# changelog

author: crrodriguez@suse.de
changelog:
  - Update to version 5.2.9, security and bugfix release
    * VUL-0: php5: memory disclosure by imagerotate() [bnc#480850]
    * VUL-0: php5: mbstring.func_overload set in .htaccess becomes global [bnc#471419]
    * Fixed a segfault when malformed string is passed to json_decode()
    * Fixed explode() behavior with empty string to respect negative limit.


author: crrodriguez@suse.de
changelog:
  - update to PHP 5.2.10
    * Fixed bug #48378 (exif_read_data() segfaults on certain corrupted .jpeg files)
    * Added "ignore_errors" option to http fopen wrapper. (David Zulke, Sara)
    * Fixed memory corruptions while reading properties of zip files. (Ilia)
    * Fixed memory leak in ob_get_clean/ob_get_flush. (Christian)
    * Fixed segfault on invalid session.save_path. (Hannes)
    * Fixed leaks in imap when a mail_criteria is used. (Pierre)
    * Changed default value of array_unique()'s optional sorting type parameter back to SORT_STRING to fix backwards compatibility breakage introduced in PHP 5.2.9. (Moriyoshi)
    * Fixed bug #47940 (memory leaks in imap_body). (Pierre, Jake Levitt)
    * Fixed bug #47903 ("@" operator does not work with string offsets). (Felipe)
    * Fixed bug #47644 (Valid integers are truncated with json_decode()). (Scott)
    * Fixed bug #47564 (unpacking unsigned long 32bit big endian returns wrong result). (Ilia)
    * Fixed bug #47365 (ip2long() may allow some invalid values on certain 64bit systems).
    * Over 100 bug fixes.


author: crrodriguez@suse.de
changelog:
  -  Upgrade to PHP 5.3, see http://www.php.net/ChangeLog-5.php
    for the huge list of changes
  -  remove dbase and ncurses extension


author: crrodriguez@suse.de
changelog:
  - update suhosin extension to version 0.9.29
  - mysql extensions now use mysqlnd instead of libmysqlclient.
  - enable sqlite3 extension, part of the php5-sqlite package
  - enable enchant extension
  - enable fileinfo extension
  - enable intl extension


author: crrodriguez@suse.de
changelog:
  - remove obsolete patches
  - apply ini patch
  - enable mhash compatibility in the hash extension and obsolete php5-mhash
  - add macros.php to the source list


author: dimstar@opensuse.org
changelog:
  - Add php5-autoconf-2.65.patch to fix build with autoconf 2.65; it's
    a backported combination of svn commits 291283, 291284 and
    291332.
  - Workaround old php bug http://bugs.php.net/bug.php?id=21153 by
    replacing -ledit with -ledit -lncurses in the resulting configure
    scripts. This became apparent problem due to libedit being built
    with as-needed now.
  - Add php5-bug51224.patch to fix buffer overflows happening in
    strcpy. It;s a combination of upstream svn revs 284097 and 284099


author: cristian.rodriguez@opensuse.org
changelog:
  - Update to PHP 5.3.3 RC3
  - Massive lot of security fixes see list
    here http://www.php-security.org/category/vulnerabilities/index.html


author: cristian.rodriguez@opensuse.org
changelog:
  - Clarify changelog this update fixed:
    * VUL-0: php5 new unserialize() flaw CVE-2010-2225 [bnc#616232]
    * VUL-0: php5: MOPS-2010-021: fnmatch() Stack Exhaustion Vulnerability [bnc#605097]
    * VUL-0: php5: MOPS-2010-017: preg_quote() Interruption Information Leak [bnc#605100]
    * VUL-0: php5: MOPS-2010-022 use after free [bnc#609763]
    * VUL-0: php5-phar: MOPS-2010-0{24,25,26,27,28} format string bugs [bnc#609766]
    * VUL-0: php5: MOPS-2010-0{32,33,34} use space interruption in iconv functions [bnc#609768]
    * VUL-0: php5: MOPS-2010-0{36,37,38,39,40} userspace interruptions [bnc#609769]
    * VUL-0: php5: MOPS-2010-0{36..46} userspace interruptions [bnc#609769]
    * VUL-0: php5: MOPS-2010-047/048 information leak [bnc#612555]
    * VUL-0: php5: MOPS-2010-049/50/51/52/53/54/55 memory corruption and/or info leak [bnc#612556]
    * VUL-0: PHP5: Session Data Injection Vulnerability [bnc#619483]
    * VUL-0: PHP5: multiple heap based buffer overflows [bnc#619486]
    * bugzilla numbers 619487,619489,619469,609766..


author: cristian.rodriguez@opensuse.org
changelog:
  - Update to an slightly newer PHP 5.3.3.x snap, fixes
    around 100 bugs including open_basedir problems.
  - add the fpm sapi to the package.


author: cristian.rodriguez@opensuse.org
changelog:
  - Update to 5.3.3_svn201011020214
    * Fix Performance issue, array_diff may take hours instead
    of seconds in some scenarios,regression appeared in version
    5.2.5


author: cristian.rodriguez@opensuse.org
changelog:
  - Update to PHP 5.3.4 final
    * Fixed crash in zip extract method (possible CWE-170).
    * Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243).
    * Fixed a possible double free in imap extension (Identified by Mateusz Kocielski). (CVE-2010-4150).
    * Fixed NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709).
    * Fixed possible flaw in open_basedir (CVE-2010-3436).
    * Fixed MOPS-2010-24, fix string validation. (CVE-2010-2950).
    * Fixed symbolic resolution support when the target is a DFS share.
    * Fixed bug #52929 (Segfault in filter_var with FILTER_VALIDATE_EMAIL with large amount of data) (CVE-2010-3710).
    * Key Bug Fixes in PHP 5.3.4 include:
    * Added stat support for zip stream.
    * Added follow_location (enabled by default) option for the http stream support.
    * Added a 3rd parameter to get_html_translation_table. It now takes a charset hint, like htmlentities et al.
    * Implemented FR #52348, added new constant ZEND_MULTIBYTE to detect zend multibyte at runtime.
    * Multiple improvements to the FPM SAPI.
    * Over 100 other bug fixes.
  - SUSE specific;
    * enable PTY support in proc_open (temporary)


author: cristian.rodriguez@opensuse.org
changelog:
  - fix format string bug in Phar extension I just found
    http://bugs.php.net/bug.php?id=53541 and the underlying
    issue, which is the lack of format attributes in several
    core prototypes.


author: cristian.rodriguez@opensuse.org
changelog:
  - Add  php-5.3.4-dlopen.patch from fedora,makes dlopen to use
    bind_now instead of lazy.
  - Compiler is now in C99 mode for both core and extensions.


author: cristian.rodriguez@opensuse.org
changelog:
  - Update to version 5.3.5, Critical Update
    * Fixed bug #53632 (PHP hangs on numeric value 2.2250738585072011e-308). (CVE-2010-4645)
    Only 32 bit binaries affected, confirmed in factory i586.


author: cristian.rodriguez@opensuse.org
changelog:
  - Use mysqlnd driver, this is a newer PHP-native mysql
    extension, that does not require external libraries.
    Now you can use mysql, mariadb or drizzle without extra libs.
    fixes bnc #661464 and other old feature requests.


author: cristian.rodriguez@opensuse.org
changelog:
  - Go back to libmysql as there is currently no way
    to build shared mysql extensions with mysqlnd. [bnc#661464]


author: cristian.rodriguez@opensuse.org
changelog:
  - export PHP_MYSQLND_ENABLED=yes to solve the mysqlnd problem
    when extensions are built shared. [bnc#661464]


author: chris@computersalat.de
changelog:
  - extend macros.php
    o __php, __phpize, __php_config, php_version
    o __pear, php_peardir, php_pearxmldir
    o php_pear_gen_filelist
  - add README.macros


author: crrodriguez@opensuse.org
changelog:
  - Upgrade to PHP 5.3.6.RC3
    * Drop obsoleted patches
    * fix some rpmlint warnings
    * Hundreds of changes, see NEWS for details


author: crrodriguez@opensuse.org
changelog:
  - Update to php 5.3.6 final
    * Enforce security in the fastcgi protocol parsing with fpm SAPI.
    * Fixed bug #54247 (format-string vulnerability on Phar). (CVE-2011-1153)
    * Fixed bug #54193 (Integer overflow in shmop_read()). (CVE-2011-1092)
    * Fixed bug #54055 (buffer overrun with high values for precision ini setting).
    * Fixed bug #54002 (crash on crafted tag in exif). (CVE-2011-0708)
    * Fixed bug #53885 (ZipArchive segfault with FL_UNCHANGED on empty archive). (CVE-2011-0421)


author: crrodriguez@opensuse.org
changelog:
  - Intl extension failed to load [bnc#659868]
  - Fix update-alternatives usage,will be dropped in the future.


