source: extensions/Google2Piwigo/include/Zend/README.txt @ 17475

Revision 17475, 11.9 KB checked in by mistic100, 7 years ago (diff)

new extension: Google2Piwigo

Line 
1Welcome to the Zend Framework 1.11 Release!
2
3RELEASE INFORMATION
4---------------
5Zend Framework 1.11.12 Release (r24992).
6Released on June 22, 2012.
7
8SECURITY NOTICE FOR 1.11.12
9---------------------------
10
11This release includes patches to each of the Request and Response
12objects within Zend_XmlRpc. These objects were found to be vulnerable to
13XML eXternal Entity Injection attacks due to insecure usage of the
14SimpleXMLElement class (SimpleXML PHP extension).  External entities
15could be specified by adding a specific DOCTYPE element to XML-RPC
16requests; exploiting this vulnerability could coerce opening arbitrary
17files and/or TCP connections.
18
19The patch in 1.11.12 ensures libxml_disable_entity_loader() is called
20before any SimpleXML calls are executed, thus removing the
21vulnerability.
22
23Thanks goes to Johannes Greil and Kestutis Gudinavicius of SEC-Consult
24for reporting the vulnerability and working with us to provide a working
25solution.
26
27SECURITY NOTICE FOR 1.11.6
28--------------------------
29
30This release includes a patch that helps prevent SQL injection attacks
31in applications using the MySQL PDO driver of PHP while using non-ASCII
32compatible encodings. Developers using ASCII-compatible encodings like
33UTF8 or latin1 are not affected by this PHP issue, which is described
34in more detail here: http://bugs.php.net/bug.php?id=47802
35
36The PHP Group included a feature in PHP 5.3.6+ that allows any
37character set information to be passed as part of the DSN in PDO to
38allow both the database as well as the c-level driver to be aware of
39which charset is in use which is of special importance when PDO's
40quoting mechanisms are utilized, which Zend Framework also relies on.
41
42Our patch ensures that any charset information provided to the Zend_Db
43PDO MySQL adapter will be sent to PDO both as part of the DSN as well
44as in a SET NAMES query.  This ensures that any developer using ZF on
45PHP 5.3.6+ while using non-ASCII compatible encodings is safe from SQL
46injection while using the PDO's quoting mechanisms or emulated prepared
47statements.
48
49If you are using non-ASCII compatible encodings, like GBK, we strongly
50urge you to consider upgrading to at least PHP 5.3.6 and use
51Zend Framework version 1.11.6 or 1.10.9
52
53NEW FEATURES
54------------
55
56Mobile Support:
57
58    Zend Framework 1.11 marks the first release with explicit support
59    for mobile devices, via the new component Zend_Http_UserAgent. This
60    component was developed by Raphael Carles, CTO of Interakting.
61   
62    Zend_Http_UserAgent performs two responsibilities:
63   
64     * User-Agent detection
65     * Device capabilities detection, based on User-Agent
66   
67    The component includes a "features" adapter mechanism that allows
68    developers to tie into different backends for the purpose of
69    discovering device capabilities. Currently, ships with adapters for
70    the WURFL (Wireless Universal Resource File) API, TeraWURFL, and
71    DeviceAtlas.
72   
73     * Note: Luca Passani, author and lead of the WURFL project, has
74       provided an exemption to Zend Framework to provide a non-GPL
75       adapter accessing the WURFL PHP API.
76   
77    Additional hooks into the component are provided via a
78    Zend_Application resource plugin, and a Zend_View helper, allowing
79    developers the ability to return output customized for the detected
80    device (e.g., alternate layouts, alternate images, Flash versus
81    HTML5 support, etc.).
82
83Zend_Cloud: SimpleCloud API:
84
85    During ZendCon 2009, Zend announced a prototype of the SimpleCloud
86    API. This API was to provide hooks into cloud-based document
87    storage, queue services, and file storage.
