Some of the key new features include: namespaces, late static binding, closures, optional garbage collection for cyclic references, new extensions (like ext/phar, ext/intl and ext/fileinfo), over 140 bug fixes and much more.

For users upgrading from PHP 5.2 there is a migration guide available here, detailing the changes between those releases and PHP 5.3.0.

Further details about the PHP 5.3.0 release can be found in the release announcement, and the full list of changes are available in the ChangeLog.

The PHP development team would like to announce the immediate availability of PHP 5.2.10. This release focuses on improving the stability of the PHP 5.2.x branch with over 100 bug fixes, one of which is security related. All users of PHP are encouraged to upgrade to this release.

Version 5.2.10
18-June-2009

• Security Fixes
  o Fixed bug #48378 (exif_read_data() segfaults on certain corrupted .jpeg files). (Pierre)
• Updated timezone database to version 2009.9 (2009i) (Derick)
• Added “ignore_errors” option to http fopen wrapper. (David Zulke, Sara)
• Added new CURL options CURLOPT_REDIR_PROTOCOLS, CURLOPT_PROTOCOLS, and CURLPROTO_* for redirect fixes in CURL 7.19.4. (Yoram Bar Haim, Stas)
• Added support for Sun CC (FR #46595 and FR #46513). (David Soria Parra)
• Changed default value of array_unique()’s optional sorting type parameter back to SORT_STRING to fix backwards compatibility breakage introduced in PHP 5.2.9. (Moriyoshi)
• Fixed memory corruptions while reading properties of zip files. (Ilia)
• Fixed memory leak in ob_get_clean/ob_get_flush. (Christian)
• Fixed segfault on invalid session.save_path. (Hannes)
• Fixed leaks in imap when a mail_criteria is used. (Pierre)
• Fixed missing erealloc() in fix for Bug #40091 in spl_autoload_register. (Greg)
• Fixed bug #48562 (Reference recursion causes segfault when used in wddx_serialize_vars()). (Felipe)
• Fixed bug #48557 (Numeric string keys in Apache Hashmaps are not cast to integers). (David Zuelke)
• Fixed bug #48518 (curl crashes when writing into invalid file handle). (Tony)
• Fixed bug #48514 (cURL extension uses same resource name for simple and multi APIs). (Felipe)
• Fixed bug #48469 (ldap_get_entries() leaks memory on empty search results). (Patrick)
• Fixed bug #48456 (CPPFLAGS not restored properly in phpize.m4). (Jani, spisek at kerio dot com)
• Fixed bug #48448 (Compile failure under IRIX 6.5.30 building cast.c). (Kalle)
• Fixed bug #48441 (ldap_search() sizelimit, timelimit and deref options persist). (Patrick)
• Fixed bug #48434 (Improve memory_get_usage() accuracy). (Arnaud)
• Fixed bug #48416 (Force a cache limit in ereg() to stop excessive memory usage). (Scott)
• Fixed bug #48409 (Crash when exception is thrown while passing function arguments). (Arnaud)
• Fixed bug #48378 (exif_read_data() segfaults on certain corrupted .jpeg files). (Pierre)
• Fixed bug #48359 (Script hangs on snmprealwalk if OID is not increasing). (Ilia, simonov at gmail dot com)
• Fixed bug #48336 (ReflectionProperty::getDeclaringClass() does not work with redeclared property). (patch by Markus dot Lidel at shadowconnect dot com)
• Fixed bug #48326 (constant MSG_DONTWAIT not defined). (Arnaud)
• Fixed bug #48313 (fgetcsv() does not return null for empty rows). (Ilia)
• Fixed bug #48309 (stream_copy_to_stream() and fpasstru() do not update stream position of plain files). (Arnaud)
• Fixed bug #48307 (stream_copy_to_stream() copies 0 bytes when $source is a socket). (Arnaud)
• Fixed bug #48273 (snmp*_real_walk() returns SNMP errors as values). (Ilia, lytboris at gmail dot com)
• Fixed bug #48256 (Crash due to double-linking of history.o). (tstarling at wikimedia dot org)
• Fixed bug #48248 (SIGSEGV when access to private property via &__get). (Felipe)
• Fixed bug #48247 (Crash on errors during startup). (Stas)
• Fixed bug #48240 (DBA Segmentation fault dba_nextkey). (Felipe)
• Fixed bug #48224 (Incorrect shuffle in array_rand). (Etienne)
• Fixed bug #48221 (memory leak when passing invalid xslt parameter). (Felipe)
• Fixed bug #48207 (CURLOPT_(FILE|WRITEHEADER options do not error out when working with a non-writable stream). (Ilia)
• Fixed bug #48206 (Iterating over an invalid data structure with RecursiveIteratorIterator leads to a segfault). (Scott)
• Fixed bug #48204 (xmlwriter_open_uri() does not emit warnings on invalid paths). (Ilia)
• Fixed bug #48203 (Crash when CURLOPT_STDERR is set to regular file). (Jani)
• Fixed bug #48202 (Out of Memory error message when passing invalid file path) (Pierre)
• Fixed bug #48156 (Added support for lcov v1.7). (Ilia)
• Fixed bug #48132 (configure check for curl ssl support fails with –disable-rpath). (Jani)
• Fixed bug #48131 (Don’t try to bind ipv4 addresses to ipv6 ips via bindto). (Ilia)
• Fixed bug #48070 (PDO_OCI: Segfault when using persistent connection). (Pierre, Matteo, jarismar dot php at gmail dot com)
• Fixed bug #48058 (Year formatter goes wrong with out-of-int range). (Derick)
• Fixed bug #48038 (odbc_execute changes variables used to form params array). (Felipe)
• Fixed bug #47997 (stream_copy_to_stream returns 1 on empty streams). (Arnaud)
