microsoft / php-src

Security backports for EOL versions of PHP.

This is a fork of the official PHP repository which receives backport of security fixes from maintained branches.

This branch is PHP version 5.6.40 with security fix.

---

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

php-src's Issues

Test fixes for Windows QA on PHP 7.0

To continue provide QA, some tests on Windows platform need to be fixed. Tests need to be fixed in

• PHP-7.0-security-backports, separate PR

Please create pull requests, so the test fixes can be merged as a single squashed commit.

Thanks.

Q: does this include all the fixes from the Debian-8 package of php 5.6.40 ?

I have hard time finding a single changelog file for the php 5.6.40 package present in Debian Jessie, but it has been maintained at least until to very recently (the changelog link at https://packages.debian.org/jessie/php5 seems broken).
There is info available at https://tracker.debian.org/pkg/php5, but it is split in multiple pages.

What I'd like to know is basically: does this repo include all of the fixes that went into the Debian package? And of course: what are the plans for the future for this repo? How long will it be maintained? And are there plans to produce tagged releases?

Support for openssl-1.1.1?

thanks.

Please add the latest patches to PHP 5.6 branch without openssl-1.1 patch

Please cherry-pick the latest patches from PHP-5.6-security-backports-openssl11 to PHP-5.6-security-backports.

Rationale?

What's the rationale / reason for MS to do this?

Docker-Images?

Are there plans/interest in providing docker images from this php fork? Or are there already some? In the latter case it would be great to have a link to one in the README.

Official docker images for PHP 5.6 have not been updated for almost a year now, so docker images build from -for example- php:5.6-apache are probably vulnerable in on form or another.

Custom PHP extensions no longer load

Recently, more precisely on Nov 19, 2019, I had a problem where when scaling my application the new instances that scaled no longer found the extensions I use on my system.
Some of my users connected to a given instance could load the system correctly, another part was in error because the extension had not been loaded.
I could even see from phpinfo in both scenarios that the extensions were not loaded.
I spent a few hours having to run my application without scaling and then having no errors. Consequently I had high response time issues.
After a few hours, even instances that were normally loading extensions had the same behavior: they could no longer load extensions.
Anyway, I imagine there was some structure change in the way Azure runs PHP and it wasn't disclosed to us.
I had a similar problem last year, where the "PHP_EXTENSIONS" setting no longer worked when PHP went from 5.6.38 to 5.6.39. From that day I had to implement the configuration "PHP_INI_SCAN_DIR". Since then everything has been working well. But from the 19th, I had the problem that neither of these configurations solved.
I had to move my system to PHP 7 in a hurry and in this case everything worked.
I wonder if you know what may have happened.
Why do these internal Azure updates sometimes generate this kind of behavior?
Is there any way I can protect my environment from this kind of behavior?

Bug 72333

First of all, many thanks for this repository.

Is there anything to be said against applying the fix for bug #72333 (fwrite() on non-blocking SSL sockets doesn't work) to the 5.6 release as well?

Bug: https://bugs.php.net/bug.php?id=72333
Fix: php/php-src@17e9fc9

Thank you very much.

Test fixes for Windows QA on PHP 5.6

To continue provide QA, some tests on Windows platform need to be fixed. Tests need to be fixed in

• PHP-5.6-security-backports, separate PR

Please create pull requests, so the test fixes can be merged as a single squashed commit.

Thanks.

PHP 7 Vulnerability Disclosure (2019-087)

A number of vulnerabilities have been disclosed against PHP 7.

Issue #75457 in PHP 7.1 appears to be the only one that PHP internals have classified as an actual security issue. Will it be investigated whether this affects 5.6?

Support for PHP 7.1? (The offical support is ending on 1 Dec 2019)

Hello,

thanks for your work to support older PHP versions.

We have here security backports for PHP 5.6 and PHP 7.0. PHP 7.1 has offical Security Support until 1 Dec 2019 (Source).

Do you have plans to support PHP 7.1 with security backports like you support PHP 5.6 and PHP 7.0?

PHP 5.6 support duration in Azure

I'm working with a client who has decided to phase out their PHP apps (Using 5.4.45) before July 2020. Do you know for how long Azure Web Apps will continue to provide support for PHP 5.6 or where I might find more info regarding this matter?

Best regards,
Henrik