Commit graph

1940 commits

Author SHA1 Message Date
Niels Dossche
1bba07ecc0
partitioned option for setcookie/setrawcookie and sessions
RFC: https://wiki.php.net/rfc/CHIPS

Closes GH-12646.
Closes GH-12652.
2025-08-15 08:41:24 +02:00
Gina Peter Banyard
f9d95c649e Update NEWS and UPGRADING for chr() deprecation
Some checks are pending
Push / MACOS_ARM64_DEBUG_NTS (push) Waiting to run
Push / WINDOWS_X64_ZTS (push) Waiting to run
Push / LINUX_X64_RELEASE_NTS (push) Has been skipped
Push / LINUX_X64_DEBUG_ZTS_ASAN (push) Has been skipped
Push / LINUX_X32_DEBUG_ZTS (push) Has been skipped
Push / BENCHMARKING (push) Has been skipped
Push / FREEBSD (push) Has been skipped
2025-08-14 20:51:30 +01:00
Calvin Buckley
60047025db
Remove references to ODBCVER and assume ODBC 3.x (#19453)
* Remove references to ODBCVER and assume ODBC 3.x

See https://wiki.php.net/rfc/deprecations_php_8_5#remove_support_for_older_odbc_versions

* Avoid calling deprecated ODBC functions

`SQLGetConnectOption`, `SQLSetConnectOption` and `SQLSetStmtOption` are
deprecated, so if ODBC 3 is available, we use `SQLSetConnectAttr`,
`SQLGetConnectAttr`, and `SQLSetStmtAttr` instead.

(This is based on GH-17556, but just assumes ODBC 3.x.)

* Remove wrappers for SQLColAttribute

We don't need to support the old way of doing it.

* Just call SQLAllocHandle directly

Again, no need for the version specific wrapper

* Update NEWS for ODBCVER in beta2

* [skip ci] UPGRADING for ODBCVER changes

---------

Co-authored-by: Christoph M. Becker <cmbecker69@gmx.de>
2025-08-12 18:05:43 -03:00
Niels Dossche
77dace78c3
[ci skip] Fix UPGRADING formatting 2025-08-12 22:35:47 +02:00
Jakub Zelenka
20c8c12d9e
Fix #81724: openssl_cms_encrypt only allows specific ciphers
The allows cipher_algo to be specified as a string. It means the not
only predefined ID ciphers are available which means that also auth
enveloped data can be created using AES GCM.

Closes GH-19459
2025-08-12 15:52:09 +02:00
Jiří Pudil
38beb44176
[RFC] Extend #[\Override] to target properties (#19061)
RFC: https://wiki.php.net/rfc/override_properties

Co-authored-by: Tim Düsterhus <tim@bastelstu.be>
2025-08-12 15:18:50 +02:00
Daniel Scherzer
c3bee21256
NEWS/UPGRADING for recent deprecations 2025-08-12 06:05:09 -07:00
Gina Peter Banyard
2b5d978a85
Update NEWS and UPGRADING 2025-08-12 11:53:37 +01:00
Tim Düsterhus
3d9d68e1ca
zend_compile: Deprecate backticks as an alias for shell_exec() (#19443)
RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_backticks_as_an_alias_for_shell_exec
2025-08-12 12:02:13 +02:00
Jakub Zelenka
10834d1572
Fix #47728: Add missing openssl constants
This adds PKCS7_NOSMIMECAP, PKCS7_CRLFEOL, PKCS7_NOCRL and
PKCS7_NO_DUAL_CONTENT constants. They might be potentially useful
in some scenarious.

Test is not added as it is not clear if there is much need for those and
it would require much bigger effort just to test OpenSSL functionality.