• Fixed bug #47991 (SSL streams fail if error stack contains items). (Mikko)
• Fixed bug #47981 (error handler not called regardless). (Hannes)
• Fixed bug #47969 (ezmlm_hash() returns different values depend on OS). (Ilia)
• Fixed bug #47946 (ImageConvolution overwrites background). (Ilia)
• Fixed bug #47940 (memory leaks in imap_body). (Pierre, Jake Levitt)
• Fixed bug #47937 (system() calls sapi_flush() regardless of output buffering). (Ilia)
• Fixed bug #47903 (”@” operator does not work with string offsets). (Felipe)
• Fixed bug #47893 (CLI aborts on non blocking stdout). (Arnaud)
• Fixed bug #47849 (Non-deep import loses the namespace). (Rob)
• Fixed bug #47845 (PDO_Firebird omits first row from query). (Lars W)
• Fixed bug #47836 (array operator [] inconsistency when the array has PHP_INT_MAX index value). (Matt)
• Fixed bug #47831 (Compile warning for strnlen() in main/spprintf.c). (Ilia, rainer dot jung at kippdata dot de)
• Fixed bug #47828 (openssl_x509_parse() segfaults when a UTF-8 conversion fails). (Scott, Kees Cook, Pierre)
• Fixed bug #47818 (Segfault due to bound callback param). (Felipe)
• Fixed bug #47801 (__call() accessed via parent:: operator is provided incorrect method name). (Felipe)
• Fixed bug #47769 (Strange extends PDO). (Felipe)
• Fixed bug #47745 (FILTER_VALIDATE_INT doesn’t allow minimum integer). (Dmitry)
• Fixed bug #47721 (Alignment issues in mbstring and sysvshm extension) (crrodriguez at opensuse dot org, Ilia)
• Fixed bug #47704 (PHP crashes on some “bad” operations with string offsets). (Dmitry)
• Fixed bug #47695 (build error when xmlrpc and iconv are compiled against different iconv versions). (Scott)
• Fixed bug #47667 (ZipArchive::OVERWRITE seems to have no effect). (Mikko, Pierre)
• Fixed bug #47644 (Valid integers are truncated with json_decode()). (Scott)
• Fixed bug #47639 (pg_copy_from() WARNING: nonstandard use of \\ in a string literal). (Ilia)
• Fixed bug #47616 (curl keeps crashing). (Felipe)
• Fixed bug #47598 (FILTER_VALIDATE_EMAIL is locale aware). (Ilia)
• Fixed bug #47566 (pcntl_wexitstatus() returns signed status). (patch by james at jamesreno dot com)
• Fixed bug #47564 (unpacking unsigned long 32bit bit endian returns wrong result). (Ilia)
• Fixed bug #47487 (performance degraded when reading large chunks after fix of bug #44607). (Arnaud)
• Fixed bug #47468 (enable cli|cgi-only extensions for embed sapi). (Jani)
• Fixed bug #47435 (FILTER_FLAG_NO_PRIV_RANGE does not work with ipv6 addresses in the filter extension). (Ilia)
• Fixed bug #47430 (Errors after writing to nodeValue parameter of an absent previousSibling). (Rob)
• Fixed bug #47365 (ip2long() may allow some invalid values on certain 64bit systems). (Ilia)
• Fixed bug #47254 (Wrong Reflection for extends class). (Felipe)
• Fixed bug #47042 (cgi sapi is incorrectly removing SCRIPT_FILENAME). (Sriram Natarajan, David Soria Parra)
• Fixed bug #46882 (Serialize / Unserialize misbehaviour under OS with different bit numbers). (Matt)
• Fixed bug #46812 (get_class_vars() does not include visible private variable looking at subclass). (Arnaud)
• Fixed bug #46386 (Digest authentication with SOAP module fails against MSSQL SOAP services). (Ilia, lordelph at gmail dot com)
• Fixed bug #46109 (Memory leak when mysqli::init() is called multiple times). (Andrey)
• Fixed bug #45997 (safe_mode bypass with exec/system/passthru (windows only)). (Pierre)
• Fixed bug #45877 (Array key ‘2147483647′ left as string). (Matt)
• Fixed bug #45822 (Near infinite-loops while parsing huge relative offsets). (Derick, Mike Sullivan)
• Fixed bug #45799 (imagepng() crashes on empty image). (Martin McNickle, Takeshi Abe)
• Fixed bug #45622 (isset($arrayObject->p) misbehaves with ArrayObject:: ARRAY_AS_PROPS set). (robin_fernandes at uk dot ibm dot com, Arnaud)
• Fixed bug #45614 (ArrayIterator::current(), ::key() can show 1st private prop of wrapped object). (robin_fernandes at uk dot ibm dot com, Arnaud)
• Fixed bug #45540 (stream_context_create creates bad http request). (Arnaud)
• Fixed bug #45202 (zlib.output_compression can not be set with ini_set()). (Jani)
• Fixed bug #45191 (error_log ignores date.timezone php.ini val when setting logging timestamps). (Derick)
• Fixed bug #45092 (header HTTP context option not being used when compiled using –with-curlwrappers). (Jani)
• Fixed bug #44996 (xmlrpc_decode() ignores time zone on iso8601.datetime). (Ilia, kawai at apache dot org)
• Fixed bug #44827 (define() is missing error checks for class constants). (Ilia)
• Fixed bug #44214 (Crash using preg_replace_callback() and global variables). (Nuno, Scott)
• Fixed bug #43073 (TrueType bounding box is wrong for angle<>0). (Martin McNickle)
• Fixed bug #42663 (gzinflate() try to allocate all memory with truncated data). (Arnaud)
• Fixed bug #42414 (some odbc_*() functions incompatible with Oracle ODBC driver). (jhml at gmx dot net)
• Fixed bug #42362 (HTTP status codes 204 and 304 should not be gzipped). (Scott, Edward Z. Yang)
• Fixed bug #42143 (The constant NAN is reported as 0 on Windows) (Kanwaljeet Singla, Venkat Raman Don)
• Fixed bug #38805 (PDO truncates text from SQL Server text data type field). (Steph)