author: lang@b1-systems.de
changelog:
  - Add a default to date.timezone  because php5 warns that this is a required setting and clutters up the output in zypper installations of pear packages and other places
  - Versions after 5.3.6 may make this fatal


author: crrodriguez@opensuse.org
changelog:
  - Update to a recent 5.3.x SVN version, mostly bug fixes
    * track_errors causes segfault
    * classes from dl()'ed extensions are not destroyed
    * Crash when assigning value to a dimension in a non-array
    * use-after-free in substr_replace()


author: crrodriguez@opensuse.org
changelog:
  - Update to current 5.3 svn version.
  - For practical reasons now the hash extension is built-in,hence
    deprecates package php5-hash, it is nowdays required by the session
    and phar extensions but must be statically built to work.
  - Drop php5-session patch, needed only to workaround compile
    failure when hash extension is built as loadable extension.
  - php.ini now clearly says that by "3" in session.hash_function
    we mean SHA256.


author: crrodriguez@opensuse.org
changelog:
  - Update 5.3 branch
  - Fix a few memory leaks
  - Check if tempfile can be created in phar extension
  - Fix problems with __halt_compiler and imported namespaces
  - Properly handle out of memory conditions in mysqlnd


author: crrodriguez@opensuse.org
changelog:
  - Update to 5.3.6.201105291701
    * Fixes random crash with apache2 SAPI and php_admin_value
    in virtualhost configuration.


author: crrodriguez@opensuse.org
changelog:
  - Drop Update alternatives usage, there are no alternatives
    PHP4 is gone and PHP6 is not coming at any time soon.
  - Remove "mm" support from session module, virtually nothing
    uses it and it doesnt support proper locking, mount
    /var/lib/php5 in tmpfs instead.


author: crrodriguez@opensuse.org
changelog:
  - Update to version 5.3.6.201106031621
  - Crash when calling call_user_func with unknown function name
  - Fixed double registering of browscap ini directive


author: crrodriguez@opensuse.org
changelog:
  - Update 5.3 snap
  - Update bundled PEAR
  - Case discrepancy in timezone names cause Uncaught exception and fatal error.
  - SEEK_CUR with 0 value, returns a warning
  - Restore fix: do not accept paths with NULL in them


author: crrodriguez@opensuse.org
changelog:
  - Update 5.3 snap
  - Fix compiler failure that happended after compile error.
  - Stream not closed and error not returned when SSL CN_match fails.


author: crrodriguez@opensuse.org
changelog:
  - Fix crash in error_log (strlen with NULL)
  - Fixed exit at FPM startup on fpm_resources_prepare
  - Added master rlimit_files and rlimit_core
  - Removed pid in debug logs written by chrildren processes
  - Replaced shm_slots with a real scoreboard


author: crrodriguez@opensuse.org
changelog:
  - Fixed missing Expires and Cache-Control headers for ping and status pages
  - fix crypt() issue with overlong salt
  - Fixed bug #52935 (call exit in user_error_handler cause stream relate core).


author: crrodriguez@opensuse.org
changelog:
  - is_a() function is throwing an annoying warning
    "Unknown class passed as parameter" which is noticeable when
    you use PEAR, fix it, if your code uses it you should be
    using the instanceof operator anyway.
  - Update bundled pear.


author: crrodriguez@opensuse.org
changelog:
  - Add sqlite3 session storage, this is no more than
    a forward port of already existent sqlite2 backend


author: crrodriguez@opensuse.org
changelog:
  - Fix build in Factory
  - Fix Segfault with allow_call_time_pass_reference = Off
  - Using class constants in array definition fails


author: crrodriguez@opensuse.org
changelog:
  - Fix wrong PAGE_SIZE assumption, must use sysconf() instead
  - Fix integer overflow when attempting to use more than 2 Gb
    of memory.


author: pgajdos@suse.com
changelog:
  - build php against system's libcrypt, which drops
    extended DES support
    * crypt-tests.patch
    * no-reentrant-crypt.patch


author: pgajdos@suse.com
changelog:
  - security update:
    * CVE-2011-4885 [bnc#738221] -- added max_input_vars directive
      to prevent attacks based on hash collisions


author: crrodriguez@opensuse.org
changelog:
  - Update to version 5.3.9
    * Drop already applied patches
    * This update only contain minor bug fixes, it is a stop over
      php 5.4.0 that should be out very soon.


author: pgajdos@suse.com
changelog:
  - updated to 5.3.13: various security fixes,
    CVE-2012-1823, CVE-2012-2311, CVE-2012-2335, CVE-2012-2336
    * removed php-5.3.10-pcre_fullinfo.patch
    * refreshed php-5.3.2-aconf26x.patch


author: pgajdos@suse.com
changelog:
  - updated to 5.3.15:
    * fixes over 30 bugs and includes a fix for a security related
      overflow issue in the stream implementation (CVE-2012-2688)
      [bnc#772582] and open_basedir bypass, CVE-2012-3365 [bnc#772580]


author: pgajdos@suse.com
changelog:
  - updated to 5.3.17:
    * Fixed bug (segfault while build with zts and GOTO vm-kind)
    * Fixed bug #62844 (parse_url() does not recognize //
    * etc. see NEWS for details


author: coolo@suse.com
changelog:
  - add explicit buildrequire on libbz2-devel
    (having to patch old .changes file to avoid "double entry")


author: pgajdos@suse.com
changelog:
  - updated to 5.3.21:
    * Fixed bug #63762 (Sigsegv when Exception::$trace is changed by user).
    * Fixed bug (segfault due to libcurl connection caching).
    * Fixed bug #63795 (CURL >= 7.28.0 no longer support value 1 for CURLOPT_SSL_VERIFYHOST).
    etc. see NEWS for details


author: pgajdos@suse.com
changelog:
  - updated to 5.3.22:
    . Fixed bug #64099 (Wrong TSRM usage in zend_Register_class alias). (Johannes)
    . Fixed bug #63899 (Use after scope error in zend_compile). (Laruence)
    . Fixed bug #63943 (Bad warning text from strpos() on empty needle).
      (Laruence)
    . Fixed bug #55397 (comparsion of incomplete DateTime causes SIGSEGV).
      (Laruence, Derick)
    . Fixed bug #63999 (php with fpm fails to build on Solaris 10 or 11). (Adam)
    . Added check that soap.wsdl_cache_dir conforms to open_basedir
      (CVE-2013-1635). (Dmitry)
    . Disabled external entities loading (CVE-2013-1643). (Dmitry)
    . Fixed bug #64106 (Segfault on SplFixedArray[][x] = y when extended). (Nikita Popov)