Closes GH-19450
2025-08-11 20:46:14 +02:00
Daniel Scherzer
6280dfc025
UPGRADING: document #[\Attribute] validation from GH-19154
[skip ci]
2025-08-11 09:17:06 -07:00
Theodore Brown
5f8d648af6
Deprecate terminating case statements with a semicolon (#19215)
Part of https://wiki.php.net/rfc/deprecations_php_8_5

Closes GH-15258
2025-08-11 14:18:06 +02:00
Tim Düsterhus
d01aa02ef5
UPGRADING: Fix formatting 2025-08-11 13:42:52 +02:00
Jakub Zelenka
702d18de99
Implement #80495: Enable to set padding in openssl_(sign|verify)
This adds support for RSA PSS padding.

Closes GH-19432
2025-08-11 13:11:10 +02:00
Gina Peter Banyard
e990b691c5
Update NEWS and UPGRADING for recent deprecation merges 2025-08-09 23:12:05 +01:00
Gina Peter Banyard
d65025b53d
Update NEWS/UPGRADING for recent commits 2025-08-09 11:49:42 +01:00
Gina Peter Banyard
7b44bfd812
UPGRADING and NEWS for recent 8.5 deprecations 2025-08-08 21:45:02 +01:00
Frederik Milling Pytlick
4e21924271
Fix GH-17951: Addition of max_memory_limit INI
Closes GH-18011
2025-08-04 16:04:25 +02:00
Alexandre Daubois
345e04b619
[skip ci] Fix typos in NEWS, UPGRADING and UPGRADING.INTERNALS (#19341) 2025-08-02 20:36:39 +02:00
Daniel Scherzer
6f630a882d
NEWS/UPGRADING: fix missing __ in __toString()
Forgotten by yours truly in 36ae82b73e

[skip ci]
2025-07-31 17:38:23 -07:00
Daniel Scherzer
63f9e4945d
GH-17927: Indicate virtual properties and hooks in reflection output (#19297) 2025-07-31 17:32:09 -07:00
David Carlier
f72105be81
ext/posix: value ranges check for posix_setrlimit and posix_setpgid
setpgid accepts values from 0 to "PID_MAX".
for setrlimit the culprit is using zend_long to represent rlim_t
but at least we accept -1 for RLIM_INFINITY, however rl_cur should
not be greater than rl_max value.

close GH-19281
2025-07-29 13:10:26 +01:00
Jakub Zelenka
cfb3e98c84
FPM: Implement configurable access log limit
It sets the access log limit as configurable log_limit to allow larger
log limit than the currently fixed limit of 1024 characters.

Fixes GH-12302
Closes GH-18725
2025-07-29 11:32:01 +02:00
David Carlier
3b4f2b0798
ext/posix: posix_kill() process_id range check.
pid_t is, for the most part, represented by a signed int, by overflowing
it, we end up being in the -1 case which affect all accessible processes.

close GH-18944
2025-07-28 15:31:14 +01:00
Arnaud Le Blanc
7b3e68ff69
Fix error handling inconsistency with opcache
When opcache is enabled, error handling is altered in the following ways:

 * Errors emitted during compilation bypass the user-defined error handler
 * Exceptions emitted during class linking are turned into fatal errors

Changes here make the behavior consistent regardless of opcache being enabled or
not:

 * Errors emitted during compilation and class linking are always delayed and
   handled after compilation or class linking. During handling, user-defined
   error handlers are not bypassed. Fatal errors emitted during compilation or
   class linking cause any delayed errors to be handled immediately (without
   calling user-defined error handlers, as it would be unsafe).
 * Exceptions thrown by user-defined error handlers when handling class linking
   error are not promoted to fatal errors anymore and do not prevent linking.

Fixes GH-17422.
Closes GH-18541.
Closes GH-17627.

Co-authored-by: Tim Düsterhus <tim@bastelstu.be>
2025-07-27 11:01:49 +02:00
Arnaud Le Blanc
7b4c14dc10
Make OPcache non-optional
This removes the --enable-opcache/--disable-opcache configure switch. OPcache
is now always builtin. The default value of opcache.enable and
opcache.enable_cli is unchanged.

