 +02:00
Nikita Popov
d579b10c84 Remove deprecated DES fallback in crypt() 2020-06-24 12:57:04 +02:00
Nikita Popov
4c4af2b2e1 Merge branch 'PHP-7.4'
* PHP-7.4:
  Handle *0 / *1 more consistently
2020-06-24 12:22:44 +02:00
Nikita Popov
565baf05c0 Handle *0 / *1 more consistently
Avoid throwing a DES salt deprecation warning if the libc crypt
implementation is used.
2020-06-24 12:22:07 +02:00
Gabriel Caruso
5d6e923d46
Remove mention of PHP major version in Copyright headers
Closes GH-4732.
2019-09-25 14:51:43 +02:00
Remi Collet
946a1e4314 Fix build warnings
- switch from strncpy to memcpy for -Wstringop-truncation
2019-07-25 11:50:44 +02:00
Nikita Popov
4b5e824aae Use unsigned char in _crypt_extended_r
Avoid signed shift UB.
2019-06-19 15:09:00 +02:00
Peter Kokot
92ac598aab Remove local variables
This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly used by Vim and Emacs editors
yet with recent changes the once working definitions don't work
anymore in Vim without custom plugins or additional configuration.
Neither are these settings synced across the PHP code base.

A simpler and better approach is EditorConfig and fixing code
using some code style fixing tools in the future instead.

This patch also removes the so called modelines for Vim. Modelines
allow Vim editor specifically to set some editor configuration such as
syntax highlighting, indentation style and tab width to be set in the
first line or the last 5 lines per file basis. Since the php test
files have syntax highlighting already set in most editors properly and
EditorConfig takes care of the indentation settings, this patch removes
these as well for the Vim 6.0 and newer versions.

With the removal of local variables for certain editors such as
Emacs and Vim, the footer is also probably not needed anymore when
creating extensions using ext_skel.php script.

Additionally, Vim modelines for setting php syntax and some editor
settings has been removed from some *.phpt files.  All these are
mostly not relevant for phpt files neither work properly in the
middle of the file.
2019-02-03 21:03:00 +01:00
Zeev Suraski
0cf7de1c70 Remove yearly range from copyright notice 2019-01-30 11:03:12 +02:00
Zeev Suraski
67e0138c0d Future-proof email addresses... 2018-11-01 18:30:28 +02:00
Peter Kokot
d3ca28f569 Remove HAVE_STRING_H
The C89 standard and later defines the `<string.h>` header as part of
the standard headers [1] and on current systems it is always present.

Code included also `<strings.h>` header as an alterinative in some
files. This kind of check was relevant on some older systems where the
`<strings.h>` file included definitions for the C89 compliant
`<string.h>`. Today such alternative check is not required anymore. The
`<strings.h>` file is part of the POSIX definition these days.

Also Autoconf suggests doing this and relying on C89 or above [2] and [3].

This patch also cleans few unused `<strings.h>` inclusions in the libmbfl.

[1]: https://port70.net/~nsz/c/c89/c89-draft.html#4.1.2
[2]: http://git.savannah.gnu.org/cgit/autoconf.git/tree/lib/autoconf/headers.m4
[3]: https://www.gnu.org/software/autoconf/manual/autoconf-2.69/autoconf.html
2018-09-18 05:32:08 +02:00
Peter Kokot
cbc785dc8c Remove AC_STRUCT_TM macro
Autoconf 2.59d (released in 2006) [1] started promoting several macros
as not relevant for newer systems anymore, including the `AC_STRUCT_TM`.

This macro checks if `struct tm` is defined in either `<sys/time.h>` or
`<time.h>` and defines the `TM_IN_SYS_TIME` symbol accordingly. This
check was relevant in times before the C89 for some embedded systems,
microcontrollers or very old systems. For newer systems it can be
avoided and the `<time.h>` should be included instead since current
systems should be well supported by now. [2]

Since PHP requires at least C89, this patch removes the obsolescent call
and time.h checks.

Refs:

- [1]: http://git.savannah.gnu.org/cgit/autoconf.git/tree/NEWS
- [2]: https://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Particular-Structures.html
2018-08-29 21:22:47 +02:00
Peter Kokot
8d3f8ca12a Remove unused Git attributes ident
The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
user who changed it.

In Git this functionality is different and can be done with Git attribute
ident. These need to be defined manually for each file in the
.gitattributes file and are afterwards replaced with 40-character
hexadecimal blob object name which is based only on the particular file
contents.

