Skip to content

Commit cbca8a8

Browse files
committed
Merge branch 'PHP-7.4'
* PHP-7.4: [ci skip] Fix CS in Markdown files
2 parents 4767c41 + 1c94aac commit cbca8a8

File tree

11 files changed

+1032
-932
lines changed

11 files changed

+1032
-932
lines changed

README.md

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -48,31 +48,38 @@ PHP uses autotools on Unix systems to configure the build:
4848

4949
*See `make -h` for make options.*
5050

51-
The `-j` option shall set the maximum number of jobs `make` can use for the build:
51+
The `-j` option shall set the maximum number of jobs `make` can use for the
52+
build:
5253

5354
make -j4
5455

55-
Shall run `make` with a maximum of 4 concurrent jobs: Generally the maximum number of jobs should not exceed the number of cores available.
56+
Shall run `make` with a maximum of 4 concurrent jobs: Generally the maximum
57+
number of jobs should not exceed the number of cores available.
5658

5759
## Testing PHP source code
5860

59-
PHP ships with an extensive test suite, the command `make test` is used after successful compilation of the sources to run this test suite.
61+
PHP ships with an extensive test suite, the command `make test` is used after
62+
successful compilation of the sources to run this test suite.
6063

61-
It is possible to run tests using multiple cores by setting `-jN` in `TEST_PHP_ARGS`:
64+
It is possible to run tests using multiple cores by setting `-jN` in
65+
`TEST_PHP_ARGS`:
6266

6367
make TEST_PHP_ARGS=-j4 test
6468

65-
Shall run `make test` with a maximum of 4 concurrent jobs: Generally the maximum number of jobs should not exceed the number of cores available.
69+
Shall run `make test` with a maximum of 4 concurrent jobs: Generally the maximum
70+
number of jobs should not exceed the number of cores available.
6671

67-
The [qa.php.net](https://qa.php.net) site provides more detailed info about testing and quality assurance.
72+
The [qa.php.net](https://qa.php.net) site provides more detailed info about
73+
testing and quality assurance.
6874

6975
## Installing PHP built from source
7076

7177
After a successful build (and test), PHP may be installed with:
7278

7379
make install
7480

75-
Depending on your permissions and prefix, `make install` may need super user permissions.
81+
Depending on your permissions and prefix, `make install` may need super user
82+
permissions.
7683

7784
## PHP extensions
7885

docs/input-filter.md

Lines changed: 20 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,23 @@
1-
# Input Filter Support in PHP 5
2-
3-
XSS (Cross Site Scripting) hacks are becoming more and more prevalent,
4-
and can be quite difficult to prevent. Whenever you accept user data
5-
and somehow display this data back to users, you are likely vulnerable
6-
to XSS hacks.
7-
8-
The Input Filter support in PHP 5 is aimed at providing the framework
9-
through which a company-wide or site-wide security policy can be
10-
enforced. It is implemented as a SAPI hook and is called from the
11-
treat_data and post handler functions. To implement your own security
12-
policy you will need to write a standard PHP extension. There is also
13-
a powerful standard implementation in ext/filter that should suit most
14-
peoples' needs. However, if you want to implement your own security
15-
policy, read on.
16-
17-
A simple implementation might look like the following. This stores the
18-
original raw user data and adds a my_get_raw() function while the normal
19-
$_POST, $_GET and $_COOKIE arrays are only populated with stripped
20-
data. In this simple example all I am doing is calling strip_tags() on
21-
the data.
22-
23-
```
1+
# Input filter support in PHP
2+
3+
XSS (Cross Site Scripting) hacks are becoming more and more prevalent, and can
4+
be quite difficult to prevent. Whenever you accept user data and somehow display
5+
this data back to users, you are likely vulnerable to XSS hacks.
6+
7+
The Input Filter support in PHP is aimed at providing the framework through
8+
which a company-wide or site-wide security policy can be enforced. It is
9+
implemented as a SAPI hook and is called from the `treat_data` and post handler
10+
functions. To implement your own security policy you will need to write a
11+
standard PHP extension. There is also a powerful standard implementation in
12+
`ext/filter` that should suit most peoples' needs. However, if you want to
13+
implement your own security policy, read on.
14+
15+
A simple implementation might look like the following. This stores the original
16+
raw user data and adds a `my_get_raw()` function while the normal `$_POST`,
17+
`$_GET` and `$_COOKIE` arrays are only populated with stripped data. In this
18+
simple example all I am doing is calling `strip_tags()` on the data.
19+
20+
```c
2421
ZEND_BEGIN_MODULE_GLOBALS(my_input_filter)
2522
zval *post_array;
2623
zval *get_array;

docs/mailinglist-rules.md

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Mailinglist Rules
1+
# Mailinglist rules
22

