phpxmlrpc-devel — Discussion list for developers on XML-RPC for PHP

[phpxmlrpc-devel] security flaw: new versions uploaded

[Edd D. <ed...@us...>]

I received notice of a security flaw from Dan Libby, details of which I
attach to this mail.

I have put fixes for this flaw into the CVS repository. In so doing I
created a branch called "stable1_0", for doing releases off of the
stable code.

Hence the new release has version 1.01, and differs only from 1.0 in the
security fix and version number.

Development still continues on the HEAD branch as normal.  I also
checked the fixes into HEAD.

As soon as the new releases show up on SourceForge I will notify people
that they need to update as a matter of urgency.

-- Edd

[phpxmlrpc-devel] [Fwd: little correction]

[Edd D. <ed...@us...>]

[phpxmlrpc-devel] [Fwd: Bug fix for PHP 3.0.12+]

[Edd D. <ed...@us...>]

Re: [phpxmlrpc-devel] formatting and php3, etc.

[Miles L. <mi...@sp...>]

Edd Dumbill wrote:
> well, i think php3-friendliness is a good idea and would endorse that.
> i've tried to keep most of the code php3 friendly.

I believe it was only some recent patch that affected this.

> for any code you change like this, could you write a unit test for it in
> testsuite.php that works before the change, and then works after -- i've
> started to try to do this in order that we have some kind of test suite
> building up.  it'll help us know exactly what has or has not caused
> problems.

I do attempt to test before I commit, having been frustrated many times
working with those who don't seem to do this.  I'll look at following
through as you have requested.  In the case of this last change, I
tested
using comments.php.

> on code indenting, well this is a religious issue :)  i personally don't
> like the style with { } on a line on their own but i'm not overly
> bothered.  i guess the answer is: if you want to change the code to look
> like that then you're welcome, but there may be occasional times when i
> forget to make it look like that

Yeah, I didn't really care for it at first.  But I got used to it and
now I even like it ;)  Once i readjusted to using a tabstop of 4, it
looks
pretty decent.  I don't know how many people you have had working on
this
at one time in the past.  But assuming there would be more involved,
some agreeable standard would help for consistency, imo.

> i've tagged the current release in the CVS repository as release1_0 or
> something like that.  it occurs to me that one problem we'll have is
> bugfixes to 1.0 that are urgent but come in while we're busy working on
> more development-like issues. therefore i propose that if we get any
> bugs to fix before 1.1 is ready then we perform them on a branch ie. we
> check out release1_0 and then tag it "stable" and perform bugfixes on
> that and release 1.01 or whatever.  i hope i'm making some sense here.

Yes.  I wish I could help more with cvs itself.  I do run one here, but
have not taken the time to become intimate with branching and tagging.
But, having both a stable and devel branch would be a good idea.


> -- Edd
> 
> On Wed, 2001-08-29 at 06:08, Miles Lott wrote:
> > Hello to all (2) of you, and others who are hidden from
> > the subscriber list.
> >
> > I am interested in first making sure the code is
> > php3-compliant.  We are using a modified version of this
> > code in phpgroupware, and it was not difficult to adjust.
> > For the most part this means replacing foreach with reset
> > and while.  Since the code is not using xml_set_object or
> > get_class, et al, it is otherwise in good shape.
> >
> > Next, I would like to go through and replace all " with '.
> > This has shown itself to improve performance noticeably.
> >
> > Lastly, I am interested in applying a new formatting style
> > to the code, roughly along the lines of GNU and phpgroupware's
> > format.  Here is a brief outline:
> >
> > <?php
> >       class myclass
> >       {
> >               var $somevar;
> >               var $somearray(
> >                       'element1' => 'value',
> >                       'element2' => 1
> >               );
> >
> >               function myclass($arg=False)
> >               {
> >                       if($arg)
> >                       {
> >                               echo 'hello world';
> >                       }
> >               }
> >       }
> > ?>
> >
> > The whitespace above are all tabs.  This format helps to ensure
> > that most people are able to view and understand it more clearly,
> > I feel.  Unbracketed if statements,etc., can be a pain to troubleshoot
> > if you did not write the code.
> >
> > I know this last item will probably spark at least some debate,
> > so I dare not touch that until I get some yeas and nays.
> >
> --
> Edd Dumbill --/ voice: +44 1904 427740 fax: +44 8701 640230 /--
>  | Managing Editor, XML.com -//- Publishing Editor, XMLhack.com
>  | Chair, XML Europe 2002   -//- Chair, O'Reilly XTech 2001
> 
>   ------------------------------------------------------------------------
>    Part 1.2Type: application/pgp-signature

-- 

Miles Lott - http://milosch.net
Handspring Visor USB and BeOS FS support for Linux
phpGroupWare - http://www.phpgroupware.org

Re: [phpxmlrpc-devel] formatting and php3, etc.