This patch simplifies handling of $Id$ keywords by removing them since
they are not used anymore.
2018-07-25 00:53:25 +02:00
Xinchen Hui
a6519d0514 year++ 2018-01-02 12:57:58 +08:00
Sammy Kaye Powers
1e3624290a Resolve conflict 2017-01-03 08:01:05 -06:00
Joe Watkins
0788f3ed3c
Merge branch 'pull-request/2163'
* pull-request/2163:
  import explicit_bzero + strlc* functions update since 1999 algorithms have changed and register k/w not necessary anymore.
2017-01-03 06:48:40 +00:00
Sammy Kaye Powers
9e29f841ce Update copyright headers to 2017 2017-01-02 09:30:12 -06:00
Sara Golemon
6f3945a9f1 Use new param API in standard 2016-12-30 12:56:21 -08:00
David Carlier
1ece764114 let s use the macro instead 2016-10-15 17:55:44 +01:00
David Carlier
2464dbd5f3 import explicit_bzero + strlc* functions update
since 1999 algorithms have changed and register k/w
not necessary anymore.
2016-10-15 14:53:38 +01:00
Anatol Belski
435048935e Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Bug #73058 crypt broken when salt is 'too' long
2016-09-10 02:49:30 +02:00
Anatol Belski
e539ea439b Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Bug #73058 crypt broken when salt is 'too' long
2016-09-10 02:44:21 +02:00
Anatol Belski
669fda00b7 Bug #73058 crypt broken when salt is 'too' long 2016-09-10 02:39:28 +02:00
Anatol Belski
22a825db85 Merge branch 'PHP-7.0' into PHP-7.1
* PHP-7.0:
  Fixed bug #72703 Out of bounds global memory read in BF_crypt triggered by password_verify
2016-08-29 20:34:44 +02:00
Anatol Belski
946335ba70 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Fixed bug #72703 Out of bounds global memory read in BF_crypt triggered by password_verify
2016-08-29 20:32:55 +02:00
Anatol Belski
295303b590 Fixed bug #72703 Out of bounds global memory read in BF_crypt triggered by password_verify 2016-08-29 20:25:34 +02:00
Xinchen Hui
82ba5b59d9 Fixed warning: "operation on ‘s’ may be undefined" 2016-08-02 20:28:42 +08:00
Leigh
be3640150c Fix crypt salt not being converted to b64 2016-07-07 15:32:38 +01:00
Leigh
b21de28bb7 Fix some insecure usages of php_rand 2016-07-05 16:02:34 +01:00
Nikita Popov
d3ed75b9eb Remove HAVE_CRYPT checks
We always provide a crypt implementation. HAVE_CRYPT is only
relevant as to whether the crypt() C function exists.
2016-03-25 21:09:47 +01:00
Nikita Popov
786effaff6 Remove PHP_*_CRYPT constants
They are always 1.
2016-03-25 20:48:34 +01:00
Nikita Popov
bd90f5507f Merge branch 'PHP-5.6' into PHP-7.0
Conflicts:
	ext/standard/crypt.c
2016-03-25 20:23:04 +01:00
Nikita Popov
54da966883 Fixed bug #67512 2016-03-25 20:18:46 +01:00
Lior Kaplan
ed35de784f Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Happy new year (Update copyright to 2016)
2016-01-01 19:48:25 +02:00
Lior Kaplan
49493a2dcf Happy new year (Update copyright to 2016) 2016-01-01 19:21:47 +02:00
Anthony Ferrara
ed4052f1d5 Fixed bug #69686 password_verify reports back error on PHP7 will null string.
The deprecation of DES salts created a warning when trying to verify them with password_hash. This bug fix adds a quiet mode to php_crypt() which is used by password_verify.
2015-05-21 17:12:51 -04:00
Stanislav Malyshev
c408c80886 Merge branch 'pull-request/989'
* pull-request/989:
  Fix a few tests and remove error/warning for *0
  Fix spaces -> tabs
  Add deprecated notice to invalid DES salts.
2015-01-31 22:04:39 -08:00
Xinchen Hui
fc33f52d8c bump year 2015-01-15 23:27:30 +08:00
Xinchen Hui
0579e8278d bump year 2015-01-15 23:26:37 +08:00
Anthony Ferrara
4a2fe3d0ab Fix a few tests and remove error/warning for *0 2015-01-13 11:49:09 -05:00