PEAR Blog » Group Blog http://blog.pear.php.net Official pear.php.net blog Tue, 24 Jan 2012 14:05:29 +0000 en hourly 1 http://wordpress.org/?v=3.1.2 PEAR channels on google code currently broken http://blog.pear.php.net/2010/03/23/google-code-channels-broken/ http://blog.pear.php.net/2010/03/23/google-code-channels-broken/#comments Tue, 23 Mar 2010 15:55:32 +0000 cweiske http://blog.pear.php.net/?p=71 Continue reading →]]> PEAR channels hosted on google code (like the unofficial Smarty channel, unofficial Zend Framework channel and the unofficial Mediawiki channel) are currently broken.

The reason for it has been discovered in the corresponding bug report: HTTP requests containing a port number in the “Host” header field are rejected, returning a 404.

The issue is currently being investigated by Google. If you cannot wait, apply a hack-fix to your PEAR installation. Alternatively, use Pyrus, the next-gen PEAR installer.

]]> http://blog.pear.php.net/2010/03/23/google-code-channels-broken/feed/ 1 Net_Traceroute and Net_Ping security advisory http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/ http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/#comments Sat, 14 Nov 2009 23:39:49 +0000 david http://blog.pear.php.net/?p=57 Continue reading →]]> PEAR Security Advisory (PSA 200911-14-01)

Severity: Serious
Title: PEAR Net_Ping and Net_Traceroute Remote Arbitrary Command Injection
Date: November 14, 2009
ID: 200911-14-01

Synopsis

Multiple remote arbitrary command injections have been found in the Net_Ping
and Net_Traceroute.

Background

Net_Ping is an OS independent wrapper class for executing ping calls from PHP

Net_Traceroute is an OS independent wrapper class for executing traceroute calls from PHP

Affected packages

———————————————————————————————
Package                   /  Vulnerable  /             Unaffected
———————————————————————————————
1  Net_Ping                   < 2.4.5                   >= 2.4.5
2  Net_Traceroute       < 0.21.2                  >= 0.21.2

———————————————————————————————
2 affected packages on all of their supported architectures.
———————————————————————————————

Description

Remote Arbitrary Command Injection

Impact

When input from forms are used directly, the attacker could pass variables that would allow him to execute remote arbitrary command injections.

Workaround

Filter your input to make sure the commands passed are shell escaped or upgrade to the latest version of both packages.

Resolution

The group recommends users of Net_Ping to upgrade to Net_Ping-2.4.5 if they haven’t already:

The group recommends users of Net_Traceroute to upgrade to Net_Traceroute-0.21.2 if they haven’t already:

Reported By

Thanks to Pasquale Imperato for finding, analyzing and reporting the issue.

Link

http://pear.php.net/advisory20091114-01.txt

]]> http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/feed/ 4 The elections are still going! http://blog.pear.php.net/2009/08/01/the-elections-are-still-going/ http://blog.pear.php.net/2009/08/01/the-elections-are-still-going/#comments Sat, 01 Aug 2009 12:42:37 +0000 david http://blog.pear.php.net/?p=35 Continue reading →]]> As every year, the elections for the PEAR Group and PEAR President are happening. This year due to a few factors and messages lost in translation, we decided to extend the elections period by 10 days so more people would have time to vote!

So remember to cast your vote at http://pear.php.net/election/ and you have until the the 5th of August 2009.

There are many new candidates for the Group and I think you should go and check them out!

]]> http://blog.pear.php.net/2009/08/01/the-elections-are-still-going/feed/ 2 PEAR Group Meeting Minutes 2008-07-13 http://blog.pear.php.net/2008/07/17/pear-group-meeting-minutes-2008-07-13/ http://blog.pear.php.net/2008/07/17/pear-group-meeting-minutes-2008-07-13/#comments Thu, 17 Jul 2008 15:44:22 +0000 bbieber http://blog.pear.bluga.net/?p=21 Continue reading →]]> The minutes from the July 13th, 2008 PEAR Group meeting have been posted to the PEAR wiki.

