Skip to content

Commit addc3c9

Browse files
committed
Fix #79174: cookie values with spaces fail to round-trip
The fix for bug #78929 disabled the conversion of spaces in cookie values to plus signs, but failed to adapt `php_setcookie()` accordingly, so that it uses raw URL encoding as well.
1 parent d705276 commit addc3c9

File tree

3 files changed

+3
-2
lines changed

3 files changed

+3
-2
lines changed

Diff for: NEWS

+1
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ PHP NEWS
99
. Fixed bug #78323 (Code 0 is returned on invalid options). (Ivan Mikheykin)
1010
. Fixed bug #78989 (Delayed variance check involving trait segfaults).
1111
(Nikita)
12+
. Fixed bug #79174 (cookie values with spaces fail to round-trip). (cmb)
1213

1314
- CURL:
1415
. Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()).

Diff for: ext/standard/head.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ PHPAPI int php_setcookie(zend_string *name, zend_string *value, time_t expires,
125125
smart_str_append(&buf, name);
126126
smart_str_appendc(&buf, '=');
127127
if (url_encode) {
128-
zend_string *encoded_value = php_url_encode(ZSTR_VAL(value), ZSTR_LEN(value));
128+
zend_string *encoded_value = php_raw_url_encode(ZSTR_VAL(value), ZSTR_LEN(value));
129129
smart_str_append(&buf, encoded_value);
130130
zend_string_release_ex(encoded_value, 0);
131131
} else {

Diff for: ext/standard/tests/network/setcookie.phpt

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ $expected = array(
2424
'Set-Cookie: name=deleted; expires='.date('D, d-M-Y H:i:s', 1).' GMT; Max-Age=0',
2525
'Set-Cookie: name=deleted; expires='.date('D, d-M-Y H:i:s', 1).' GMT; Max-Age=0',
2626
'Set-Cookie: name=value',
27-
'Set-Cookie: name=space+value',
27+
'Set-Cookie: name=space%20value',
2828
'Set-Cookie: name=value',
2929
'Set-Cookie: name=value; expires='.date('D, d-M-Y H:i:s', $tsp).' GMT; Max-Age=5',
3030
'Set-Cookie: name=value; expires='.date('D, d-M-Y H:i:s', $tsn).' GMT; Max-Age=0',

0 commit comments

Comments
 (0)