PHP 5.3.7 Released(php.net)
php.net
PHP 5.3.7 Released
http://www.php.net/ChangeLog-5.php#5.3.7
9 comments
This bug really frustrated me. I couldn't figure out how to make a simple blogging application without at least 28,000 bound parameters because the thing kept crashing out.
I'm glad I can now un-hobble my database query and retrieve the full output.
I'm glad I can now un-hobble my database query and retrieve the full output.
Ya seriously, why in the world would you have so many bound parameters?
e.g. a Bayesian classifier that updates word counts:
INSERT INTO words(word, spam, ham) VALUES(?, ?, ?),(?, ?, ?),(?, ?, ?),…
ON DUPLICATE KEY UPDATE …
Just bug fixes? If you allow file uploads, you would be wise to upgrade.
Fixed bug #54939 (File path injection vulnerability in RFC1867 File upload filename). Reported by Krzysztof Kotowicz. (CVE-2011-2202)
"The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability."
Fixed bug #54939 (File path injection vulnerability in RFC1867 File upload filename). Reported by Krzysztof Kotowicz. (CVE-2011-2202)
"The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability."
Looks like mostly bug fixes.
High level overview anyone?
http://www.php.net/archive/2011.php#id2011-08-18-1
Upgraded some libraries and fixed a pile of bugs, basically. And PHP 5.2 series is NOT supported anymore.
just bug fixes basically. 5.4 is coming out soon which has new features and more major changes
Fixed crash when using more than 28,000 bound parameters. Workaround is to set mysqlnd.net_cmd_buffer_size to at least 9000. (Andrey)
Whew. Thank goodness that's fixed?