33
This is the first file you should be reading before doing any posts on PHP
44
mailinglists. Following these rules is considered imperative to the success of
@@ -19,7 +19,6 @@ following some basic rules with regards to mailinglist usage will:
1919

2020
d. Increase the general level of good will on planet Earth.
2121

22-
2322
Having said that, here are the organizational rules:
2423

2524
1. Respect other people working on the project.
@@ -28,9 +27,9 @@ Having said that, here are the organizational rules:
2827
your post after a good breather or a good nights sleep.
2928

3029
3. Make sure you pick the right mailinglist for your posting. Please review
31-
the descriptions on the mailinglist overview page
32-
(http://www.php.net/mailing-lists.php). When in doubt ask a friend or
33-
someone you trust on IRC.
30+
the descriptions on the
31+
[mailinglist overview page](https://www.php.net/mailing-lists.php). When
32+
in doubt ask a friend or someone you trust on IRC.
3433

3534
4. Make sure you know what you are talking about. PHP is a very large project
3635
that strives to be very open. The flip side is that the core developers
@@ -70,7 +69,7 @@ The next few rules are more some general hints:
7069
new thread.
7170

7271
Finally, additional hints on how to behave inside the virtual community can be
73-
found in RFC 1855 (http://www.faqs.org/rfcs/rfc1855.html).
72+
found in [RFC 1855](http://www.faqs.org/rfcs/rfc1855.html).
7473

7574
Happy hacking,
7675

docs/output-api.md

Lines changed: 131 additions & 134 deletions
Original file line numberDiff line numberDiff line change
@@ -1,139 +1,136 @@
1-
API adjustment to the old output control code:
1+
# API adjustment to the old output control code
22

3-
Everything now resides beneath the php_output namespace,
4-
and there's an API call for every output handler op.
3+
Everything now resides beneath the php_output namespace, and there's an API call
4+
for every output handler op.
55

6-
Checking output control layers status:
7-
// Using OG()
8-
php_output_get_status();
6+
Checking output control layers status:
7+
// Using OG()
8+
php_output_get_status();
99

10-
Starting the default output handler:
11-
// php_start_ob_buffer(NULL, 0, 1);
12-
php_output_start_default();
10+
Starting the default output handler:
11+
// php_start_ob_buffer(NULL, 0, 1);
12+
php_output_start_default();
1313

14-
Starting an user handler by zval:
15-
// php_start_ob_buffer(zhandler, chunk_size, erase);
16-
php_output_start_user(zhandler, chunk_size, flags);
14+
Starting an user handler by zval:
15+
// php_start_ob_buffer(zhandler, chunk_size, erase);
16+
php_output_start_user(zhandler, chunk_size, flags);
1717

