5.4.28

This reverts commit b05c088a3a.
Breaks case like this: /path/path2?param=foo:bar

NEWS

@@ -1,13 +1,11 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2014, PHP 5.4.28
+01 May 2014, PHP 5.4.28
 
 - Core:
   . Fixed bug #61019 (Out of memory on command stream_get_contents). (Mike)
   . Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace 
     UNIX sockets). (Mike)
-  . Fixed bug #64604 (parse_url is inconsistent with specified port). 
-    (Ingo Walz)
   . Fixed bug #66171 (Symlinks and session handler allow open_basedir bypass).
     (Jann Horn, Stas)
   . Fixed bug #66182 (exit in stream filter produces segfault). (Mike)
@@ -32,6 +30,8 @@ PHP                                                                        NEWS
 
 - FPM:
   . Fixed bug #66482 (unknown entry 'priority' in php-fpm.conf). 
+  . Fixed bug #67060 (sapi/fpm: possible privilege escalation due to insecure 
+    default configuration) (CVE-2014-0185). (Stas)
 
 - JSON:
   . Fixed bug #66021 (Blank line inside empty array/object when

configure.in

@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=4
 PHP_RELEASE_VERSION=28
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/standard/tests/url/bug64604.phpt

@@ -1,40 +0,0 @@
---TEST--
-Bug #64604 parse_url is inconsistent with specified port
---FILE--
-<?php
-var_dump(parse_url('//localhost/path'));
-var_dump(parse_url('//localhost:80/path'));
-var_dump(parse_url('//localhost:/path'));
-var_dump(parse_url('http://localhost:80/path'));
-?>
---EXPECT--
-array(2) {
-  ["host"]=>
-  string(9) "localhost"
-  ["path"]=>
-  string(5) "/path"
-}
-array(3) {
-  ["host"]=>
-  string(9) "localhost"
-  ["port"]=>
-  int(80)
-  ["path"]=>
-  string(5) "/path"
-}
-array(2) {
-  ["host"]=>
-  string(9) "localhost"
-  ["path"]=>
-  string(5) "/path"
-}
-array(4) {
-  ["scheme"]=>
-  string(4) "http"
-  ["host"]=>
-  string(9) "localhost"
-  ["port"]=>
-  int(80)
-  ["path"]=>
-  string(5) "/path"
-}

ext/standard/url.c

@@ -181,10 +181,6 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 		p = e + 1;
 		pp = p;
 
-		if (*s == '/' && *(s+1) == '/') { /* relative-scheme URL */
-			s += 2;
-		}
-
 		while (pp-p < 6 && isdigit(*pp)) {
 			pp++;
 		}
@@ -205,6 +201,10 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 			STR_FREE(ret->scheme);
 			efree(ret);
 			return NULL;
+		} else if (*s == '/' && *(s+1) == '/') { /* relative-scheme URL */
+			s += 2;
+		} else {
+			goto just_path;
 		}
 	} else if (*s == '/' && *(s+1) == '/') { /* relative-scheme URL */
 		s += 2;

main/php_version.h

@@ -3,6 +3,6 @@
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 4
 #define PHP_RELEASE_VERSION 28
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.4.28-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.4.28"
 #define PHP_VERSION_ID 50428

sapi/fpm/fpm/fpm_unix.c

@@ -35,7 +35,7 @@ int fpm_unix_resolve_socket_premissions(struct fpm_worker_pool_s *wp) /* {{{ */
 	/* uninitialized */
 	wp->socket_uid = -1;
 	wp->socket_gid = -1;
-	wp->socket_mode = 0666;
+	wp->socket_mode = 0660;
 
 	if (!c) {
 		return 0;

sapi/fpm/php-fpm.conf.in

@@ -166,10 +166,10 @@ listen = 127.0.0.1:9000
 ; permissions must be set in order to allow connections from a web server. Many
 ; BSD-derived systems allow connections regardless of permissions. 
 ; Default Values: user and group are set as the running user
-;                 mode is set to 0666
+;                 mode is set to 0660
 ;listen.owner = @php_fpm_user@
 ;listen.group = @php_fpm_group@
-;listen.mode = 0666
+;listen.mode = 0660
  
 ; List of ipv4 addresses of FastCGI clients which are allowed to connect.
 ; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original