Firefox 3.0.11 fixes several security issues found in Firefox 3.0.10 (4 Critical, 1 High, 2 Moderate, 2 Low):

MFSA 2009-32 JavaScript chrome privilege escalation
MFSA 2009-31 XUL scripts bypass content-policy checks
MFSA 2009-30 Incorrect principal set for file: resources loaded via location bar
MFSA 2009-29 Arbitrary code execution using event listeners attached to an element whose owner document is null
MFSA 2009-28 Race condition while accessing the private data of a NPObject JS wrapper class object
MFSA 2009-27 SSL tampering via non-200 responses to proxy CONNECT requests
MFSA 2009-26 Arbitrary domain cookie access by local file: resources
MFSA 2009-25 URL spoofing with invalid unicode characters
MFSA 2009-24 Crashes with evidence of memory corruption (rv:1.9.0.11)

The sooner… the safer!

Click on the archive on the top menu!

Errors:
SQL error “Out of range value adjusted for column…”

if you have removed STRICT_TRANS_TABLES from my.ini (Windows) or my.cnf (Linux)
Server SQL Modes

You will get this error…
Duplicate entry xxx for key 1

ATTENTION:
If you want to remove STRICT_TRANS_TABLES
1. You need to have access and restart MySQL Server! A production server !?!?
2. Not everybody has root access or admin rights to change the sql mode.
3. Maybe, you need the server to run in strict mode for some reason.
4. NOT RECOMMENDED!

Solution:
Check the field type (e.g test_id TINYINT -128 to 127 )
So if you are trying to insert into a table value 128 it won’t insert !