18-
Starting an internal handler without context:
19-
// php_ob_set_internal_handler(my_php_output_handler_func_t, buffer_size, "output handler name", erase);
20-
php_output_start_internal(handler_name, handler_name_len, my_php_output_handler_func_t, chunk_size, flags);
21-
22-
Starting an internal handler with context:
23-
// not possible with old API
24-
php_output_handler *h;
25-
h = php_output_handler_create_internal(handler_name, handler_name_len, my_php_output_handler_context_func_t, chunk_size, flags);
26-
php_output_handler_set_context(h, my_context, my_context_dtor);
27-
php_output_handler_start(h);
28-
29-
Testing whether a certain output handler has already been started:
30-
// php_ob_handler_used("output handler name");
31-
php_output_handler_started(handler_name, handler_name_len);
32-
33-
Flushing one output buffer:
34-
// php_end_ob_buffer(1, 1);
35-
php_output_flush();
36-
37-
Flushing all output buffers:
38-
// not possible with old API
39-
php_output_flush_all();
40-
41-
Cleaning one output buffer:
42-
// php_ob_end_buffer(0, 1);
43-
php_output_clean();
44-
45-
Cleaning all output buffers:
46-
// not possible with old API
47-
php_output_clean_all();
48-
49-
Discarding one output buffer:
50-
// php_ob_end_buffer(0, 0);
51-
php_output_discard();
52-
53-
Discarding all output buffers:
54-
// php_ob_end_buffers(0);
55-
php_output_discard_all();
56-
57-
Stopping (and dropping) one output buffer:
58-
// php_ob_end_buffer(1, 0)
59-
php_output_end();
60-
61-
Stopping (and dropping) all output buffers:
62-
// php_ob_end_buffers(1, 0);
63-
php_output_end_all();
64-
65-
Retrieving output buffers contents:
66-
// php_ob_get_buffer(zstring);
67-
php_output_get_contents(zstring);
68-
69-
Retrieving output buffers length:
70-
// php_ob_get_length(zlength);
71-
php_output_get_length(zlength);
72-
73-
Retrieving output buffering level:
74-
// OG(nesting_level);
75-
php_output_get_level();
76-
77-
Issue a warning because of an output handler conflict:
78-
// php_ob_init_conflict("to be started handler name", "to be tested if already started handler name");
79-
php_output_handler_conflict(new_handler_name, new_handler_name_len, set_handler_name, set_handler_name_len);
80-
81-
Registering a conflict checking function, which will be checked prior starting the handler:
82-
// not possible with old API, unless hardcoding into output.c
83-
php_output_handler_conflict_register(handler_name, handler_name_len, my_php_output_handler_conflict_check_t);
84-
85-
Registering a reverse conflict checking function, which will be checked prior starting the specified foreign handler:
86-
// not possible with old API
87-
php_output_handler_reverse_conflict_register(foreign_handler_name, foreign_handler_name_len, my_php_output_handler_conflict_check_t);
88-
89-
Facilitating a context from within an output handler callable with ob_start():
90-
// not possible with old API
91-
php_output_handler_hook(PHP_OUTPUT_HANDLER_HOOK_GET_OPAQ, (void *) &custom_ctx_ptr_ptr);
92-
93-
Disabling of the output handler by itself:
94-
//not possible with old API
95-
php_output_handler_hook(PHP_OUTPUT_HANDLER_HOOK_DISABLE, NULL);
96-
97-
Marking an output handler immutable by itself because of irreversibility of its operation:
98-
// not possible with old API
99-
php_output_handler_hook(PHP_OUTPUT_HANDLER_HOOK_IMMUTABLE, NULL);
100-
101-
Restarting the output handler because of a CLEAN operation:
102-
// not possible with old API
103-
if (flags & PHP_OUTPUT_HANDLER_CLEAN) { ... }
104-
105-
Recognizing by the output handler itself if it gets discarded:
106-
// not possible with old API
107-
if ((flags & PHP_OUTPUT_HANDLER_CLEAN) && (flags & PHP_OUTPUT_HANDLER_FINAL)) { ... }
108-
109-
110-
Output handler hooks
111-
112-
The output handler can change its abilities at runtime. Eg. the gz handler can
113-
remove the CLEANABLE and REMOVABLE bits when the first output has passed through it;
114-
or handlers implemented in C to be used with ob_start() can contain a non-global
115-
context:
116-
PHP_OUTPUT_HANDLER_HOOK_GET_OPAQ
117-
pass a void*** pointer as second arg to receive the address of a pointer
118-
pointer to the opaque field of the output handler context
119-
PHP_OUTPUT_HANDLER_HOOK_GET_FLAGS
120-
pass a int* pointer as second arg to receive the flags set for the output handler
121-
PHP_OUTPUT_HANDLER_HOOK_GET_LEVEL
122-
pass a int* pointer as second arg to receive the level of this output handler
123-
(starts with 0)
124-
PHP_OUTPUT_HANDLER_HOOK_IMMUTABLE
125-
the second arg is ignored; marks the output handler to be neither cleanable
126-
nor removable
127-
PHP_OUTPUT_HANDLER_HOOK_DISABLE
128-
the second arg is ignored; marks the output handler as disabled
129-
130-
131-
Open questions
132-
133-
Should the userland API be adjusted and unified?
134-
135-
Many bits of the manual (and very first implementation) do not comply
136-
with the behaviour of the current (to be obsoleted) code, thus should
137-
the manual or the behaviour be adjusted?
138-
139-
END
18+
