Merge 3.3/release/3.3.3 into 3.3/master

Author: enov

.gitignore

@@ -1,2 +1,5 @@
 *~
 *.swp
+/composer.lock
+/vendor/*
+/koharness_bootstrap.php

.travis.yml

@@ -0,0 +1,18 @@
+language: php
+
+php:
+  - 5.3
+  - 5.4
+  - 5.5
+  - 5.6
+  - hhvm
+
+before_script:
+  - COMPOSER_ROOT_VERSION=3.3.x-dev composer install --prefer-dist
+  - vendor/bin/koharness
+
+script:
+  - cd /tmp/koharness && ./vendor/bin/phpunit --bootstrap=modules/unittest/bootstrap.php modules/unittest/tests.php
+
+notifications:
+  email: false

README.md

@@ -0,0 +1,33 @@
+# Kohana PHP Framework - core
+
+| ver   | Stable                                                                                                                       | Develop                                                                                                                        |
+|-------|------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|
+| 3.3.x | [![Build Status - 3.3/master](https://travis-ci.org/kohana/core.svg?branch=3.3%2Fmaster)](https://travis-ci.org/kohana/core) | [![Build Status - 3.3/develop](https://travis-ci.org/kohana/core.svg?branch=3.3%2Fdevelop)](https://travis-ci.org/kohana/core) |
+| 3.4.x | [![Build Status - 3.4/master](https://travis-ci.org/kohana/core.svg?branch=3.4%2Fmaster)](https://travis-ci.org/kohana/core) | [![Build Status - 3.4/develop](https://travis-ci.org/kohana/core.svg?branch=3.4%2Fdevelop)](https://travis-ci.org/kohana/core) |
+
+This is the core package for the [Kohana](http://kohanaframework.org/) object oriented HMVC framework built using PHP5.
+It aims to be swift, secure, and small.
+
+Released under a [BSD license](http://kohanaframework.org/license), Kohana can be used legally for any open source,
+commercial, or personal project.
+
+## Documentation and installation
+
+See the [sample application repository](https://github.com/kohana/kohana) for full readme and contributing information.
+You will usually add `kohana/core` as a dependency in your own project's composer.json to install and work with this
+pacakge.
+
+## Installation for development
+
+To work on this package, you'll want to install it with composer to get the required dependencies. Note that there are
+currently circular dependencies between this module and kohana/unittest. These may cause you problems if you are working
+on a feature branch, because composer may not be able to figure out which version of kohana core you have.
+
+To work around this, run composer like: `COMPOSER_ROOT_VERSION=3.3.x-dev composer install`. This tells composer that the
+current checkout is a 3.3.* development version. Obviously change the argument if your branch is based on a different
+version.
+
+After installing the dependencies, you'll need a skeleton Kohana application before you can run the unit tests etc. The
+simplest way to do this is to use kohana/koharness to build a bare project in `/tmp/koharness`.
+
+If in doubt, check the install and test steps in the [.travis.yml](.travis.yml) file.

classes/Kohana/Arr.php

@@ -279,7 +279,13 @@ public static function range($step = 10, $max = 100)
 	 */
 	public static function get($array, $key, $default = NULL)
 	{
-		return isset($array[$key]) ? $array[$key] : $default;
+		if ($array instanceof ArrayObject) {
+			// This is a workaround for inconsistent implementation of isset between PHP and HHVM
+			// See https://github.com/facebook/hhvm/issues/3437
+			return $array->offsetExists($key) ? $array->offsetGet($key) : $default;
+		} else {
+			return isset($array[$key]) ? $array[$key] : $default;
+		}
 	}
 
 	/**

classes/Kohana/Config/Group.php

@@ -11,8 +11,8 @@
  * @package    Kohana
  * @category   Configuration
  * @author     Kohana Team
- * @copyright  (c) 2012 Kohana Team
- * @license    http://kohanaphp.com/license
+ * @copyright  (c) 2012-2014 Kohana Team
+ * @license    http://kohanaframework.org/license
  */
 class Kohana_Config_Group extends ArrayObject {
 

classes/Kohana/Config/Source.php

@@ -7,8 +7,8 @@
  * @package    Kohana
  * @category   Configuration
  * @author     Kohana Team
- * @copyright  (c) 2012 Kohana Team
- * @license    http://kohanaphp.com/license
+ * @copyright  (c) 2012-2014 Kohana Team
+ * @license    http://kohanaframework.org/license
  */
 
 interface Kohana_Config_Source {}

classes/Kohana/Config/Writer.php

@@ -7,8 +7,8 @@
  *
  * @package Kohana
  * @author  Kohana Team
- * @copyright  (c) 2008-2012 Kohana Team
- * @license    http://kohanaphp.com/license
+ * @copyright  (c) 2008-2014 Kohana Team
+ * @license    http://kohanaframework.org/license
  */
 interface Kohana_Config_Writer extends Kohana_Config_Source
 {

classes/Kohana/Cookie.php

@@ -71,14 +71,14 @@ public static function get($key, $default = NULL)
 			// Separate the salt and the value
 			list ($hash, $value) = explode('~', $cookie, 2);
 
-			if (Cookie::salt($key, $value) === $hash)
+			if (Security::slow_equals(Cookie::salt($key, $value), $hash))
 			{
 				// Cookie signature is valid
 				return $value;
 			}
 
