Ilia Alshanetsky 7b3369c0c2 Fix GH-24315: Harden SoapClient cross-origin redirect handling (#24329) ...

SoapClient followed any Location header, so a redirect to another host,
port, or scheme resent the HTTP authentication credentials, the stream
context headers, and the SOAP envelope to that origin. Such redirects now
fail with a SoapFault. A same-host upgrade from http to https on port 443
is still followed. The new follow_cross_origin_redirects option restores
the previous behavior. Cookies were already scoped by domain and
Proxy-Authorization only reaches the proxy, so neither changes.

Fixes GH-24315

2026-10-25 07:01:05 -04:00

..

tests

Fix GH-24315: Harden SoapClient cross-origin redirect handling (#24329)

2026-10-25 07:01:05 -04:00

config.m4

Windows: Remove useless ext/hash dependencies (#23929)

2026-09-27 02:39:02 +08:00

config.w32

Windows: Remove useless ext/hash dependencies (#23929)

2026-09-27 02:39:02 +08:00

CREDITS

…

php_encoding.c

Merge branch 'PHP-8.6' into master

2026-10-21 16:34:56 +02:00

php_encoding.h

license-update: ext/soap source headers

2026-04-11 21:20:54 -05:00

php_http.c

Fix GH-24315: Harden SoapClient cross-origin redirect handling (#24329)

2026-10-25 07:01:05 -04:00

php_http.h

ext/soap: use bool type instead of int type in php_http.c

2026-07-03 11:28:29 +01:00

php_packet_soap.c

ext/soap: Add UNEXPECTED() in obvious error path (#22596)

2026-07-05 12:28:12 +08:00

php_packet_soap.h

ext/soap: refactor parse_packet_soap()

2026-07-03 11:28:29 +01:00

php_schema.c

Merge branch 'PHP-8.5'

2026-09-07 18:13:23 -04:00

php_schema.h

license-update: ext/soap source headers

2026-04-11 21:20:54 -05:00

php_sdl.c

SoapClient: add new keep_headers option

2026-10-19 14:39:11 -07:00

php_sdl.h

SoapClient: add new keep_headers option

2026-10-19 14:39:11 -07:00

php_soap.h

Fix GH-24315: Harden SoapClient cross-origin redirect handling (#24329)

2026-10-25 07:01:05 -04:00

php_xml.c

Merge branch 'PHP-8.5'

2026-09-22 11:15:26 +02:00

php_xml.h

ext/soap: use bool type instead of int type in php_xml.c

2026-07-03 11:28:29 +01:00

soap_arginfo.h

Fix GH-24315: Harden SoapClient cross-origin redirect handling (#24329)

2026-10-25 07:01:05 -04:00

soap.c

Fix GH-24315: Harden SoapClient cross-origin redirect handling (#24329)

2026-10-25 07:01:05 -04:00

soap.stub.php

Fix GH-24315: Harden SoapClient cross-origin redirect handling (#24329)

2026-10-25 07:01:05 -04:00