RFC: https://wiki.php.net/rfc/make_opcache_required

Closes GH-18961.

Co-authored-by: Tim Düsterhus <tim@tideways-gmbh.com>
2025-07-27 09:40:22 +02:00
Ayesh Karunaratne
6f3bc59950
ext/curl: Add CURLOPT_SSL_SIGNATURE_ALGORITHMS option
Adds support for `CURLOPT_SSL_SIGNATURE_ALGORITHMS`[^1], supported
since Curl version 8.14.0.

[^1]: https://curl.se/libcurl/c/CURLOPT_SSL_SIGNATURE_ALGORITHMS.html

Closes GH-18692
2025-07-26 20:17:05 +02:00
Tim Düsterhus
a2d8ee27f2
opcache: Disallow changing opcache.memory_consumption when SHM is set up (#19146)
* opcache: Reset `accel_startup_ok` after shutting down

This is necessary for phpdbg, which runs multiple startup/shutdown cycles in
the same process.

* opcache: Disallow changing `opcache.memory_consumption` when SHM is set up

Normally changing the INI value is not possible after SHM is set up, since it
is `PHP_INI_SYSTEM`. FPM is a notable exception: SHM is set up in the master
process, but when spawning the individual pools, the `php_admin_value` config
option can be used to change `PHP_INI_SYSTEM` INIs on a per-pool basis. This
does not work for this option, since it will only be read on early start,
leading to misleading PHPInfo output, since the INI value appears to be
successfully set and since some of the calculated values are derived from the
INI value rather than the actual value.
2025-07-25 18:36:47 +02:00
Jakub Zelenka
b1fce8a98c
Add digest algo param to public encrypt and private decrypt
Specifically, it is added to openssl_public_encrypt() and
openssl_private_decrypt() functions. The purpose is to specify digest
algorithm for OEAP padding. It currently defaults to SHA1 for some
OpenSSL versions which is not preferred for modern setup and causes
problems in compatibility with web crypto.

Closes GH-19223
2025-07-25 12:56:47 +02:00
Alexandre Daubois
d292968f7c
Add ReflectionProperty::getMangledName() (#18980) 2025-07-22 12:24:27 -07:00
DanielEScherzer
745e81bfd0
UPGRADING: clean up a few entries [skip ci] (#19204)
Co-authored-by: Tim Düsterhus <tim@tideways-gmbh.com>
2025-07-22 10:12:23 -07:00
Niels Dossche
95f1350ca8
NEWS and UPGRADING for array_chunk 2025-07-21 23:00:44 +02:00
Ilija Tovilo
eb65ec41b7
Implement Closure::getCurrent() to retrieve current closure
Fixes GH-18163
Closes GH-18167
2025-07-21 16:07:49 +02:00
Tim Düsterhus
7f1b3606a8
main: Add PHP_BUILD_PROVIDER userland constant (#19157)
This constant can be handy for tools like PIE to determine the origin of a PHP
binary to provide better output / diagnostics.

see php/pie#275
see php/php-src#18168
2025-07-21 10:43:14 +02:00
Niels Dossche
726516b8c1 UPGRADING, UPGRADING.INTERNALS, and NEWS for SVG and extensible image API 2025-07-20 12:53:57 +02:00
Benstone Zhang
dfac2da7fb
Add support for HEIF/HEIC to getimagesize
Signed-off-by: Benstone Zhang <benstonezhang@gmail.com>
2025-07-19 19:24:45 +02:00
Tim Düsterhus
7f4076bae0
RFC: Clone with v2 (#18747)
RFC: https://wiki.php.net/rfc/clone_with_v2

Co-authored-by: Volker Dusch <volker@tideways-gmbh.com>
2025-07-17 21:13:42 +02:00
Emre Çalışkan
7fb6afbe9f
Add support for CURLINFO_QUEUE_TIME_T in curl_getinfo() (#19147)
This patch adds support for the CURLINFO_QUEUE_TIME_T constant in the
curl_getinfo() function when compiled with libcurl >= 8.6.0.