Starting an internal handler without context:
19+
// php_ob_set_internal_handler(my_php_output_handler_func_t, buffer_size, "output handler name", erase);
20+
php_output_start_internal(handler_name, handler_name_len, my_php_output_handler_func_t, chunk_size, flags);
21+
22+
Starting an internal handler with context:
23+
// not possible with old API
24+
php_output_handler *h;
25+
h = php_output_handler_create_internal(handler_name, handler_name_len, my_php_output_handler_context_func_t, chunk_size, flags);
26+
php_output_handler_set_context(h, my_context, my_context_dtor);
27+
php_output_handler_start(h);
28+
29+
Testing whether a certain output handler has already been started:
30+
// php_ob_handler_used("output handler name");
31+
php_output_handler_started(handler_name, handler_name_len);
32+
33+
Flushing one output buffer:
34+
// php_end_ob_buffer(1, 1);
35+
php_output_flush();
36+
37+
Flushing all output buffers:
38+
// not possible with old API
39+
php_output_flush_all();
40+
41+
Cleaning one output buffer:
42+
// php_ob_end_buffer(0, 1);
43+
php_output_clean();
44+
45+
Cleaning all output buffers:
46+
// not possible with old API
47+
php_output_clean_all();
48+
49+
Discarding one output buffer:
50+
// php_ob_end_buffer(0, 0);
51+
php_output_discard();
52+
53+
Discarding all output buffers:
54+
// php_ob_end_buffers(0);
55+
php_output_discard_all();
56+
57+
Stopping (and dropping) one output buffer:
58+
// php_ob_end_buffer(1, 0)
59+
php_output_end();
60+
61+
Stopping (and dropping) all output buffers:
62+
// php_ob_end_buffers(1, 0);
63+
php_output_end_all();
64+
65+
Retrieving output buffers contents:
66+
// php_ob_get_buffer(zstring);
67+
php_output_get_contents(zstring);
68+
69+
Retrieving output buffers length:
70+
// php_ob_get_length(zlength);
71+
php_output_get_length(zlength);
72+
73+
Retrieving output buffering level:
74+
// OG(nesting_level);
75+
php_output_get_level();
76+
77+
Issue a warning because of an output handler conflict:
78+
// php_ob_init_conflict("to be started handler name", "to be tested if already started handler name");
79+
php_output_handler_conflict(new_handler_name, new_handler_name_len, set_handler_name, set_handler_name_len);
80+
81+
Registering a conflict checking function, which will be checked prior starting the handler:
82+
// not possible with old API, unless hardcoding into output.c
83+
php_output_handler_conflict_register(handler_name, handler_name_len, my_php_output_handler_conflict_check_t);
84+
85+
Registering a reverse conflict checking function, which will be checked prior starting the specified foreign handler:
86+
// not possible with old API
87+
php_output_handler_reverse_conflict_register(foreign_handler_name, foreign_handler_name_len, my_php_output_handler_conflict_check_t);
88+
89+
Facilitating a context from within an output handler callable with ob_start():
90+
// not possible with old API
91+
php_output_handler_hook(PHP_OUTPUT_HANDLER_HOOK_GET_OPAQ, (void *) &custom_ctx_ptr_ptr);
92+
93+
Disabling of the output handler by itself:
94+
//not possible with old API
95+
php_output_handler_hook(PHP_OUTPUT_HANDLER_HOOK_DISABLE, NULL);
96+
97+
Marking an output handler immutable by itself because of irreversibility of its operation:
98+
// not possible with old API
99+
php_output_handler_hook(PHP_OUTPUT_HANDLER_HOOK_IMMUTABLE, NULL);
100+
101+
Restarting the output handler because of a CLEAN operation:
102+
// not possible with old API
103+
if (flags & PHP_OUTPUT_HANDLER_CLEAN) { ... }
104+
105+
Recognizing by the output handler itself if it gets discarded:
106+
// not possible with old API
107+
if ((flags & PHP_OUTPUT_HANDLER_CLEAN) && (flags & PHP_OUTPUT_HANDLER_FINAL)) { ... }
108+
109+
## Output handler hooks
110+
111+
The output handler can change its abilities at runtime. Eg. the gz handler can
112+
remove the CLEANABLE and REMOVABLE bits when the first output has passed through it;
113+
or handlers implemented in C to be used with ob_start() can contain a non-global
114+
context:
115+
116+
PHP_OUTPUT_HANDLER_HOOK_GET_OPAQ
117+
pass a void*** pointer as second arg to receive the address of a pointer
118+
pointer to the opaque field of the output handler context
119+
PHP_OUTPUT_HANDLER_HOOK_GET_FLAGS
120+
pass a int* pointer as second arg to receive the flags set for the output handler
121+
PHP_OUTPUT_HANDLER_HOOK_GET_LEVEL
122+
pass a int* pointer as second arg to receive the level of this output handler
123+
(starts with 0)
124+
PHP_OUTPUT_HANDLER_HOOK_IMMUTABLE
125+
the second arg is ignored; marks the output handler to be neither cleanable
126+
nor removable
127+
PHP_OUTPUT_HANDLER_HOOK_DISABLE
128+
the second arg is ignored; marks the output handler as disabled
129+
130+
## Open questions
131+
132+
* Should the userland API be adjusted and unified?
133+
134+
Many bits of the manual (and very first implementation) do not comply with the
135+
behaviour of the current (to be obsoleted) code, thus should the manual or the
136+
behaviour be adjusted?

0 commit comments

Comments
 (0)