[MIR] php5-common is missing dependency on php5-json
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
php-json (Ubuntu) |
Fix Released
|
High
|
Unassigned | ||
php5 (Ubuntu) |
Fix Released
|
High
|
Unassigned | ||
pkg-php-tools (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
MIR for php-json:
[Availability]
Available in universe; successfully built on all architectures.
[Rationale]
Useful functionality for a large proportion of php users; JSON support is
pretty essential for many web services nowadays.
New dependency of php5 (see background information below)
[Security]
JSON parsing is security sensitive; particular in web applications for which
PHP is often used. This package is a wrapper around json-c which is in main
already. We do need to make sure that the wrapper is not vulnerable, but the
JSON parsing itself is already covered by json-c in main.
No other relevant security history. CVE-2009-1271 appears to refer to the JSON
module bundled with PHP and not this alternative implementation.
No suid or sgid binaries. No executables in /sbin or /usr/sbin. No daemons. No
use of privileged ports.
This is an add-on to PHP and an expected use (parsing untrusted input) is
security sensitive.
[QA]
Works with no further configuration or documentation.
No debconf questions.
No long-term outstanding bugs upstream. The only bug in Debian appears to
relate to a edge case difference in error handling behaviour, which I'm not
sure is a bug at all. No relevant bugs in Ubuntu.
Outstanding Lintian bugs all refer to PHP packaging issues; this package is
maintained by the PHP maintainer in Debian.
No exotic hardware.
Test suite is run during package build using dh_auto_test which fails on test
suite failure.
No watch file.
[Dependencies]
All in main, including libjson-c-dev.
[Standards compliance]
Packaging uses debhelper 9, standard phpize and dh-php5.
[Maintenance]
This is a straightforward wrapper around json-c. Except to trivially keep
synced with Debian.
The Ubuntu Server team will subscribe to the package.
[Background Information]
The JSON module bundled by PHP upstream is not DFSG compliant due to a problem
with a licence term. See
http://
does not ship with the embedded JSON module, but instead ships php-json
(binary: phphp5-json) which is an independent implementation, and php depends
on it.
For parity with Debian and common use of PHP, we should have php-json in main.
Otherwise we cannot depend on php5-json, and so JSON functionality in PHP will
be broken by default.
[Original Description]
After the upgrade to saucy the function json_encode is missing from the current version of php5.
It should be always there on PHP versions >= 5.2.0 (not a pecl module anymore) [1]
to reproduce:
---
user@vm:~$ echo '<?php json_encode(true);' | php
PHP Fatal error: Call to undefined function json_encode() in - on line 1
PHP Stack trace:
PHP 1. {main}() -:0
user@vm:~$ php -v
PHP 5.5.3-1ubuntu2 (cli) (built: Oct 9 2013 14:49:12)
Copyright (c) 1997-2013 The PHP Group
Zend Engine v2.5.0, Copyright (c) 1998-2013 Zend Technologies
with Zend OPcache v7.0.3-dev, Copyright (c) 1999-2013, by Zend Technologies
with Xdebug v2.2.3, Copyright (c) 2002-2013, by Derick Rethans
---
[1] http://
ProblemType: Bug
DistroRelease: Ubuntu 13.10
Package: php5 (not installed)
ProcVersionSign
Uname: Linux 3.11.0-12-generic x86_64
ApportVersion: 2.12.5-0ubuntu2
Architecture: amd64
Date: Mon Oct 21 16:30:04 2013
InstallationDate: Installed on 2013-06-03 (140 days ago)
InstallationMedia: Ubuntu 13.04 "Raring Ringtail" - Release amd64 (20130424)
MarkForUpload: True
SourcePackage: php5
UpgradeStatus: Upgraded to saucy on 2013-10-21 (0 days ago)
Changed in php-json (Ubuntu): | |
importance: | Undecided → High |
Changed in php-json (Ubuntu): | |
assignee: | Jamie Strandboge (jdstrand) → Seth Arnold (seth-arnold) |
adding php info