Some highlights from the meeting include new/upcoming RFCs for package naming schemes, exception handling in PHP 5.3, and a vote on extending the current PEAR2 Policies. Heavy stuff, check it out!

http://wiki.pear.php.net/index.php/MeetingMinutes20080713

-Brett

]]> http://blog.pear.php.net/2008/07/17/pear-group-meeting-minutes-2008-07-13/feed/ 0 Election 2008 Results http://blog.pear.php.net/2008/06/22/election-2008-results/ http://blog.pear.php.net/2008/06/22/election-2008-results/#comments Sun, 22 Jun 2008 17:24:15 +0000 jeichorn http://blog.pear.php.net/?p=20 Continue reading →]]> 2008 Elections are now over, you can view the offical results on the PEAR website.

The new PEAR group is:

elections are now over and a new PEAR Group has been formed. Just like last year and always following the Constitution, the new members have been elected by a secret ballot of PEAR Developers. They have chosen:

  • Joshua Eichorn
  • Helgi Þormar Þorbjornsson
  • Joe Stump
  • Christian Weiske
  • Chuck Burgess
  • Travis Swicegood
  • Brett Bieber

The new PEAR President is: David Coallier

The kickoff meeting for the new group is being held today.

]]> http://blog.pear.php.net/2008/06/22/election-2008-results/feed/ 0 First PEAR bug triage over! http://blog.pear.php.net/2008/03/28/first-pear-bug-triage-over/ http://blog.pear.php.net/2008/03/28/first-pear-bug-triage-over/#comments Fri, 28 Mar 2008 18:59:24 +0000 cweiske http://blog.pear.php.net/2008/03/28/first-pear-bug-triage-over/ Continue reading →]]> PEAR’s bug tracker hit the 600+ open bugs mark a month ago. Compared to the 400+ packages PEAR hosts, this is just 1.2 bug per package – but enough to be annoying for caring developers, especially when PEARgirl in IRC tells us every hour that the bug count increased again.

One and a half year ago, we faced an equal problem – only that the mark was 500 bugs at that time. Within half a year, we had this decreased to 400. Methods to accomplish this were mainly digging through the bug tracker, identifying bugs that could be fixed easily and nagging the package developers to do something (“Hey, bugs #23 and #42 are really easy to fix! Do that now and release a new version!”).

So with 600+ open bugs (not including the feature requests), we had to do something. Other open source projects regularly or irregularly organize bug triage days or weekends with the goal to fix as many bugs as possible with the combined brain forces of all attending developers. The logical step was to hold our own bug smashing event and see how it works for PEAR.

Date of action was the weekend 22nd to 23rd March 2008, which was the easter weekend. The event has not been announced publicly except on our pear-dev mailing list since it was a test run only. The attendees met in #pear-bugs on EFnet.

Participants included Amir, Cipri, Chuck, Daniel Connor, David, Helgi, Jan Schneider, Johnathan Street and Walter Hop. A number of packages, mostly orphaned ones, got tackled. Among them were Services_Google, SOAPmebeli, Net_Whois and Mail_Mime. Net_URLhotel furnishing in Bulgaria*, MDB2 and pearweb also got some love. Net_IDNA got new helper and went down to 0 bugs.

On day 2, Date got a new release. XML_sql2xml, DB_ldap, DB_ldap2 and Tree got also bugs fixed. A number of bugs got attention and in return got set to feedback needed, duplicate or bogus.

Thanks to the triage, we are close to reaching two important milestones: Closing bug reports with lower bug ID than 1000 (1 bug left!) and 2000 (5 left).

In the end, the bug count got down to 547 – but this was the first PEAR bug triage, and only a small number of devs attended.

We’re hoping for more active people on the next triage so for those interested we’re holding it bi weekly on weekends, both on Saturday and Sunday, that way people can pick the most fitting days for them and the next triage weekend is never far away :-)

We’re also holding out a Google Calendar for those events so that people can subscribe and be reminded about the the upcoming dates.