MySQL 5.1 Reference Manual :: 10 Data Types :: 10.2 Numeric Types

Read also:
Masai Mara - Giraffe trying to give birth
Around the world

Read more…

The Open Web Application Security Project (OWASP) is a worldwide free and open community focused on improving the security of application software. Our mission is to make application security visible, so that people and organizations can make informed decisions about true application security risks. Everyone is free to participate in OWASP and all of our materials are available under a free and open software license. The OWASP Foundation is a 501c3 not-for-profit charitable organization that ensures the ongoing availability and support for our work with your support.

Nikolas Branis’s Profile

Allow PDFs to be searched via the Joomla/Mambo search module.

This Joomla/Mambo Component allows you to index PDFs located within your Joomla directory and the corresponding mosbot allows that index to be searched using the Joomla search component. This allows the text of PDFs to be viewed when searching a Joomla site.

Version 2.4

New Features:
* Joomla 1.5 legacy support
* More bug fixes

Also Featuring:
* Indexes new pdfs only so indexing is much faster.
* PDF file version changes.  It will automatically detect if a PDF has changed and index it on the next pass.
* Delete indexes to PDFs that have been removed from your file structure.
* Password Protected PDF indexing!
* Ability to edit past indexes (For those image based pdfs, add keywords, phrases)
* Improved MosBot
* Other Various Bug Fixes

Does not work on servers in SafeMode or when Popen is off.

Great work! Really!
But i run into a big problem…

I have tested PDF Indexer with Joomla 1.5 and works PERFECT with “small” pdf files.
With “Small” pdf files I mean up to 1 MB.
When I tried a “bigger” pdf file like 10 MB or even worst 40MB or 80MB, although it seemed that it was working (that is, no errors found) when I tried to see it in “Modify Indexes” from the Administration Menu… it wasn’t there.

Solution:

1. Edit the file…
/administrator/components/com_file_index/admin.file_index.php

Lines 366,445:
Change this…
$contents .= fread($handle2, 8192);
to this…
$contents .= fread($handle2, $fileSize);

then add the following line…
ini_set("memory_limit","128M");
in the first lines of the file.

Alternative: If you have access, change the memory_limit = 32M to  memory_limit = 128M in your /etc/php.ini file. Restart apache !!!

2. Edit the file…
/etc/my.cnf
set-variable = max_allowed_packet=xM
where xM the needed MB (for example 5MB)!

Fire up phpMyAdmin or open your favorite MySQL Manager.
Go to the Joomla DATABASE and in the TABLE that stores the data for indexing edit the FIELD Description to LONGTEXT.
Restart mysql !!!

That’s all!

The results were great. In a few seconds a 78MB pdf file was indexed !

Senario
You have taken a few nice photos with your brand new camera and you have uploaded them to your blog (website) so family,friends and visitors could see them.
That is so… nice.
That is what the HotLinkers said too.

Solution
Use the mod_rewrite module of Apache.
Let’s say your site’s url is www.MyDomain.com.
Fire up your preffered editor, copy these lines below…

RewriteEngine On
# Uncomment the next line if you have placed your images in a folder called photos. As you can see /photos/ is in root directory and the .htaccess file will take care all the subfolders if you have any...
# RewriteBase /photos/
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?MyDomain.com/.*$ [NC]
RewriteRule \.(gif|jpg|swf|flv|png|JPG)$ http://www.MyDomain.com [R,NC]

and paste them to a file you will call .htaccess (mind the dot please… it’s important!)
Put the .htaccess file to the folder where your photos are…
That’s all!

Keep in mind that even Google will not be able to HotLink your images. If you want to allow this, just insert this line…

RewriteCond %{HTTP_REFERER} !^http://(www\.)?images.google.com(/)?.*$ [NC]

Before the RewriteRule.
Now you are done.

“The great thing about mod_rewrite is it gives you all the configurability and flexibility of Sendmail. The downside to mod_rewrite is that it gives you all the configurability and flexibility of Sendmail.”
– Brian Behlendorf

“Despite the tons of examples and docs, mod_rewrite is voodoo. Damned cool voodoo, but still voodoo.”
– Brian Moore

Title: Crash in nsTextFrame::ClearTextRun()
Impact: Critical
Announced: April 27, 2009
Reporter: Marc Gueury, Daniel Veditz
Fixed in: Firefox 3.0.10

Description
One of the security fixes in Firefox 3.0.9 introduced a regression that caused some users to experience frequent crashes. Users of the HTML Validator add-on were particularly affected, but other users also experienced this crash in some situations. In analyzing this crash we discovered that it was due to memory corruption similar to cases that have been identified as security vulnerabilities in the past.

Download Firefox 3.0.10