PHP 5.2.9-1 (for Windows) released

Fixes security flaw

[coopster]

FYI if you are running PHP on Windows:

5.2.9-1 (for Windows) released [php.net]

[10-Mar-2009] The PHP Development Team would like to announce the availability of a new Windows build of PHP - PHP 5.2.9-1

This release focuses on fixing a security flaw introduced by the cURL library (CVE-2009-0037). Please see the following for a full description: [curl.haxx.se...]

Please note that the cURL related function is disabled when open_basedir or safe_mode enabled.

Note: Only the Windows packages are affected.

[coopster]

I loaded this today on a development laptop. I took the time to review the note on cURL as well.

If you are running a Windows server you really should patch to this level, especially if you are using the server in a production environment.

[coopster]

Unless you are using pspell!

To use the pspell functions you need to have aspell loaded and the aspell binary must be in your PATH. The tests I have been running show that your Apache server will start just fine but if you try to use any pspell functions, you'll lock up your httpd executable. Command line processing will do the same. I set up a PHP 5.2.8 and met the same issue ... tracking back down, 5.2.6 is the last release that worked properly.

Does anybody else have a Windows development box up and running using a PHP release > 5.2.6 that can confirm the issue?

[coopster]

I was just chatting with a friend and we were reminded of the big hiccup at 5.2.7 [php.net]. I did a quick scan of the changelog to see what, if anything, jumped out. Nothing, really. So I went back to my 5.2.6 install to do some comparisons and have a look at the dll causing the issue. There is a dll in the root folder for PHP > 5.2.6 called "aspell-15.dll" which was causing the issue. I noticed the very same dll does not exist in the 5.2.6 distro so I deleted it from my PHP > 5.2.6 installs and the problem is gone. pspell works again.

Go figure.

[web_young]

I installed this latest PHP version on a new server (windows 2003, IIS 6) to test it out and had an odd problem, but maybe this has changed in PHP and I haven't noticed. I found that my scripts wouldn't work the way I've written them in the past:

<? script here ?>

I had to change them all to:

<?php script here ?>

Notice I have to start them with <?php now. Is this something new that is required, I use to think it was optional to start that way. Do I need to change a setting somewhere?

[coopster]

That is a configuration directive [php.net] called short_open_tag [php.net]. Best practice when Escaping from HTML [php.net] is to use the full php tag as you did in your updates.