88
89    Zend Framework 1.11.0 markes the first official, stable release of
90    Zend_Cloud, Zend Framework's PHP version of the SimpleCloud API.
91    Current support includes:
92
93    * Document Services:
94      - Amazon SimpleDB
95      - Windows Azure's Table Storage
96    * Queue Services:
97      - Amazon Simple Queue Service (SQS)
98      - Windows Azure's Queue Service
99      - All adapters supported by Zend_Queue:
100        * Zend Platform JobQueue
101        * Memcacheq
102        * Relational Database
103        * ActiveMQ
104    * Storage Services:
105      - Amazon Simple Storage Service (S3)
106      - Windows Azure's Blog Storage
107      - Nirvanix
108      - Local filesystem
109
110    When using any of the SimpleCloud APIs, your code will be portable
111    across the various adapters provided, allowing you to pick and
112    choose your services, as well as try different services until you
113    find one that suits your application or business needs.
114    Additionally, if you find you need to code adapter-specific
115    features, you can drop down to the specific adapter in order to do
116    so.
117
118    More adapters will be arriving in the coming months, giving you even
119    more options!
120
121    We thank Wil Sinclair and Stas Malyshev for their assistance in the
122    initial releases of Zend_Cloud.
123
124Security:
125
126    Several classes in Zend Framework were patched to eliminate the
127    potential for leaking timing information from the direct comparison
128    of sensitive data such as plaintext passwords or cryptographic
129    signatures to user input. These leaks arise from the normal process
130    of comparing any two strings in PHP. The nature of the leaks is that
131    strings are often compared byte by byte, with a negative result
132    being returned early as soon as any set of non-matching bytes is
133    detected. The more bytes that are equal (starting from the first
134    byte) between both sides of the comparison, the longer it takes for
135    a final result to be returned. Based on the time it takes to return
136    a negative or positive result, it is possible that an attacker
137    could, over many samples of requests, craft a string that compares
138    positively to another secret string value known only to a target
139    server simply by guessing the string one byte at a time and
140    measuring each guess' execution time. This server secret could be a
141    plaintext password or the correct cryptographic signature of a
142    request the attacker wants to execute, such as is used in several
143    open protocols including OpenID and OAuth. This could obviously
144    enable an attacker to gain sufficient information to perform a
145    secondary attack such as masquerading as an authenticated user.
146
147    This form of attack is known as a Remote Timing Attack. Timing
148    Attacks have been problematic in the past but to date have been very
149    difficult to perform remotely over the internet due to the
150    interference of network jitter which limits their effectiveness in
151    resolving very small timing differences. While the internet still
152    poses a challenge to performing successful Timing Attacks against a
153    remote server, the increasing use of frameworks on local networks
154    and in cloud computing, where network jitter may be significantly
155    reduced, raises the distinct possibility that remote Timing Attacks
156    will become feasible against ever smaller timing information leaks,
157    such as those leaked when comparing any two strings. As a
158    precaution, the applied changes implement a fixed time comparison
159    for several classes which would be attractive targets in any
160    potential remote Timing Attack. A fixed time comparison function
161    does not leak any timing information useful to an attacker thus
162    proactively preventing any future vulnerability to these forms of
163    attack.
164
165    We thank Padraic Brady for his efforts in identifying and patching
166    these vulnerabilities.
167
168SimpleDB Support:
169
170    Zend Framework has provided support for Amazon's Simple Storage
171    Service (S3), Simple Queue Service (SQS), and Elastic Cloud Compute
172    (EC2) platforms for several releases. Zend Framework 1.11.0 adds
173    support for SimpleDB, Amazon's non-relational document storage
174    database offering. Support is available for all SimpleDB operations
175    via Zend_Service_Amazon_SimpleDb.
176   
177    Zend Framework's SimpleDB adapter was originally written by Wil
178    Sinclair.
179
180eBay Findings API Support:
181
182    eBay has an extensive REST API, allowing developers to build
183    applications interacting with their extensive data. Zend Framework
184    1.11.0 includes Zend_Service_Ebay_Findings, which provides complete
185    support for the eBay Findings API. This API allows developers to
186    query eBay for details on active auctions, using categories or
187    keywords.
