All notable changes to this project will be documented in this file, in reverse chronological order by release.
Curl
and
Socket
client adapters; it now correctly identifies both integer and string
integer values.#165 fixes detection of the base URL when operating under a CLI environment.
#149 provides fixes to Client::setUri()
to ensure its status as a relative
or absolute URI is correctly memoized.
#162 fixes a typo in an exception message raised within Cookies::fromString()
.
#121 adds detection for non-numeric connection timeout values as well as integer casting to ensure the timeout is set properly in both the Curl and Socket adapters.
Zend\Http\Exception\InvalidArgumentException
in such cases. This change ensures the behavior is consistent with behavior
prior to the 2.8.0 release.Zend\Http\PhpEnvironment\Request
marshals the
request URI. In prior releases, we would attempt to inspect the
X-Rewrite-Url
and X-Original-Url
headers, using their values, if present.
These headers are issued by the ISAPI_Rewrite module for IIS (developed by
HeliconTech). However, we have no way of guaranteeing that the module is what
issued the headers, making it an unreliable source for discovering the URI. As
such, we have removed this feature in this release of zend-http.If you are developing a zend-mvc application, you can mimic the functionality by adding a bootstrap listener like the following:
public function onBootstrap(MvcEvent $mvcEvent)
{
$request = $mvcEvent->getRequest();
$requestUri = null;
$httpXRewriteUrl = $request->getHeader('X-Rewrite-Url');
if ($httpXRewriteUrl) {
$requestUri = $httpXRewriteUrl->getFieldValue();
}
$httpXOriginalUrl = $request->getHeader('X-Original-Url');
if ($httpXOriginalUrl) {
$requestUri = $httpXOriginalUrl->getFieldValue();
}
if ($requestUri) {
$request->setUri($requestUri)
}
}
If you use a listener such as the above, make sure you also instruct your web server to strip any incoming headers of the same name so that you can guarantee they are issued by the ISAPI_Rewrite module.
#135 adds a package suggestion of paragonie/certainty, which provides automated management of cacert.pem files.
#143 adds support for PHP 7.2.
#140 fixes retrieval of headers when multiple headers of the same name
are added to the Headers
instance; it now ensures that the last header added of the same
type is retrieved when it is not a multi-value type. Previous values are overwritten.
#112 provides performance improvements when parsing large chunked messages.
introduces changes to Response::fromString()
to pull the next line of the response
and parse it for the status when a 100 status code is initially encountered, per https://tools.ietf.org/html/rfc7231#section-6.2.1
#122 fixes an issue with the stream response whereby if the outputstream
option is set, the output file was opened twice; it is now opened exactly once.
#147 fixes an issue with header retrieval when the header line is malformed.
Previously, an exception would be raised if a specific HeaderInterface
implementation determined
the header line was invalid. Now, Header::has()
will return false for such headers, allowing
Request::getHeader()
to return false
or the provided default value. Additionally, in cases
where the header name is malformed (e.g., Useragent
instead of User-Agent
, users can still
retrieve by the submitted header name; they will receive a GenericHeader
instance in such
cases, however.
#133 Adds back missing sprintf placeholder in CacheControl exception message
connecttimeout
) for cURL and Socket adapters.sslcafile
and sslcapath
to cURL adapter.Expires
header to allow values of 0
or '0'
; these now resolve
to the start of the unix epoch (1970-01-01).none
(empty value).ContentLength
constructor to test for a non null value (vs a falsy value)
before validating the value; this ensures 0 values may be specified for the
length.SetCookie
header. The fix backs out a
check for message splitting syntax, as that particular class already encodes
the value in a manner that prevents the attack. It also adds tests to ensure
the security vulnerability remains patched.Response::extractCode()
, which does not exist, to
Response::fromString()->getStatusCode()
, which does.CURLINFO_HEADER_OUT
, which is required to ensure
we can fetch the raw request after it is sent.Zend\Http\PhpEnvironment\Request
to ensure that empty SCRIPT_FILENAME
and
SCRIPT_NAME
values which result in an empty $baseUrl
will not raise an
E_WARNING
when used to do a strpos()
check during base URI detection.