Re: [PHP-DEV] removing http line folding support?

2015-02-04 Thread Michael Wallner
On 04/02/15 08:24, Stanislav Malyshev wrote: Hi! Our header() function supports multiline HTTP headers, which are allowed by RFC 2616. However, newer RFC - https://tools.ietf.org/html/rfc7230#section-3.2.4 - deprecates them and says: Historically, HTTP header field values could be

Re: [PHP-DEV] removing http line folding support?

2015-02-04 Thread Yasuo Ohgaki
Hi Stas, On Wed, Feb 4, 2015 at 4:24 PM, Stanislav Malyshev smalys...@gmail.com wrote: So, my question is - any objections for dropping this functionality? I'd be inclined to drop it in all versions from 5.4 up since it may still be confusing some not too smart clients that don't implement

Re: [PHP-DEV] removing http line folding support?

2015-02-04 Thread Stanislav Malyshev
Hi! How about replacing \r and \n with spaces and throwing E_DEPRECATED instead? I'd rather not mangle supplied data in such sensitive area. If it's wrong, then it's wrong. -- Stas Malyshev smalys...@gmail.com -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit:

Re: [PHP-DEV] removing http line folding support?

2015-02-04 Thread Nikita Popov
On Wed, Feb 4, 2015 at 8:24 AM, Stanislav Malyshev smalys...@gmail.com wrote: Hi! Our header() function supports multiline HTTP headers, which are allowed by RFC 2616. However, newer RFC - https://tools.ietf.org/html/rfc7230#section-3.2.4 - deprecates them and says: Historically, HTTP

Re: [PHP-DEV] removing http line folding support?

2015-02-04 Thread Yasuo Ohgaki
Hi all, On Wed, Feb 4, 2015 at 5:22 PM, Michael Wallner m...@php.net wrote: Don't we prevent that already? http://lxr.php.net/xref/PHP_5_6/main/SAPI.c#749 I don't expect there is such web server, but \r\r is allowed by this code. I remember that there was mail server treats \r\r as double

Re: [PHP-DEV] removing http line folding support?

2015-02-04 Thread Stanislav Malyshev
Hi! Don't we prevent that already? http://lxr.php.net/xref/PHP_5_6/main/SAPI.c#749 I'm not sure what you meant by that, but the code you linked to allows multi-line headers according to RFC 2616 - this is what comment in line 750 means. I propose to remove this (of course, no newline chars

Re: [PHP-DEV] removing http line folding support?

2015-02-04 Thread Michael Wallner
On 04/02/15 09:52, Stanislav Malyshev wrote: Hi! Don't we prevent that already? http://lxr.php.net/xref/PHP_5_6/main/SAPI.c#749 I'm not sure what you meant by that, but the code you linked to allows multi-line headers according to RFC 2616 - this is what comment in line 750 means. I

Re: [PHP-DEV] removing http line folding support?

2015-02-04 Thread Matteo Beccati
On 04/02/2015 09:52, Stanislav Malyshev wrote: Hi! Don't we prevent that already? http://lxr.php.net/xref/PHP_5_6/main/SAPI.c#749 I'm not sure what you meant by that, but the code you linked to allows multi-line headers according to RFC 2616 - this is what comment in line 750 means. I

Re: [PHP-DEV] removing http line folding support?

2015-02-04 Thread Matteo Beccati
On 04/02/2015 11:58, Leigh wrote: On 4 February 2015 at 09:03, Stanislav Malyshev smalys...@gmail.com wrote: I'd rather not mangle supplied data in such sensitive area. If it's wrong, then it's wrong. Agreed with this approach. Sure, I pointed it out as it's the alternative the RFC itself

Re: [PHP-DEV] removing http line folding support?

2015-02-04 Thread Leigh
On 4 February 2015 at 09:03, Stanislav Malyshev smalys...@gmail.com wrote: I'd rather not mangle supplied data in such sensitive area. If it's wrong, then it's wrong. Agreed with this approach. -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit:

[PHP-DEV] removing http line folding support?

2015-02-03 Thread Stanislav Malyshev
Hi! Our header() function supports multiline HTTP headers, which are allowed by RFC 2616. However, newer RFC - https://tools.ietf.org/html/rfc7230#section-3.2.4 - deprecates them and says: Historically, HTTP header field values could be extended over multiple lines by preceding each extra line