CURLINFO_QUEUE_TIME_T This constant allows retrieving the time (in
microseconds) that the request spent in libcurl’s connection queue
before it was sent.
2025-07-17 14:56:07 +02:00
Samuel Melrose
6f1501a601
Add opcache_is_script_cached_in_file_cache() function
Closes GH-16979
2025-07-16 17:37:12 +02:00
Emre Çalışkan
e84320ad75
Add support for CURLINFO_CONN_ID in curl_getinfo() (#18984)
This patch adds support for the CURLINFO_CONN_ID constant in the curl_getinfo() function when compiled with libcurl >= 8.2.0.

CURLINFO_CONN_ID allows retrieving the unique identifier of the underlying connection used in the most recent transfer. This is useful for advanced features like connection reuse tracking, diagnostics, or connection pooling implementations at the PHP level.
2025-07-16 11:08:19 +02:00
Máté Kocsis
02b94556cf
Add missing news and upgrading notes for ext/uri
[skip ci]
2025-07-15 22:45:59 +02:00
David Carlier
64852b44b5
ext/sockets: multicast on unsupported socket type error change.
From a mere warning to an exception.

close GH-19114
2025-07-15 13:05:13 +01:00
Niels Dossche
9121b015c1
Implement GH-18550: Implement getElementsByClassName() (#19108)
Spec: https://dom.spec.whatwg.org/#ref-for-dom-element-getelementsbyclassname
2025-07-14 21:53:37 +02:00
Jakub Zelenka
b750aa8bfc
[ci skip] Update NEWS and UPGRADING with OpenSSL libctx changes 2025-07-14 15:23:54 +02:00
Niels Dossche
e013b4a91e
Make cloning DOM node lists, maps, and collections fail
This never worked and creates a broken object,
and on master can cause a crash with foreach.
It makes no sense to fix a behaviour that never worked, block it
instead.

Closes GH-19089.
2025-07-11 10:34:25 +02:00
Calvin Buckley
0d584c32c5
pdo_odbc: Don't fetch 256 byte blocks for long columns (#10809)
* pdo_odbc: Don't fetch 256 byte blocks for long columns

Fetching 256 byte blocks can confuse some drivers with conversion
routines. That, and it seems to me the round trips to and from a
database could be a major performance impact.

Instead, we try to fetch all at once, and continue fetching if a
driver somehow has more for us.

This has been tested with a problematic case with the Db2i driver
with stateful MBCS encodings.

See GH-10733 for discussion about this and issues it can resolve.

* change to separate by 256 bytes, when C->fetched_len == SQL_NO_TOTAL

change to separate by 256 bytes, when C->fetched_len == SQL_NO_TOTAL

changed from 256 byte to 2048 byte buf block.

* Make long column buffer size single define

Could be configurable maybe, but best to avoid magic numbers even for a
compile-time constant.

* Use ZendMM page size minus zend_string overhead

Change recommended by Christoph.

Probably a little better performance wise I have to guess.

* [skip ci] Update comment to mention constant

* Update UPGRADING for PDO_ODBC change

mention GH issues in UPGRADING too

* Update NEWS for PDO_ODBC change

---------

Co-authored-by: SakiTakamachi <saki@sakiot.com>
2025-07-10 13:03:11 -03:00
DanielEScherzer
07f1cfd9b0
Deprecate producing output in a user output handler (#19067)
https://wiki.php.net/rfc/deprecations_php_8_4
2025-07-09 21:20:58 -07:00
DanielEScherzer
d8577d9bfb
Deprecate returning non-string values from a user output handler (#18932)
https://wiki.php.net/rfc/deprecations_php_8_4
2025-07-07 14:31:13 -07:00
Niels Dossche
6cc21c4ee6
Optimize pack()
Instead of using lookup tables, we can use a combination of shifts and
byte swapping to achieve the same thing in less cycles and with less
code.