author: pgajdos@suse.com
changelog:
  - updated to 5.4.12:
    * dropped sqlite.so (no longer shipped with 5.4)
    * dropped t1lib support
    * dropped %{suse_version} 10.x support
    * see /usr/share/doc/packages/php5/UPGRADING or
      http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/UPGRADING
      for details
    * source changes:
      D    php-5.2.9-BNC-457056.patch -- renamed to php5-BNC-457056.patch
      D    php-5.3.0-bnc513080.patch -- there's no relevant code in exif.c
      D    php-5.3.1-systzdata-v7.patch -- renamed to php5-systzdata-v7.patch
      D    php-5.3.2-aconf26x.patch -- dropped, it is not needed yet
      D    php-5.3.2-ini.patch -- renamed to php5-ini.patch
      D    php-5.3.2-no-build-date.patch -- renamed to php5-no-build-date.patch
      D    php-5.3.22.tar.bz2 -- old tarball
      D    php-5.3.4-format-string-issues.patch -- renamed to php5-format-string-issues.patch
      D    php-5.3.4-pts.patch -- renamed to php5-pts.patch
      D    php-5.3.6-gcc_builtins.patch -- renamed to php5-gcc_builtins.patch
      D    php-5.3.6-ini-date.timezone.patch -- part of php5-ini.patch
      D    php-5.3.8-CVE-2011-4153.patch -- fixed in 5.4 branch
      D    php-5.3.8-crypt-tests.patch -- renamed to php5-crypt-tests.patch
      D    php-5.3.8-no-reentrant-crypt.patch -- renamed to php5-no-reentrant-crypt.patch
      A    php-5.4.13.tar.bz2 -- new version tarball
      D    php-cloexec.patch -- renamed to php5-cloexec.patch
      M    php-suse-addons.tar.bz2 -- content of tar balls are actualy equal
      A    php5-BNC-457056.patch -- renamed from php-5.2.9-BNC-457056.patch, not rebased
      A    php5-cloexec.patch -- renamed from php-cloexec.patch, rebased
      A    php5-sytzdata-v7.patch -- renamed from sytzdata-v7.pach, not rebased
      A    php-format-string-issues.patch -- renamed from php5-5.3.4-format-string-issues.patch, not rebased
      A    php5-crypt-tests.patch -- renamed from php-5.3.8-crypt-tests.patch, not rebased
      A    php5-gcc_builtins.patch -- renamed from php-5.3.6-gcc_builtins.patch, not rebased
      A    php5-ini.patch -- renamed from php-5.3.2-ini.patch, rebased
      A    php5-mbstring-missing-return.patch -- new patch, missing return
      M    php5-missing-extdeps.patch -- rebased
      A    php5-no-build-date.patch -- renamed from php-5.3.2-no-build-date.patch, rebased
      A    php5-no-reentrant-crypt.patch -- renamed from php-5.3.8-no-reentrant-crypt.patch, not rebased
      M    php5-openssl.patch -- rebased
      M    php5-phpize.patch -- rebased
      A    php5-pts.patch -- renamed from php-5.3.4-pts.patch, not rebased
      A    php5-suhosin-php54.patch -- patch on top of suhosin-0.9.33.tgz to work with php 5.4
      M    php5.changes -- this change log
      M    php5.spec -- new version, etc
      D    suhosin-patch-5.3.3-0.9.10.patch.gz -- dropped, seems not be used for some time


author: pgajdos@suse.com
changelog:
  - updated to 5.4.13:
      Core:
      Fixed bug #64235 (Insteadof not work for class method in 5.4.11).
      Implemented FR #64175 (Added HTTP codes as of RFC 6585).
      Fixed bug #64142 (dval to lval different behavior on ppc64).
      Fixed bug #64070 (Inheritance with Traits failed with error).
      CLI server:
      Fixed bug #64128 (buit-in web server is broken on ppc64).
      Mbstring:
      mb_split() can now handle empty matches like preg_split() does.
      OpenSSL:
      Fixed bug #61930 (openssl corrupts ssl key resource when using openssl_get_publickey()).
      PDO_mysql:
      Fixed bug #60840 (undefined symbol: mysqlnd_debug_std_no_trace_funcs).
      Phar:
      Fixed timestamp update on Phar contents modification.
      SOAP
      Added check that soap.wsdl_cache_dir conforms to open_basedir (CVE-2013-1635).
      Disabled external entities loading (CVE-2013-1643, CVE-2013-1824).
      SPL:
      Fixed bug #64264 (SPLFixedArray toArray problem).
      Fixed bug #64228 (RecursiveDirectoryIterator always assumes SKIP_DOTS).
      Fixed bug #64106 (Segfault on SplFixedArray[][x] = y when extended).
      Fixed bug #52861 (unset fails with ArrayObject and deep arrays).
      SNMP:
      Fixed bug #64124 (IPv6 malformed).


author: pgajdos@suse.com
changelog:
  - fixed 'http limits uploads to 2GB' [bnc#812800], see
    https://bugs.php.net/bug.php?id=44522
    * 64bit-post-large-files.patch


author: pgajdos@suse.com
changelog:
  - updated to 5.4.14:
      Core:
      Fixed bug #64529 (Ran out of opcode space).
      Fixed bug #64515 (Memoryleak when using the same variablename
      two times in function declaration).
      Fixed bug #64432 (more empty delimiter warning in strX methods).
      Fixed bug #64417 (ArrayAccess::&offsetGet() in a trait causes
      fatal error).
      Fixed bug #64370 (microtime(true) less than $_SERVER['REQUEST_TIME_FLOAT']).
      Fixed bug #64239 (Debug backtrace changed behavior since 5.4.10
      or 5.4.11).
      Fixed bug #63976 (Parent class incorrectly using child constant
      in class property).
      Fixed bug #63914 (zend_do_fcall_common_helper_SPEC does not
      handle exceptions properly).
      Fixed bug #62343 (Show class_alias In get_declared_classes()).
      PCRE:
      Merged PCRE 8.32.
      SNMP:
      Fixed bug #61981 (OO API, walk: $suffix_as_key is not working correctly).
      Zip:
      Fixed bug #64452 (Zip crash intermittently). (Anatol)


author: pgajdos@suse.com
changelog:
  - use current install-pear-nozlib.phar from
    http://pear.php.net/install-pear-nozlib.phar
  - php5-pear package provides/obsoletes php5-pear-Archive_Tar,
    see explanation in the spec


author: adaugherity@tamu.edu
changelog:
  - Conflict with php53 packages so zypper doesn't suggest installing a
    mix of php53-* (from SLES 11) and php5-* (these 5.4 packages).


author: pgajdos@suse.com
changelog:
  - updated to 5.4.15:
      Core:
      Fixed bug #64578 (debug_backtrace in set_error_handler
      corrupts zend heap: segfault).
      Fixed bug #64458 (dns_get_record result with string of
      length -1).
      Fixed bug #64433 (follow_location parameter of context
      is ignored for most response codes).
      Fixed bug #47675 (fd leak on Solaris).
      Fixed bug #64577 (fd leak on Solaris).
      Fileinfo:
      Upgraded libmagic to 5.14.
      Streams:
      Fixed Windows x64 version of stream_socket_pair() and
      improved error handling.
      Zip:
      Fixed bug #64342 (ZipArchive::addFile() has to check
      for file existence).


author: pgajdos@suse.com
changelog:
  - updated to 5.4.16
  - Core:
    . Fixed bug #64879 (Heap based buffer overflow in quoted_printable_encode,
      CVE 2013-2110). (Stas)
    . Fixed bug #64853 (Use of no longer available ini directives causes crash on
      TS build). (Anatol)
    . Fixed bug #64729 (compilation failure on x32). (Gustavo)
    . Fixed bug #64720 (SegFault on zend_deactivate). (Dmitry)
    . Fixed bug #64660 (Segfault on memory exhaustion within function definition).
      (Stas, reported by Juha Kylmänen)
  - Calendar:
    . Fixed bug #64895 (Integer overflow in SndToJewish). (Remi)
  - Fileinfo:
    . Fixed bug #64830 (mimetype detection segfaults on mp3 file). (Anatol)
  - FPM:
    . Ignore QUERY_STRING when sent in SCRIPT_FILENAME. (Remi)
    . Fixed some possible memory or resource leaks and possible null dereference
      detected by code coverity scan. (Remi)
    . Log a warning when a syscall fails. (Remi)
    . Add --with-fpm-systemd option to report health to systemd, and
      systemd_interval option to configure this. The service can now use
      Type=notify in the systemd unit file. (Remi)
  - MySQLi
    . Fixed bug #64726 (Segfault when calling fetch_object on a use_result and DB
      pointer has closed). (Laruence)
  - Phar
    . Fixed bug #64214 (PHAR PHPTs intermittently crash when run on DFS, SMB or
      with non std tmp dir). (Pierre)
  - SNMP:
    . Fixed bug #64765 (Some IPv6 addresses get interpreted wrong).
      (Boris Lytochkin)
    . Fixed bug #64159 (Truncated snmpget). (Boris Lytochkin)
  - Streams:
    . Fixed bug #64770 (stream_select() fails with pipes returned by proc_open()
      on Windows x64). (Anatol)
  - Zend Engine:
    . Fixed bug #64821 (Custom Exceptions crash when internal properties
      overridden). (Anatol)