[Edd D. <ed...@us...>]

well, i think php3-friendliness is a good idea and would endorse that.
i've tried to keep most of the code php3 friendly.

for any code you change like this, could you write a unit test for it in
testsuite.php that works before the change, and then works after -- i've
started to try to do this in order that we have some kind of test suite
building up.  it'll help us know exactly what has or has not caused
problems.

on code indenting, well this is a religious issue :)  i personally don't
like the style with { } on a line on their own but i'm not overly
bothered.  i guess the answer is: if you want to change the code to look
like that then you're welcome, but there may be occasional times when i
forget to make it look like that :)

i've tagged the current release in the CVS repository as release1_0 or
something like that.  it occurs to me that one problem we'll have is
bugfixes to 1.0 that are urgent but come in while we're busy working on
more development-like issues. therefore i propose that if we get any
bugs to fix before 1.1 is ready then we perform them on a branch ie. we
check out release1_0 and then tag it "stable" and perform bugfixes on
that and release 1.01 or whatever.  i hope i'm making some sense here.

-- Edd


On Wed, 2001-08-29 at 06:08, Miles Lott wrote:
> Hello to all (2) of you, and others who are hidden from
> the subscriber list.
>=20
> I am interested in first making sure the code is
> php3-compliant.  We are using a modified version of this
> code in phpgroupware, and it was not difficult to adjust.
> For the most part this means replacing foreach with reset
> and while.  Since the code is not using xml_set_object or
> get_class, et al, it is otherwise in good shape.
>=20
> Next, I would like to go through and replace all " with '.
> This has shown itself to improve performance noticeably.
>=20
> Lastly, I am interested in applying a new formatting style
> to the code, roughly along the lines of GNU and phpgroupware's
> format.  Here is a brief outline:
>=20
> <?php
> 	class myclass
> 	{
> 		var $somevar;
> 		var $somearray(
> 			'element1' =3D> 'value',
> 			'element2' =3D> 1
> 		);
> 	=09
> 		function myclass($arg=3DFalse)
> 		{
> 			if($arg)
> 			{
> 				echo 'hello world';
> 			}
> 		}
> 	}
> ?>
>=20
> The whitespace above are all tabs.  This format helps to ensure
> that most people are able to view and understand it more clearly,
> I feel.  Unbracketed if statements,etc., can be a pain to troubleshoot
> if you did not write the code.
>=20
> I know this last item will probably spark at least some debate,
> so I dare not touch that until I get some yeas and nays.
>=20
--=20
Edd Dumbill --/ voice: +44 1904 427740 fax: +44 8701 640230 /--
 | Managing Editor, XML.com -//- Publishing Editor, XMLhack.com
 | Chair, XML Europe 2002   -//- Chair, O'Reilly XTech 2001

[phpxmlrpc-devel] formatting and php3, etc.

[Miles L. <mi...@sp...>]

Hello to all (2) of you, and others who are hidden from
the subscriber list.

I am interested in first making sure the code is
php3-compliant.  We are using a modified version of this
code in phpgroupware, and it was not difficult to adjust.
For the most part this means replacing foreach with reset
and while.  Since the code is not using xml_set_object or
get_class, et al, it is otherwise in good shape.

Next, I would like to go through and replace all " with '.
This has shown itself to improve performance noticeably.

Lastly, I am interested in applying a new formatting style
to the code, roughly along the lines of GNU and phpgroupware's
format.  Here is a brief outline:

<?php
	class myclass
	{
		var $somevar;
		var $somearray(
			'element1' => 'value',
			'element2' => 1
		);
		
		function myclass($arg=False)
		{
			if($arg)
			{
				echo 'hello world';
			}
		}
	}
?>

The whitespace above are all tabs.  This format helps to ensure
that most people are able to view and understand it more clearly,
I feel.  Unbracketed if statements,etc., can be a pain to troubleshoot
if you did not write the code.

I know this last item will probably spark at least some debate,
so I dare not touch that until I get some yeas and nays.

-- 

Miles Lott - http://milosch.net
Handspring Visor USB and BeOS FS support for Linux
phpGroupWare - http://www.phpgroupware.org

[phpxmlrpc-devel] new developers

[Edd D. <ed...@us...>]

Welcome Miles Lott and Justin Miller as developers on the project.

Miles and Justin have both contributed patches: Justin's SSL patch was
integrated into the most recent release.

-- Edd