Calendar links:
HTML and iCal.

]]> http://blog.pear.php.net/2008/03/28/first-pear-bug-triage-over/feed/ 3 PEAR2 standards, we would like to know what you think http://blog.pear.php.net/2007/07/08/pear2-standards-we-would-like-to-know-what-you-think/ http://blog.pear.php.net/2007/07/08/pear2-standards-we-would-like-to-know-what-you-think/#comments Mon, 09 Jul 2007 06:20:11 +0000 arnaud http://blog.pear.php.net/2007/07/08/pear2-standards-we-would-like-to-know-what-you-think/ Continue reading →]]> Please read the following document and post your comments on the wiki using the discussion page. Comments are opened for a period of two weeks.

It is very important that you comment as these standards will define PEAR2.

RFC at:
http://wiki.pear.php.net/index.php/PEAR2_Standards

Thank you

]]> http://blog.pear.php.net/2007/07/08/pear2-standards-we-would-like-to-know-what-you-think/feed/ 9 Request for ideas: New developer FAQ http://blog.pear.php.net/2007/06/28/request-for-ideas-new-developer-faq/ http://blog.pear.php.net/2007/06/28/request-for-ideas-new-developer-faq/#comments Thu, 28 Jun 2007 11:35:01 +0000 cweiske http://blog.pear.php.net/2007/06/28/request-for-ideas-new-developer-faq/ Continue reading →]]> New developers need quite a time to familiarize themselves with the rules and conventions in PEAR. With the new role of mentors in PEAR2, they will have a contact person they can ask in that cases.
But in many cases the same questions will get asked which will get boring for the mentoring developer, so we need a Mini-FAQ with a list of things the newbie should know.

Which information should go onto that list in your eyes? Comments appreciated!

- cweiske

]]> http://blog.pear.php.net/2007/06/28/request-for-ideas-new-developer-faq/feed/ 4 SVN and PEAR http://blog.pear.php.net/2007/06/18/svn-and-pear/ http://blog.pear.php.net/2007/06/18/svn-and-pear/#comments Mon, 18 Jun 2007 22:36:27 +0000 jeichorn http://blog.pear.php.net/2007/06/18/svn-and-pear/ Continue reading →]]> A common request for PEAR is too use SVN instead of CVS for source code management. As part of the PEAR2 project we are making that happen.

I’m happy to announce that we now have an SVN repo ready for testing. Web access at http://svn.pear.php.net with the SVN url being http://svn.pear.php.net/repo

Were still working out all the naming conventions (and the rules for getting code into PEAR2). But SVN access should be widely available soon. Feel free to leave comments and suggestions.

Update: the svn url is now http://svn.pear.php.net/PEAR2

-josh

]]> http://blog.pear.php.net/2007/06/18/svn-and-pear/feed/ 11 The PEAR Group is now complete. http://blog.pear.php.net/2007/05/30/the-pear-group-is-now-complete/ http://blog.pear.php.net/2007/05/30/the-pear-group-is-now-complete/#comments Thu, 31 May 2007 04:09:35 +0000 david http://blog.pear.php.net/2007/05/30/the-pear-group-is-now-complete/ Continue reading →]]> Finally after having a tie in the initial PEAR Group Election, we have ran a runoff election between the two tied parties Justin Patrin and Paul M. Jones.

After the regular time for an election, the choice has been made by the community on the seventh member of the PEAR Group.

% Name #
52.27% Paul M. Jones 23
45.45% Justin Patrin 20
2.27% Abstained 1

I would like to personally congratulate both participants and hope that we will continue and keep on doing constructive work within PEAR even though we cannot keep both of you in.

Furthermore, special congratulations to Paul M. Jones who has been elected as the 7th member. Looking forward for solid and hard work :-)

Thanks to all the voters for taking the time to vote.

-D

]]> http://blog.pear.php.net/2007/05/30/the-pear-group-is-now-complete/feed/ 0