author: pgajdos@suse.com
changelog:
  - updated to 5.4.17:
      Core:
      Fixed bug #64988 (Class loading order affects E_STRICT warning).
      Fixed bug #64966 (segfault in zend_do_fcall_common_helper_SPEC).
      Fixed bug #64960 (Segfault in gc_zval_possible_root).
      Fixed bug #64936 (doc comments picked up from previous scanner run).
      Fixed bug #64934 (Apache2 TS crash with get_browser()).
      Fixed bug #64166 (quoted-printable-encode stream filter incorrectly
      discarding whitespace).
      DateTime:
      Fixed bug #53437 (Crash when using unserialized DatePeriod instance).
      FPM:
      Fixed bug #64915 (error_log ignored when daemonize=0).
      Implemented FR #64764 (add support for FPM init.d script).
      PDO:
      Fixed bug #63176 (Segmentation fault when instantiate 2 persistent
      PDO to the same db server).
      PDO_DBlib:
      Fixed bug #63638 (Cannot connect to SQL Server 2008 with PDO dblib).
      Fixed bug #64338 (pdo_dblib can't connect to Azure SQL).
      Fixed bug #64808 (FreeTDS PDO getColumnMeta on a prepared but not
      executed statement crashes).
      PDO_firebird:
      Fixed bug #64037 (Firebird return wrong value for numeric field).
      Fixed bug #62024 (Cannot insert second row with null using
      parametrized query).
      PDO_mysql:
      Fixed bug #48724 (getColumnMeta() doesn't return native_type for BIT,
      TINYINT and YEAR).
      PDO_pgsql:
      Fixed bug #64949 (Buffer overflow in _pdo_pgsql_error).
      pgsql:
      Fixed bug #64609 (pg_convert enum type support).
      Readline:
      Implement FR #55694 (Expose additional readline variable to prevent
      default filename completion).
      SPL:
      Fixed bug #64997 (Segfault while using RecursiveIteratorIterator
      on 64-bits systems).


author: crrodriguez@opensuse.org
changelog:
  - php5-per-mod-log.patch Support apache 2.4 per module logging
  - php5-apache24-updates.patch Use proper API in apache 2.4
    to determine when the module has to be loaded.
    I made this patches at least a year ago, but for some reason
    they went out of my radar and were not applied to upstream
    Will be submitted again soon.


author: crrodriguez@opensuse.org
changelog:
  - php5-per-mod-log.patch: It turns out that requesting per-module
    logging support in 2.4 will not do a thing if the expansion
    of APLOG_USE_MODULE is not visible to all files of the module
    so place it in the header instead.


author: pgajdos@suse.com
changelog:
  - updated to 5.4.18:
    * About 30 bugs were fixed, including security issues CVE-2013-4113
      and CVE-2013-4248.


author: pgajdos@suse.com
changelog:
  - updated to 5.4.19:
    * These releases fix a bug in the patch for CVE-2013-4248 in
      OpenSSL module and compile failure with ZTS enabled in PHP 5.4.


author: crrodriguez@opensuse.org
changelog:
  - build with --with-fpm-systemd and install systemd unit
  - php5-systemd-unit.patch: tweak systemd unit for openSUSE requirements
  - php5-openssl.patch: only openSSL_config() is really needed.
  - Recommended for 13.1 and Factory


author: rolf@suse.de
changelog:
  - new version 4b4pl1
  - now with --enable-thread-safety --with-gd=yes --with-ttf
  - imap support is now broken


author: rolf@suse.de
changelog:
  - update tp 4.0.3pl1 due to some security breaches
  - needed to drop db3 and dbm support, as these are incompatible
  - enable FTP support [BUG#3862]


author: rolf@suse.de
changelog:
  - added Sablotron support     [BUG#3891]
  - added curl support          [BUG#3890]
  - added Flash support on i386 [BUG#3209]
  - also pack module files in /usr/lib/php/
  - moved the exec dir to /usr/lib/php/bin
  - include pear binaries
  - added the following modules: sockets, shmop, exif, filepro, dbase
    readline, mcrypt, gettext


author: rolf@suse.de
changelog:
  - added the asp2php package [BUG#4456]
  - roxen/pike still doesn?t work
  - require RPM group tag via apxs


author: rolf@suse.de
changelog:
  - new features imap-ssl, bz2, qtdom, ctype, debug, force-cgi-redirect,
    discard_path, sigchild, gd-imgstrttf
  - added apache-mod_php4.rc.config
  - added /etc/httpd/modules/mod_php4


author: rolf@suse.de
changelog:
  - spin off subpackage mod_php4-core which is required by apache and
    roxen modules now
  - moved config file to /etc/php.ini for all php4 modules
  - sybase support conflicts with Adabas D support
  - Ingres support is for Ingres II only
  - added t1lib support [BUG#6212]
  - updated asp2php 0.75.13
  - make us of suse_loadmodule for testing
  - added /usr/bin/php to core package [BUG#6648]


author: rolf@suse.de
changelog:
  - new version 4.0.5
  - disable pgsql for roxen, as it is broken
  - mysql bug fixed in this release [BUG#6839]
  - move stuff to /usr/share/php [BUG#8352]
  - now Provides: mod_php as well [BUG#8911]


author: rolf@suse.de
changelog:
  - update to php 4.0.6
  - apply memlimit patch
  - new subpackage mod_php4-servlet for use of PHP4 as JAVA servlet
    with tomcat
  - new options: --with-gmp, --with-dom, mbstring


author: rolf@suse.de
changelog:
  - new subpackage mod_php4-aolserver for use of PHP4 with AOL server
  - disable-debug so Zend optimizer can work


author: tcrhak@suse.cz
changelog:
  - fixed configure.in and config.m4's for autoconf 2.52
  - added libtoolize, autoconf, autoheader
  - used setJava to find JAVA_HOME
  - TTF - bug 9523
  - gd  - bug 12226
  - changed the order in which subpackages (for Servers) are built,
  - so that the devel package corresponds to core
  - (=> experimental-zts disabled)
  - moved phpize to the devel package (fixed for autoconf 2.52)
  - added files needed by phpize to the devel package


author: tcrhak@suse.cz
changelog:
  - update to 4.1.0
  - no mm support for aol and servlet (mm is not ZTS in 4.1 yet)
  - patched acinclude.m4 to find the very dir for mysql libraries
  - added `php-config --extension-dir` to core files


author: tcrhak@suse.cz
changelog:
  - update to version 4.2.2
  - update of asp2php to version 0.76.12
  - detect the module magic number if provided by apache, indicating
    API changes, and add an RPM Require on it
  - add compiled extensions (currently gd.so, as it is build shared
    by a previous change by bk@suse.de) to php.ini and filelist


author: poeml@suse.de
changelog:
  - update to 4.3.0
    - GD library is now bundled with the distribution and it is
      recommended to always use the bundled version
    - vpopmail and cybermut extensions are moved to PECL
    - several deprecated extensions (aspell, ccvs, cybercash, icap)
      and SAPIs (fastcgi, fhttpd) are removed
    - speed improvements in a variety of string functions
    - Apache2 filter is improved, but is still considered
      experimental (use with PHP in prefork and not worker (thread)
      model since many extensions based on external libraries are not
      thread safe)
    - various security fixes (imap, mysql, mcrypt, file upload, gd, etc)
    - new SAPI for embedding PHP in other applications (experimental)
    - much better test suite
    - significant improvements in dba, gd, pcntl, sybase, and xslt
      extensions
    - debug_backtrace() should help with debugging
    - error messages now contain URLs linking to pages describing the
      error or function in question
    - Zend Engine has some fixes and minor performance enhancements
    - and TONS of other fixes, updates, new functions, etc
  - build apache2 module
  - QtDOM support is now in qt3, and therefore we need to link
    against libqt-mt
  - merge the lib64 patch, hope it's complete
  - gd lib is now bundled, and preferred for building
  - adjust the Provides of the -core package


author: poeml@suse.de
changelog:
  - don't built -servlet for now, needs work
  - swf.h has vanished from ./dist/include/, and I can't find another
    one --> disabling swf support


author: poeml@suse.de
changelog:
  - call the new /usr/share/apache2/get_module_list script to
    configure apache2, so the test can be passed


author: tcrhak@suse.cz
changelog:
  - security update to version 4.3.1 - fixes a CGI vulnerability
  - added sysconfig metadata [bug #22604]


author: tcrhak@suse.cz
changelog:
  - fixed order of Type and Define in sysconfig metadata
  - readded subpackage servlet (patch servlet)
  - reenabled support for swf
  - install swf fonts, use proper SWFFONTPATH
    (bug #18057, patch swf)


