| Summary | Horde-Text-Filter use preg_replace with eval |
| Queue | Horde Framework Packages |
| Queue Version | Git master |
| Type | Enhancement |
| State | Resolved |
| Priority | 1. Low |
| Owners | jan (at) horde (dot) org |
| Requester | remi (at) famillecollet (dot) com |
| Created | 01/10/2013 (4561 days ago) |
| Due | |
| Updated | 01/12/2013 (4559 days ago) |
| Assigned | |
| Resolved | 01/12/2013 (4559 days ago) |
| Milestone | |
| Patch | No |
Please check framework/Ldap/lib/Horde/Ldap/Util.php
Ligne 522: missing _callback in function call.
State ⇒ Resolved
commit 1bba90d1bdb04c774e35c97e0a7cacb668f025b5
Author: Jan Schneider <jan@horde.org>
Date: Sat Jan 12 16:03:36 2013 +0100
Replace preg_replace() /e modifier with preg_replace_callback()
(
Bug #11943).framework/Ldap/lib/Horde/Ldap/Util.php | 30 ++++++++++++++++---
framework/Mime/lib/Horde/Mime.php | 7 ++++-
.../Text_Filter/lib/Horde/Text/Filter/Emails.php | 7 ++++-
.../Text_Filter/lib/Horde/Text/Filter/Linkurls.php | 7 ++++-
framework/Vcs/lib/Horde/Vcs/Directory/Git.php | 6 +++-
horde/docs/CODING_STANDARDS | 3 +-
horde/lib/Application.php | 24 +++++++++++++++-
klutz/lib/Comic.php | 30 ++++++++++++++++---
luxor/lib/Lang.php | 16 +++++++++-
luxor/lib/SimpleParse.php | 11 ++++++-
wicked/lib/Page/MergeOrRename.php | 10 ++++++-
11 files changed, 129 insertions(+), 22 deletions(-)
http://git.horde.org/horde-git/-/commit/1bba90d1bdb04c774e35c97e0a7cacb668f025b5
Priority ⇒ 1. Low
New Attachment: Horde_Text_Filter-php55.patch
Patch ⇒ No
Milestone ⇒
Queue ⇒ Horde Framework Packages
Summary ⇒ Horde-Text-Filter use preg_replace with eval
Type ⇒ Enhancement
State ⇒ New
preg_replace with /e modifier (PREG_REPLACE_EVAL)
From PHP documentation :
"Use of this modifier is discouraged, as it can easily introduce
security vulnerabilite"
"This feature has been DEPRECATED as of PHP 5.5.0. Relying on this
feature is highly discouraged"
So with PHP 5.5, Horde_Text_Filter test suite fails with
preg_replace(): The /e modifier is deprecated, use
preg_replace_callback instead
The attached patch use preg_replace_callback instead, with an
anonymous function (supported since php 5.3.0).
I understand than php 5.5 is not yet supported, but as this fix
doesn't change the requirement and is still compatible with previous
php version, I hope you will consider it.