188
189    Zend_Service_Ebay was contributed by Renan de Lima and Ramon
190    Henrique Ornelas.
191
192New Configuration Formats:
193
194    Zend_Config has been a quite popular component in Zend Framework,
195    and has offerred adapters for PHP arrays, XML, and INI configuration
196    files. Zend Framework 1.11.0 now offers two additional configuration
197    formats: YAML and JSON.
198
199    Zend_Config_Yaml provides a very rudimentary YAML-parser that should
200    work with most configuration formats. However, it also allows you to
201    specify an alternate YAML parser if desired, allowing you to lever
202    tools such as PECL's ext/syck or Symfony's YAML component, sfYaml.
203
204    Zend_Config_Json leverages the Zend_Json component, and by extension
205    ext/json.
206
207    Both adapters have support for PHP constants, as well as provide the
208    ability to write configuration files based on configuration objects.
209
210    Stas Malyshev created both adapters for Zend Framework;
211    Zend_Config_Json also had assistance from Sudheer Satyanarayana.
212
213URL Shortening:
214
215    Zend_Service_ShortUrl was added for this release. The component
216    provides a simple interface for use with most URL shortening
217    services, defining simply the methods "shorten" and "unshorten".
218    Adapters for the services http://is.gd, http://jdem.cz,
219    http://metamark.net, and http://tinyurl.com, are provided with this
220    release.
221
222    Zend_Service_ShortUrl was contributed by Martin Hujer.
223
224Additional View Helpers:
225
226    Several new view helpers are now exposed:
227
228    * Zend_View_Helper_UserAgent ties into the Zend_Http_UserAgent
229      component, detailed above. It gives you access to the UserAgent
230      instance, allowing you to query for the device and capabilities.
231    * Zend_View_Helper_TinySrc is an additional portion of Zend
232      Framework's mobile offering for version 1.11.0. The helper ties
233      into the TinySrc API, allowing you to a) provide device-specific
234      image sizes and formats for your site, and b) offload generation
235      of those images to this third-party service. The helper creates
236      img tags pointing to the service, and provides options for
237      specifying adaptive sizing and formats.
238    * Zend_View_Helper_Gravatar ties into the Gravatar API, allowing you
239      to provide avatar images for registered users that utilize the
240      Gravatar service. This helper was contributed by Marcin Morawski.
241
242A detailed list of all features and bug fixes in this release may be found at:
243
244http://framework.zend.com/changelog/
245
246SYSTEM REQUIREMENTS
247-------------------
248
249Zend Framework requires PHP 5.2.4 or later. Please see our reference
250guide for more detailed system requirements:
251
252http://framework.zend.com/manual/en/requirements.html
253
254INSTALLATION
255------------
256
257Please see INSTALL.txt.
258
259QUESTIONS AND FEEDBACK
260----------------------
261
262Online documentation can be found at http://framework.zend.com/manual.
263Questions that are not addressed in the manual should be directed to the
264appropriate mailing list:
265
266http://framework.zend.com/wiki/display/ZFDEV/Mailing+Lists
267
268If you find code in this release behaving in an unexpected manner or
269contrary to its documented behavior, please create an issue in the Zend
270Framework issue tracker at:
271
272http://framework.zend.com/issues
273
274If you would like to be notified of new releases, you can subscribe to
275the fw-announce mailing list by sending a blank message to
276fw-announce-subscribe@lists.zend.com.
277
278LICENSE
279-------
280
281The files in this archive are released under the Zend Framework license.
282You can find a copy of this license in LICENSE.txt.
283
284ACKNOWLEDGEMENTS
285----------------
286
287The Zend Framework team would like to thank all the contributors to the Zend
288Framework project, our corporate sponsor, and you, the Zend Framework user.
289Please visit us sometime soon at http://framework.zend.com.
Note: See TracBrowser for help on using the repository browser.