author: poeml@suse.de
changelog:
  - add README.{SuSE,UnitedLinux} [#25888]
  - don't explicitely strip binary objects, because RPM does it
    anyway, and it might keep the stripped debugging info somewhere.
  - don't try to install a file in /etc/apache2/modules/ (it's gone)


author: mls@suse.de
changelog:
  - remove 'Obsoletes: mod_php' from mod_php4, otherwise rpmv4
    makes mod_php4 conflict with apache2-mod_php4


author: poeml@suse.de
changelog:
  - fix symbol exports for apache2
  - add -fno-strict-aliasing to CFLAGS, due to code where
    dereferencing type-punned pointers would break strict aliasing
  - fix test load of apache2 module (the LoadModule statement went
    into the wrong place)


author: tcrhak@suse.cz
changelog:
  - modularized
  - updated to version 4.3.4
  - added fastcgi
  - added PHP4 module sockets
  - added PHP4 module mime_magic (bug #34134)
  - php binary is now CLI, not CGI (bug #34152)


author: tcrhak@suse.cz
changelog:
  - added sendmail to neededforbuild, so that mail() is defined (bug #39153)
  - dlopen php modules with RTLD_LOCAL (fixes bug #39197)


author: ro@suse.de
changelog:
  - removed mod_dav from neededforbuild
  - removed mod_php4 package (mod_php4-core is probably obsolete too)


author: aj@suse.de
changelog:
  - Remove broken cat commands from post section:
    * no requires for them
    * no need to execute them


author: tcrhak@suse.cz
changelog:
  - update to 4.3.8
  - added module dbx (bug #43972)
  - use system gd library, includes "GIF Create Support" (bug #44001)
  - disallow persistant connections by default (bug #34849)
  - use /var/lib/php for php sessions by default (bug #36886)
  - php modules need to prereq sce_install (bug #43994)


author: tcrhak@suse.cz
changelog:
  - removed the build dependency on tomcat5
  - added tomcat5 directories to filelist
  - enabled iconv for the other archs


author: tcrhak@suse.cz
changelog:
  - security fix for array parsing (bug #45710) and
    some other fixes from php-4.3.9RC3 (patch 4.3.9RC3)
  - removed the #%endif causing syntax error during /usr/lib/php/sce_install (bug #45589)
  - /var/lib/php is now owned by wwwrun (bug #45360)
  - reverted dlopen flag back to RTLD_GLOBAL (bugs #39197 and #41866),
    php4-recode now conflicts with php4-imap, php4-mysql and apache2-mod_auth_mysql,
    mod_php4-core does not require php4-recode any more
  - dropped php4-dba and php4-readline due to license poblems (bug #45654)


author: pmladek@suse.cz
changelog:
  - added /usr/lib/php/sce_install to prerequires of php4-swf; it is in the
    package php4-32bit on x86_64 [#46475]


author: poeml@suse.de
changelog:
  - update to 4.3.10
  - for apache module, pick up CFLAGS from apxs [#49356]
  - drop obsolete php-4.3.9RC3.diff
  - update lib64.diff
  - fix return type in php_sprintf()
  - don't apply php-4.3.8-snmp.diff
  - do not clean buildroot in buildsystem to facilitate debugging
  - fix PreRequires (sce_install_path) [#46664]


author: mcihar@suse.cz
changelog:
  - initial packaging of php5
  - suse addons are now in tarball instead of patch
  - reorganize patches
  - simplified build system


author: mcihar@suse.cz
changelog:
  - drop actually unused patches
  - fix build on ia64 (endians patch, stolen from cvs) (still doesn't build due to missing current MySQL)
  - fix build on lib64 machines


author: mcihar@suse.cz
changelog:
  - use correct path to apache2_MMN
  - comment some patches
  - update README.SUSE
  - drop unused sce_install
  - each extension now provides also unversioned symbol, to allow not to depend
    on specific php version
  - drop MIME type change as both php modules don't work together anyway


author: mcihar@suse.cz
changelog:
  - do not build CLI with all GCI stuff
  - fix build when extensions are built as *.so instead of just *
  - use different php.ini for each SAPI, this is needed for giving CLI more space to live (bug #72311)


author: tcrhak@suse.cz
changelog:
  - dropped php4-dba and php4-readline due to license problems (bug #91489)
  - compile without -DPHP_AP_DEBUG (bug #95502)
  - fixed php-config to return a correct includes path (patch php5-php-config)
  - fixed a sigsegv in the soap extension (bug #99268, patch php5-soap)


author: postadal@suse.cz
changelog:
  - added security patch pcre-overflow-bug-106209.patch for internal
    libpcre and statically linked against it [#114157]
  - added include_path = "/usr/share/php" to php.ini [#114406]


author: mmarek@suse.cz
changelog:
  - fixed infinite recursion in exif code
    [#132684] (CVE-2005-3353.patch)
  - fixed XSS in phpinfo()
    [#131578] (CVE-2005-3388.patch)
  - fixed register_globals actvation in parse_str()
    [#131579] (CVE-2005-3389.patch)
  - fixed possible $GLOBALS overwrite
    [#131580] (CVE-2005-3390.patch)
  - fixed handling basedirs that end with a /
    [#118976] (basedir-fix.patch)
  - fixed segfaulting when save_path is set and safe_mode is On
    [#130227] (save_path-segfault.patch)


author: postadal@suse.cz
changelog:
  - fixed unexpected header can be injected to mb_send_mail()
    [#135673] (mbstring.patch)
  - added safe_mode checks for image* functions and cURL
    [#135673] (CVE-2005-3391.patch)
  - fixed possible INI setting leak via virtual() in Apache 2 sapi
    [#135673] (CVE-2005-3392.patch)


author: postadal@suse.cz
changelog:
  - updated to version 5.1.1 [#135635, #139297]
  - removed obsoleted patches: php5-with_lib.patch, soap.patch, posix.patch,
    gcc4.patch, save_path-segfault.patch, basedir-fix.patch,
    RPC-CAN-2005-1921.patch, RPC-CAN-2005-2498.patch, pcre-overflow-bug-106209.patch,
    CVE-2005-3388.patch, CVE-2005-3389.patch, CVE-2005-3390.patch,
    mod_rewrite-fix.patch, mbstring.patch, CVE-2005-3391.patch, CVE-2005-3392.patch,
    errordocument-fix.patch
  - removed sqlite2 from build dependencies and added libtidy libtidy-devel
  - removed dbx, fam, yp, dio extensions (upstream deprecated)
  - added dba, tidy and xmlreader extensions
  - renamed libphp5.so -> mod_php5.so (need it for yast module)
  - added upstream patches:
    openssl.patch [php#35381]
    soap.patch [php#35399]
    pdo.patch [php#35431, php#35430]
    simplexml.patch [php#35028]
    curl.patch [php#35908]
    ze.patch [php#35393]
  - updated pear sources install-pear-nozlib.phar
  - package CLI instad CGI binaries [#137443]
  - reverted last changes (problem caused curl-devel package)


author: postadal@suse.cz
changelog:
  - updated to version 5.1.2
  - removed obsoleted patches: CAN-2005-1042_1043.patch, CVE-2005-3353.patch,
    openssl.patch, soap.patch, pdo.patch, simplexml.patch, curl.patch,
    ze.patch
  - added pdo, pdo_mysql, pdo_pgsql, pdo_sqlite extensions


author: postadal@suse.cz
changelog:
  - added forgoted extension xmlwrite
  - gave back simple dot to include_path [#129682]
  - fixed upstream bugs:
    [php#36071] (phpbug-36011.patch)
    [php#36016] (phpbug-36016.patch)
    - realpath cache memleaks
    [php#36071] (phpbug-36071.patch)
    - Zend engine crash related with 'clone'
    (zend-fix.patch)
    - fix issues with static method invocation
    - ce_child is properly initialized
    [php#36046] (phpbug-36046.patch)
    - parse_ini_file() miscounts lines in multi-line values
    [php#36037] (phpbug-36037.patch)
    - heredoc adds extra line number
    [php#36006] (phpbug-36006.patch)
    - problem with $this in __destruct()
    (gd.patch)
    - improve open_basedir checks in GD
    [php#36007] (phpbug-36007.patch)
    - added new mysqli constants for BIT and NEW_DECIMAL field types (for mysql 5)
    (session.patch)
    - check for special characters in the session name
    (xmlreader.patch)
    - 64bit fixes


