Hi,
Here is a patch to fix bug #42718:
http://bugs.php.net/?id=42718&edit=1
The "unsafe_raw" filter is not applied when configured as default
filter.
I found that the php_sapi_filter() internal function in
ext/filter/filter.c intentionally bypass this filter:
if (!(IF_G(default_filter) == FILTER_UNSAFE_RAW)){
(apply default filter)
} else [...]
The unsafe_raw filter does nothing by default, but it
can "optionally strip or encode special characters", and it is the
only filter which is able to do that without doing any other
filtering.
I suggest to not bypass the unsafe_raw filter when default_filter_flags is
different than 0 (bug42718.patch attached).
I also wrote a testcase for this bug: bug42718.phpt.
And an other testcase (052.phpt) to check if the patch does not modify the
behavior of the php_sapi_filter() function:
- Apply filter, only if filter will do something (unsafe_raw with no
flags do nothing)
- Else, fallback to magic_quotes_gpc if enabled
Regards
