com php-src: Fixed bug #72071: Prevent Max-Age from being negative: NEWS ext/standard/head.c ext/standard/tests/network/bug72071.phpt ext/standard/tests/network/setcookie.phpt
[email protected] (Nikita Popov)
| Newsgroups | php.cvs |
|---|---|
| Message-ID | <[email protected]> |
Commit: ba6561d3cc5ef8c2d5a698622586e7aa28e76f5a Author: Craig Duncan <[email protected]> Mon, 3 Apr 2017 12:31:26 +0100 Committer: Nikita Popov <[email protected]> Sun, 9 Apr 2017 13:14:40 +0200 Parents: 948ad747d7fa3894fa3ff13cfa4436e0cf442096 Branches: PHP-7.0 PHP-7.1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=ba6561d3cc5ef8c2d5a698622586e7aa28e76f5a Log: Fixed bug #72071: Prevent Max-Age from being negative Bugs: https://bugs.php.net/72071 Changed paths: M NEWS M ext/standard/head.c A ext/standard/tests/network/bug72071.phpt M ext/standard/tests/network/setcookie.phpt Diff: diff --git a/NEWS b/NEWS index eff9bb0..e68c7fb 100644 --- a/NEWS +++ b/NEWS @@ -11,6 +11,9 @@ PHP NEWS seconds). (Moritz Fain) . Add OpenSSL 1.1.0 support. (Jakub Zelenka) +- Standard: + . Fixed bug #72071 (setcookie allows max-age to be negative). (Craig Duncan) + 13 Apr 2017 PHP 7.0.18 - Core: diff --git a/ext/standard/head.c b/ext/standard/head.c index 5c2da97..13c1c7b 100644 --- a/ext/standard/head.c +++ b/ext/standard/head.c @@ -134,6 +134,8 @@ PHPAPI int php_setcookie(zend_string *name, zend_string *value, time_t expires, if (expires > 0) { const char *p; char tsdelta[13]; + double diff; + strlcat(cookie, COOKIE_EXPIRES, len + 100); dt = php_format_date("D, d-M-Y H:i:s T", sizeof("D, d-M-Y H:i:s T")-1, expires, 0); /* check to make sure that the year does not exceed 4 digits in length */ @@ -148,7 +150,11 @@ PHPAPI int php_setcookie(zend_string *name, zend_string *value, time_t expires, strlcat(cookie, ZSTR_VAL(dt), len + 100); zend_string_free(dt); - snprintf(tsdelta, sizeof(tsdelta), ZEND_LONG_FMT, (zend_long) difftime(expires, time(NULL))); + diff = difftime(expires, time(NULL)); + if (diff < 0) { + diff = 0; + } + snprintf(tsdelta, sizeof(tsdelta), ZEND_LONG_FMT, (zend_long) diff); strlcat(cookie, COOKIE_MAX_AGE, len + 100); strlcat(cookie, tsdelta, len + 100); } diff --git a/ext/standard/tests/network/bug72071.phpt b/ext/standard/tests/network/bug72071.phpt new file mode 100644 index 0000000..6d19ab4 --- /dev/null +++ b/ext/standard/tests/network/bug72071.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #72071 setcookie allows max-age to be negative +--INI-- +date.timezone=UTC +--FILE-- +<?php + +$date = mktime(12, 25, 39, 4, 1, 2017); +setcookie("name", "value", $date); + +?> +--EXPECT-- +--EXPECTHEADERS-- +Set-Cookie: name=value; expires=Sat, 01-Apr-2017 12:25:39 GMT; Max-Age=0 diff --git a/ext/standard/tests/network/setcookie.phpt b/ext/standard/tests/network/setcookie.phpt index 68c9299..3582d34 100644 --- a/ext/standard/tests/network/setcookie.phpt +++ b/ext/standard/tests/network/setcookie.phpt @@ -26,7 +26,7 @@ $expected = array( 'Set-Cookie: name=space+value', 'Set-Cookie: name=value', 'Set-Cookie: name=value; expires='.date('D, d-M-Y H:i:s', $tsp).' GMT; Max-Age=5', - 'Set-Cookie: name=value; expires='.date('D, d-M-Y H:i:s', $tsn).' GMT; Max-Age=-6', + 'Set-Cookie: name=value; expires='.date('D, d-M-Y H:i:s', $tsn).' GMT; Max-Age=0', 'Set-Cookie: name=value; expires='.date('D, d-M-Y H:i:s', $tsc).' GMT; Max-Age=0', 'Set-Cookie: name=value; path=/path/', 'Set-Cookie: name=value; domain=domain.tld',