author: postadal@suse.cz
changelog:
  - added php5-pdo to requires for pdo_mysql, pdo_pgsql, pdo_sqlite and
    sqlite and php5-dom to requires for xmlreader and xsl [#144360]
  - revert name of extensions (appended suffix .so) [#143552]
  - removed _FILE_OFFSET_BITS=64 and _LARGEFILE_SOURCE from CFLAGS
    (doesn't work with apache2 configuration, which uses libapr with
    native support for large files) [#144362]
  - added -fstack-protector


author: postadal@suse.cz
changelog:
  -  fixed upstream bugs:
    [php#36176] (phpbug-36176.patch)
    (pdo.patch)
    - properly rewrite queries where a bound parameter appears more then once


author: postadal@suse.cz
changelog:
  - removed gd-devel from BuildRequires (better used bundled modified gd lib)
  - fixed upstream bugs:
    [php#36268] (phpbug-36268.patch)
    [php#36148] (phpbug-36148.patch)
    [php#36185] (phpbug-36185.patch)
    [php#36208] (phpbug-36208.patch)
    [php#36158] (phpbug-36158.patch)


author: postadal@suse.cz
changelog:
  - fixed upstream bugs:
    [php#36306] (phpbug-36306.patch)
    - fixed crc32() for 64bit arch
    [php#36351] (phpbug-36351.patch)
    - parse_url() did not parse numeric paths properly
    (spl_directory.patch)
    [php#35998]
    - getPathname() method always returns unix style filenames
    [php#36134]
    - DirectoryIterator constructor failed to detect empty directory names
    [php#36258]
    - SplFileObject::getPath() may lead to segfault
    [php#36287]
    [php#36295]
    [php#36359]
    - splFileObject::fwrite() doesn't write when no data length specified
    (session2.patch)
    - fixed logic, if the client already sent us the cookie, we don't
      need to send it again
    (soap.patch) [php#36226, php#36083, php#36283]
    (math.patch, simplexml.patch, mbstring.patch, zend_operators.patch, xp_socket.patch)
    - initialize variables


author: postadal@suse.cz
changelog:
  - added php5-openssl to php5-ftp Requires [#154273]
  - added safe_mode num of parameter check for mb_send_mail [#154315]


author: postadal@suse.cz
changelog:
  - fixed a possible null injection in mbstring (mbstring-null_injection.patch)
  - fixed upstream bugs:
      [mysql#16144] (phpbug-16144)
    - fix for MySQL 5.1 (mysql_stmt_attr_get)
      [php#36656] (phpbug-36656)
    - http_build_query generates invalid URIs due to use of square brackets
      [php#36396,36510,36510,36638] (parse_date.patch)
    - fixed few bugs in date/time parsing
      (string.patch)
    - added overflow checks to wordwrap() function
      [php#36459] (phpbug-36459)
    - incorrect adding PHPSESSID to links, which contains \r\n


author: postadal@suse.cz
changelog:
  - added updating APACHE_MODULES in /etc/sysconfig/apache2 [#155333]
  - added forgotten regenerated sources for (parse_date.patch and
    phpbug-36459.patch)
  - fixed upstream bugs:
      [php#36420] (phpbug-36420)
    - segfault when access result->num_rows after calling result->close()
      (mysqli-64bit.patch)
    - fixed a 64-bit problem


author: postadal@suse.cz
changelog:
  - fixed security problem in copy() and tempname()
    [#164845] (CVE-2006-1494-1608.patch)
  - fixed phpinfo() XSS [#164804] (CVE-2006-0996.patch)
  - fixed memory leak in html_entity_decode  [#161718] (CVE-2006-1490.patch)
  - fixed multiple imap safemode and open_basedir restriction bypass
    [#154317] (CVE-2006-1017.patch)


author: postadal@suse.cz
changelog:
  - fixed completely broken SplTempFileObject [php#37257]
    (phpbug-37257.patch)
  - fixed problem with with $_POST array [php#37276]
    (phpbug-37276.patch)


author: postadal@suse.cz
changelog:
  - fixed memory leak in imagecreatefromgif()
    [#173451] (phpbug-37346.patch)
  - fixed possibility of a wrong element being deleted by zend_hash_del()
    [#175976] (zend_hash_del.patch)
  - fixed substr_compare() when offset equals string length
    [#169038, php#37394] (CVE-2006-1991, phpbug-37394.patch)
  - fixed _emalloc() on 64bit archs [#169038] (emalloc.patch)


author: poeml@suse.de
changelog:
  - fix BuildRequires to build on SUSE Linux 10.1, 10.0, 9.3
  - use the -fstack-protector compile switch only on 10.0 and newer


author: postadal@suse.cz
changelog:
  - updated to version 5.1.4
    * FastCGI interface was completely reimplemented
    * multitude of improvements to the SPL, SimpleXML, GD, CURL and
      Reflection extensions
    * support for many additional date formats added to the strtotime()
    * a performance improvements added to the engine and core extensions
    * added imap_savebody() that allows message body to be written to a file
    * added lchown() and lchgrp() to change user/group ownership of symlinks
    * upgraded bundled PCRE library to version 6.6
  - merged changes from openSUSE build service
    * removed unneeded sablot-devel,sqlite-devel,pcre-devel,fam-devel
      and libmcal from BuildRequires
    * added php-ctype,php-dom,php-iconv,php-pdo,php-pdo_sqlite,php-sqlite,
      php-tokenizer,php-xmlreader,php-xmlwriter to Recommends
    * added php-mbstring php-gd php-pear php-gettext php-mysqli to Suggests
    * added support for optional readline(libedit) for CLI
      (disabled by default)
    * patches for zendengine (ze2_bugs.patch), xsl (xsl_bugs.patch),
      curl (curl.patch) and mbstring bugs (mbstring_bugs.patch),
      big soap patch (soap.patch)
    * removed obsoleted patches
    * fixed Safe Mode Bypass [#188243] (standard.patch)
    * upstream patches
      [php#37306, php#37416, php#37587, php#37720]
      [php#37576, php#37496, php#37341, php#37313, php#37256] (cgi_bugs.patch)
      [php#37346, php#37360] (gd-fixes.patch)
    * fixed build inconsistences, added php-hash module [#173023]
    * added pdo_odbc.so to php-odbc module [#190614]
    * build without explicit safe_mode and magic_quotes (unneeded)
    * removed useless GD --with-ttf configure option, only suitable
      for freetype 1


author: postadal@suse.cz
changelog:
  - update to version 5.2.0RC4
    * added DSA key generation support to openssl_pkey_new()
    * updated PCRE to version 6.7
    * increased default memory limit to 16 megabytes to accommodate for a more
      accurate memory utilization measurement
    * added support for httpOnly flag for session extension and cookie setting
      functions
    * added version specific registry keys to allow different configurations for
      different php version
    * added "PHPINIDir" Apache directive to apache and apache_hooks SAPIs
    * added an optional boolean parameter to memory_get_usage() and
      memory_get_peak_usage() to get memory size allocated by emalloc() or real
      size of memory allocated from system
    * moved extensions to PECL (filepro and hwapi)
    * improved SNMP, OpenSSL extension
    * improved the Zend memory manager, FastCGI SAPI, CURL, PCRE, PDO, SPL,
      xmlReader
  - merged changes from openSUSE build service
    * build without --enable-sigchild [#206533, php#28294, php#38342]
    * build CLI with libedit support (really-with-libedit.patch)
    * tweaked the default config a bit, to make it more secure
    * removed ini entries related to extensions we don't ship
    * t1lib is not currently needed for build, we need t1lib5 to do
      something useful
    * removeed --enable-ucd-snmp-hack (needed for ucd-snmp, but we use net-snmp)
    * pdo_odbc provided by php-odbc
    * php-suse-addons :
      o PHP5 is unlikely to parse php3 code, remove the file association
      o corrected apache directive is AddHandler not AddType
    * dropped extensions:
      o mysql, mysqli and pdo_mysql provided by php-mysql (reduce package count)
      o php-pdo_sqlite provided by php-sqlite
      o php-pdo_pgsql provided by php-pgsql
      o filepro dropped by upstream
    * new extension:
      o filter (kept static and cannot be unloaded, due security reasons)
      o json (added as Recommended)
      o zip (it uses a bundled library)
  - fixed gcc issues (gcc.patch)
  - droped obsoleted patches: include_path.patch, bug-37720.patch,
    bug-37306.patch, cgi_bugs.patch, bug-37587.patch, gd-fixes.patch,
    bug-37416.patch, main_bugs.patch, soap.patch, standard.patch,
    mbstring_bugs.patch, ze2_bugs.patch, xsl_bugs.patch, curl.patch