Benchmark files
---------------

pack1.php:
```php
for ($i = 0; $i < 10_000_000; ++$i) {
    pack("J", 0x7FFFFFFFFFFFFFFF);
}
```

pack2.php:
```php
for ($i = 0; $i < 4000000; ++$i) {
    pack("nvc*", 0x1234, 0x5678, 65, 66);
}
```

On an i7-4790:
```
Benchmark 1: ./sapi/cli/php pack1.php
  Time (mean ± σ):     408.8 ms ±   3.4 ms    [User: 406.1 ms, System: 1.6 ms]
  Range (min … max):   403.6 ms … 413.6 ms    10 runs

Benchmark 2: ./sapi/cli/php_old pack1.php
  Time (mean ± σ):     451.7 ms ±   7.7 ms    [User: 448.5 ms, System: 2.0 ms]
  Range (min … max):   442.8 ms … 461.2 ms    10 runs

Summary
  ./sapi/cli/php pack1.php ran
    1.11 ± 0.02 times faster than ./sapi/cli/php_old pack1.php

Benchmark 1: ./sapi/cli/php pack2.php
  Time (mean ± σ):     239.3 ms ±   6.0 ms    [User: 236.2 ms, System: 2.3 ms]
  Range (min … max):   233.2 ms … 256.8 ms    12 runs

Benchmark 2: ./sapi/cli/php_old pack2.php
  Time (mean ± σ):     271.9 ms ±   3.3 ms    [User: 269.7 ms, System: 1.3 ms]
  Range (min … max):   267.4 ms … 279.0 ms    11 runs

Summary
  ./sapi/cli/php pack2.php ran
    1.14 ± 0.03 times faster than ./sapi/cli/php_old pack2.php
```

On an i7-1185G7:
```
Benchmark 1: ./sapi/cli/php pack1.php
  Time (mean ± σ):     263.7 ms ±   1.8 ms    [User: 262.6 ms, System: 0.9 ms]
  Range (min … max):   261.5 ms … 268.2 ms    11 runs

Benchmark 2: ./sapi/cli/php_old pack1.php
  Time (mean ± σ):     303.3 ms ±   6.5 ms    [User: 300.7 ms, System: 2.3 ms]
  Range (min … max):   297.4 ms … 318.1 ms    10 runs

Summary
  ./sapi/cli/php pack1.php ran
    1.15 ± 0.03 times faster than ./sapi/cli/php_old pack1.php

Benchmark 1: ./sapi/cli/php pack2.php
  Time (mean ± σ):     156.7 ms ±   2.9 ms    [User: 154.7 ms, System: 1.7 ms]
  Range (min … max):   151.6 ms … 164.7 ms    19 runs

Benchmark 2: ./sapi/cli/php_old pack2.php
  Time (mean ± σ):     174.6 ms ±   3.3 ms    [User: 171.9 ms, System: 2.3 ms]
  Range (min … max):   170.7 ms … 180.4 ms    17 runs

Summary
  ./sapi/cli/php pack2.php ran
    1.11 ± 0.03 times faster than ./sapi/cli/php_old pack2.php
```

Closes GH-18524.

Co-authored-by: divinity76 <divinity76@gmail.com>
2025-07-07 22:28:12 +02:00
Niels Dossche
c7c6a79bd0
Add support for ParentNode::$children (#18908)
ParentNode::$children returns a HTMLCollection of all directly
descendant child elements of a container.

I had to move around some properties such that the ParentNode property
offsets are always at a fixed offset, to simplify the code.
This also adds the necessary code to deal with GC cycles in
HTMLCollections.
Furthermore, we also disable cloning a HTMLCollection as that never
worked and furthermore it also conflicts with the [[SameObject]] WebIDL
requirement of $children.
2025-06-27 09:03:50 +02:00