author: anosek@suse.cz
changelog:
  - php5-sqlite now uses our sqlite and sqlite2 packages to build
    and not bundled ones [#201440]
  - updated suhosin to 0.9.9


author: mmarek@suse.cz
changelog:
  - updated to 5.2.0 final
  - merged changes from buildservice (by soporte@onfocus.cl):
    - updated suhosin to 0.9.10
    - added suhosin patch
    - build with system PCRE if suse_release > 10.1 only [#215610]
    - suhosin extension does not require PDO
    - suhosin added to the reccommended list
    - php5-pspell to require at least aspell-en otherwise is useless
      [#217272]


author: mmarek@suse.cz
changelog:
  - fixed implicit function decls in suhosin patch (keep the original
    patch intact and put fixes into separate patch)


author: anosek@suse.cz
changelog:
  - synced with BuildService
    * updated Suhosin patch to 0.9.6.2
    * updated Suhosin extension to 0.9.16
    * fixed php5-devel should provide PECL tool [#204006]
    * use bundled sqlite in  suse versions =< 10.1
      (pdo_sqlite stopped working properly with older sqlite3 libs)
    * do not use zend-multibyte anymore, please refer
      to phpbug #36711 and associated links, no applications uses
      this feature in the real world since it is disabled
      in all other distributions/OS.seems to cause more problems
      than solutions.
    * change php.ini, back to short_open_tag =off (the default)
      the package that depended on this setting no longer does.
      Also explicitely set the upload_tmp_dir in php.ini to deal
      with open_basedir recent changes (please refer
      to phpbug #39123) for the details.
    * suhosin.ini uses just the default recommended settings


author: mmarek@suse.cz
changelog:
  - updated the curl module from cvs to fix build with curl-7.16
    (curl-cvs-fix.patch, dropped gcc.patch)


author: anosek@suse.cz
changelog:
  - synced with BuildService
    * file "session_mm_apache2handler0.sem" written at boot
      [#229200] (php5-config.patch)
    * for certain functionality php5-exif requires php5-mbstring
    * php5-ldap requires php5-openssl
    * remove LDAP_DEPRECATED from CFLAGS, module already
      takes care of this.
    * patch potential HTTP_SESSION_VARS et all hijack when
      register_globals is On users from suhosin extension are
      not affected.(php5-session-rgon-hijack.patch)
    * on 10.2 and up  php5-devel should require pcre-devel
      sqlite-devel sqlite2-devel
    * php5-devel is mostly useless without autoconf automake libtool
      bison make gcc.
    * added patches: phpbug-39350.patch
      oldhat-phpinputdata-secfix.patch
      ze2-fixes.patch
      filter.patch
      ext-lib64again.patch


author: judas_iscariote@shorewall.net
changelog:
  - fix getenv() modifing $_POST, breaks suhosin badly when
    register_* is On and variables orde is "GPCS" (default).
  - change/remove obsoleted patches


author: judas_iscariote@shorewall.net
changelog:
  - PHP 5.2.1. for a full list of changes see
    http://www.php.net/ChangeLog-5.php#5.2.1
  - add Obsoletes for extensions we dont ship anymore


author: judas_iscariote@shorewall.net
changelog:
  - Update suhosin extension to version 0.9.17. see
    http://www.hardened-php.net/suhosin/changelog.html for details.


author: judas_iscariote@shorewall.net
changelog:
  - fix/workaround for php5-gd problem with typo3 [#236680]
  - add fix for MOPB-14-2007 PHP substr_compare() Information Leak
    Vulnerability.
  - add secfix for import_request_variables() ancient problem, users
    of suhosin extension are not affected.
  - Run the test suite here


author: judas_iscariote@shorewall.net
changelog:
  - fix Requires of -devel package to include only what is really
    needed for operation of the pecl tool as well the neccesary
    headers to compile php extensions.
  - Fix MOPB 24 "PHP array_user_key_compare() Double DTOR
    Vulnerability"
  - note that fix for MOPB 23 was included in the previous patchset.


author: mmarek@suse.de
changelog:
  - fixed unpack() on big-endian 64bit (revert-phpbug38770.patch)
  - blacklist more env variables when safe_mode is on
    (php5-config.patch)


author: judas_iscariote@shorewall.net
changelog:
  - Upgrade suhosin extension to version 0.9.19 see
    http://www.hardened-php.net/suhosin/changelog.html for details


author: judas_iscariote@shorewall.net
changelog:
  - upgrade to PHP 5.2.2, fixed hundreds of bugs including MOPB ones
    if you need the complete changes see http://www.php.net/ChangeLog-5.php#5.2.2


author: judas_iscariote@shorewall.net
changelog:
  - php5-devel package now requires pcre-devel for > 10.1 as 5.2.2 installs
    php_pcre.h header that needs it.


author: judas_iscariote@shorewall.net
changelog:
  - add php5-test-fixes.patch fixing a test case that wont pass on i586
    as well a real fix for Zend/tests/bug41117_1.phpt problem, that was commited
    after the release was done. there is another test case that fails in 10.2
    ext/pcre/tests/bug40195.phpt but this is not a PHP problem but a bug in PCRE.
  - added missing fix for PMOPB-45-2007 PHP ext/filter Email Validation Vulnerability (minor)


author: judas_iscariote@shorewall.net
changelog:
  - remove --enable-memory-limit configure flag, it disappeared in 5.2.1,
      nowdays memory_limit is always enabled.


author: judas_iscariote@shorewall.net
changelog:
  - update php5-test-fixes fixing another bug in zend_compile.c
  - use rpm macros in the spec file
  - when removing apache2-mod_php5, unload it from apache first.
  - when updating apache2-mod_php5 restart apache with restart on update macro.


author: judas_iscariote@shorewall.net
changelog:
  - fix devel package, in the reality PHP does not currenly require expat.
    headers provides a expat compatibility layer but it is no longer in use
    by our packages as libxml2 is always prefered, (and HAVE_LIBEXPAT is not defined)


author: judas_iscariote@shorewall.net
changelog:
  - updated suhosin to version 0.9.20, security fix + bugfixes
    see http://www.hardened-php.net/suhosin/changelog.html for more detail.


author: mmarek@suse.cz
changelog:
  - fixed the dba extension adding -ldb-4.x to global LDFLAGS,
    causing unnecessary dependency in /usr/bin/php5
    [http://bugs.php.net/bug.php?id=41455]


author: judas_iscariote@shorewall.net
changelog:
  - use system re2c in factory.
  - enable support for qbdm in the dba extension (build service only)
  - enable the ming extension (build service only)


author: judas_iscariote@shorewall.net
changelog:
  - PHP version 5.2.3 see http://www.php.net/releases/5_2_3.php
  - important: PHP-cgi now lives in /usr, package attempts to fix both
    lighttpd and apache2 fastcgi config files.


author: mmarek@suse.cz
changelog:
  - drop php5.xpm and the Icon: line from the specfile (the icon is
    not used at all and it breaks rpm -q --specfile php5.spec)


author: judas_iscariote@shorewall.net
changelog:
  - fixed a mess with update-alternatives PreReq uncovered by newer build versions.
    actually every subpackage that uses update-alternatives should PreReq it.
  - fix some ZE2 bugs.


author: anosek@suse.cz
changelog:
  - fixed YOU honors Recommends, breaks php update [#291551]
    (moved php-suhosin from Recommends to Suggests)


author: mmarek@suse.cz
changelog:
  - updated to latest state of PHP_5_2 branch; highlights from the
    NEWS file:
    - Upgraded PCRE to version 7.2 (Nuno)
    - Updated timezone database to version 2007.6. (Derick)
    - Improved openssl_x509_parse() to return extensions in readable
      form.  (Dmitry)
    - Changed "display_errors" php.ini option to accept "stderr" as
      value which makes the error messages to be outputted to STDERR
      instead of STDOUT with CGI and CLI SAPIs (FR #22839). (Jani)
    - Changed error handler to send HTTP 500 instead of blank page on
      PHP errors.  (Dmitry, Andrei Nigmatulin)
    - Added check for unknown options passed to configure. (Jani)
    - Added persistent connection status checker to pdo_pgsql.
      (Elvis Pranskevichus, Ilia)
    - Added support for ATTR_TIMEOUT inside pdo_pgsql driver. (Ilia)
    - Added php_ini_loaded_file() function which returns the path to
      the actual php.ini in use. (Jani)
    - Added GD version constants GD_MAJOR_VERSION, GD_MINOR_VERSION
      GD_RELEASE_VERSION, GD_EXTRA_VERSION and GD_VERSION_STRING.
      (Pierre)
    - Added missing open_basedir checks to CGI.  (anight at
      eyelinkmedia dot com, Tony)
    - Added missing format validator to unpack() function. (Ilia)
    - Added missing error check inside bcpowmod(). (Ilia)
    - Added CURLOPT_PRIVATE & CURLINFO_PRIVATE constants.  (Andrey A.
      Belashkov, Tony)
    - Added missing MSG_EOR and MSG_EOF constants to sockets
      extension. (Jani)
    - Added PCRE_VERSION constant. (Tony)
    - Added ReflectionExtension::info() function to print the
      phpinfo() block for an extension. (Johannes)
    - Implemented FR #41884 (ReflectionClass::getDefaultProperties()
      does not handle static attributes). (Tony)
    - plus lots of bugfixes
  - fixed the pear phar archive to run with 5.2.4
    [http://bugs.php.net/bug.php?id=42146]


author: anosek@suse.cz
changelog:
  - updated to version 5.2.4RC2
    - Fixed oci8 and PDO_OCI extensions to allow configuring with Oracle 11g client
      libraries. (Chris Jones)
    - Fixed bug #42292 ($PHP_CONFIG not set for phpized builds). (Jani)
    - Fixed bug #42261 (header wrong for date field). (roberto at spadim dot com
      dot br, Ilia)
    - Fixed bug #42259 (SimpleXMLIterator loses ancestry). (Rob)
    - Fixed bug #42247 (ldap_parse_result() not defined under win32). (Jani)
    - Fixed bug #42243 (copy() does not output an error when the first arg is a
      dir). (Ilia)
    - Fixed bug #42242 (sybase_connect() crashes). (Ilia)
    - Fixed bug #42237 (stream_copy_to_stream returns invalid values for mmaped
      streams). (andrew dot minerd at sellingsource dot com, Ilia)
    - Fixed bug #42222 (possible buffer overflow in php_openssl_make_REQ). (Pierre)
    - Fixed bug #42211 (property_exists() fails to find protected properties from
      a parent class). (Dmitry)
    - Fixed bug #42208 (substr_replace() crashes when the same array is passed
      more than once). (crrodriguez at suse dot de, Ilia)
    - Fixed bug #42198 (SCRIPT_NAME and PHP_SELF truncated when inside a userdir
      and using PATH_INFO). (Dmitry)
    - Fixed bug #42195 (C++ compiler required always). (Jani)
    - Fixed bug #42117 (bzip2.compress loses data in internal buffer). (Philip,
      Ilia)
    - Fixed bug #42082 (NodeList length zero should be empty). (Hannes)
    - Fixed bug #36492 (Userfilters can leak buckets). (Sara)
    - Fixed bug #31892 (PHP_SELF incorrect without cgi.fix_pathinfo, but turning
      on screws up PATH_INFO). (Dmitry)


author: crrodriguez@suse.de
changelog:
  - PHP 5.2.4RC3
  - Fixed version_compare() to support "rc" as well as "RC" for release
    candidate version numbers.
  - Fixed bug #42368 (Incorrect error message displayed by pg_escape_string).
    (Ilia)
  - Fixed phpbug #42365 and Novell bugzilla #292998 (glob() crashes and/or accepts way too many flags). (Jani)
  - Fixed bug #42183 (classmap causes crash in non-wsdl mode). (Dmitry)
  - Fixed bug #42009 (is_a() and is_subclass_of() should NOT call autoload,
    in the same way as "instanceof" operator). (Dmitry)
  - Fixed bug #41904 (proc_open(): empty env array should cause empty
    environment to be passed to process). (Jani)
  - Fixed bug #37273 (Symlinks and mod_files session handler allow open_basedir
    bypass). (Ilia)
  - remove wrong hardcoded requirement on libedit
  - devel package at least does not need libtool the php build enviroment uses a private copy.
  - drop no longer needed patches already in upstream


author: crrodriguez@suse.de
changelog:
  - update to PHP 5.2.5
    * Fixed dl() to only accept filenames. reported by Laurent Gaffie.
    * Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
    * Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
    * Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
    * Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
    * Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
    * Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
    * Upgraded PCRE to version 7.3 (Nuno)
    * Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
    * Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
    * Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
    * Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
    * Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
    * Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
    * Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
    * Fixed PDO crash when driver returns empty LOB stream. (Stas)
    * Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
    * Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
    * Fixed leaks with multiple connects on one mysqli object. (Andrey)
    * Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
    * Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
    * Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
    * Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
    * Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
    * Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
    * Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
    * Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
    * Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
    * Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
    * Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
    * Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
    * Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
    * Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
    * Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
    * Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
    * Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
    * Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
    * Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
    * Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
    * Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
    * Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
    * Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
    * Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
    * Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
    * Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
    * Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
    * Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
    * Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
    * Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
    * Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
    * Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
    * Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
    * Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
    * Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
    * Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
    * Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
    * Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
    * Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
    * Fixed bug #42326 (SoapServer crash). (Dmitry)
    * Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
    * Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
    * Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
    * Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
    * Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
    * Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)


author: crrodriguez@suse.de
changelog:
  - use /dev/urandom for generating session-IDs [#337005]
  - L3: PHP: Venezuela Time Zone Update starting date changed to December 9 [#345548]


author: crrodriguez@suse.de
changelog:
  - suhosin 0.9.22
    - Fixed function_exists() now checks the Suhosin permissions
    - Fixed crypt() salt no longer uses Blowfish by default
    - Fixed .htaccess/perdir support
    - Fixed compilation problem on OS/X
    - Added protection against some attacks through _SERVER variables
    - Added suhosin.server.strip and suhosin.server.encode


author: crrodriguez@suse.de
changelog:
  - Do not hard require php5-timezonedb, instead provide a capability
    php(tzdatabase) = builtin_tz_ver so it gets installed via rpm
    Supplements only when needed.


author: crrodriguez@suse.de
changelog:
  - Try patch recently published by Redhat that allows PHP to
    use the system timezone database instead of the bundled one.


author: mmarek@suse.cz
changelog:
  - use %%_with_ming and %%_with_qdbm instead of %%opensuse_bs,
    enables building in the bs in other projects than server:php
    (bnc#357917)


author: crrodriguez@suse.de
changelog:
  - update suhosin extension to version 0.9.23
  - Fixed suhosin extension now compiles with snapshots of PHP 5.3
  - Fixed crypt() behaves like normal again when there is no salt supplied
  - wrong Obsoletes causes upgrade trouble [bnc #355618]


author: crrodriguez@suse.de
changelog:
  - update to PHP 5.2.6
    * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
    * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
    * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
    * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
    * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
    * Fixed two possible crashes inside the posix extension.
    * Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
    * Fixed bug #44141 (private parent constructor callable through static function).
    * Fixed bug #43589 (a possible infinite loop in bz2_filter.c).
    * Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call).
    * Fixed bug #43201 (Crash on using uninitialized vals and __get/__set).
    * Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql).
    * Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class).
    * Fixed bug #42736 (xmlrpc_server_call_method() crashes).
    * Fixed bug #42369 (Implicit conversion to string leaks memory).
    * Fixed bug #41562 (SimpleXML memory issue).
    * Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
    * Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
    * Over 120 bug fixes.


author: crrodriguez@suse.de
changelog:
  - update suhosin to version 0.9.27
    * Fixed problem with suhosin.perdir
      Thanks to Hosteurope for tracking this down
    * Fixed problems with ext/uploadprogress
      Reported by: Christian Stocker
    * Added suhosin.srand.ignore and suhosin.mt_srand.ignore (default: on)
    * Modified rand()/srand() to use the Mersenne Twister algorithm with separate state
    * Added better internal seeding of rand() and mt_rand()


author: crrodriguez@suse.de
changelog:
  - fix BLOCKER magic_quotes breakage, if your code
    relies on this feature, it is broken,time to press the panic button.