 			// The cookie signature is invalid, delete it
-			Cookie::delete($key);
+			static::delete($key);
 		}
 
 		return $default;
@@ -88,33 +88,38 @@ public static function get($key, $default = NULL)
 	 * Sets a signed cookie. Note that all cookie values must be strings and no
 	 * automatic serialization will be performed!
 	 *
+	 * [!!] By default, Cookie::$expiration is 0 - if you skip/pass NULL for the optional
+	 *      lifetime argument your cookies will expire immediately unless you have separately
+	 *      configured Cookie::$expiration.
+	 *
+	 *
 	 *     // Set the "theme" cookie
 	 *     Cookie::set('theme', 'red');
 	 *
 	 * @param   string  $name       name of cookie
 	 * @param   string  $value      value of cookie
-	 * @param   integer $expiration lifetime in seconds
+	 * @param   integer $lifetime   lifetime in seconds
 	 * @return  boolean
 	 * @uses    Cookie::salt
 	 */
-	public static function set($name, $value, $expiration = NULL)
+	public static function set($name, $value, $lifetime = NULL)
 	{
-		if ($expiration === NULL)
+		if ($lifetime === NULL)
 		{
 			// Use the default expiration
-			$expiration = Cookie::$expiration;
+			$lifetime = Cookie::$expiration;
 		}
 
-		if ($expiration !== 0)
+		if ($lifetime !== 0)
 		{
 			// The expiration is expected to be a UNIX timestamp
-			$expiration += time();
+			$lifetime += static::_time();
 		}
 
 		// Add the salt to the cookie value
 		$value = Cookie::salt($name, $value).'~'.$value;
 
-		return setcookie($name, $value, $expiration, Cookie::$path, Cookie::$domain, Cookie::$secure, Cookie::$httponly);
+		return static::_setcookie($name, $value, $lifetime, Cookie::$path, Cookie::$domain, Cookie::$secure, Cookie::$httponly);
 	}
 
 	/**
@@ -131,16 +136,18 @@ public static function delete($name)
 		unset($_COOKIE[$name]);
 
 		// Nullify the cookie and make it expire
-		return setcookie($name, NULL, -86400, Cookie::$path, Cookie::$domain, Cookie::$secure, Cookie::$httponly);
+		return static::_setcookie($name, NULL, -86400, Cookie::$path, Cookie::$domain, Cookie::$secure, Cookie::$httponly);
 	}
 
 	/**
 	 * Generates a salt string for a cookie based on the name and value.
 	 *
 	 *     $salt = Cookie::salt('theme', 'red');
 	 *
-	 * @param   string  $name   name of cookie
-	 * @param   string  $value  value of cookie
+	 * @param   string $name name of cookie
+	 * @param   string $value value of cookie
+	 *
+	 * @throws Kohana_Exception if Cookie::$salt is not configured
 	 * @return  string
 	 */
 	public static function salt($name, $value)
@@ -154,7 +161,38 @@ public static function salt($name, $value)
 		// Determine the user agent
 		$agent = isset($_SERVER['HTTP_USER_AGENT']) ? strtolower($_SERVER['HTTP_USER_AGENT']) : 'unknown';
 
-		return sha1($agent.$name.$value.Cookie::$salt);
+		return hash_hmac('sha1', $agent.$name.$value.Cookie::$salt, Cookie::$salt);
+	}
+
+	/**
+	 * Proxy for the native setcookie function - to allow mocking in unit tests so that they do not fail when headers
+	 * have been sent.
+	 *
+	 * @param string  $name
+	 * @param string  $value
+	 * @param integer $expire
+	 * @param string  $path
+	 * @param string  $domain
+	 * @param boolean $secure
+	 * @param boolean $httponly
+	 *
+	 * @return bool
+	 * @see setcookie
+	 */
+	protected static function _setcookie($name, $value, $expire, $path, $domain, $secure, $httponly)
+	{
+		return setcookie($name, $value, $expire, $path, $domain, $secure, $httponly);
+	}
+
+	/**
+	 * Proxy for the native time function - to allow mocking of time-related logic in unit tests
+	 *
+	 * @return int
+	 * @see    time
+	 */
+	protected static function _time()
+	{
+		return time();
 	}
 
 }

classes/Kohana/Core.php

@@ -16,8 +16,8 @@
 class Kohana_Core {
 
 	// Release version and codename
-	const VERSION  = '3.3.2';
-	const CODENAME = 'dryocopus';
+	const VERSION  = '3.3.3';
+	const CODENAME = 'uluru';
 
 	// Common environment type constants for consistency and convenience
 	const PRODUCTION  = 10;
@@ -322,7 +322,7 @@ public static function init(array $settings = NULL)
 		}
 
 		// Determine if the extremely evil magic quotes are enabled
-		Kohana::$magic_quotes = (version_compare(PHP_VERSION, '5.4') < 0 AND get_magic_quotes_gpc());
+		Kohana::$magic_quotes = get_magic_quotes_gpc();
 
 		// Sanitize all request variables
 		$_GET    = Kohana::sanitize($_GET);

classes/Kohana/Date.php

@@ -592,10 +592,10 @@ public static function formatted_time($datetime_str = 'now', $timestamp_format =
 		$tz   = new DateTimeZone($timezone ? $timezone : date_default_timezone_get());
 		$time = new DateTime($datetime_str, $tz);
 
-		if ($time->getTimeZone()->getName() !== $tz->getName())
-		{
-			$time->setTimeZone($tz);
-		}
+		// Convert the time back to the expected timezone if required (in case the datetime_str provided a timezone,
+		// offset or unix timestamp. This also ensures that the timezone reported by the object is correct on HHVM
+		// (see https://github.com/facebook/hhvm/issues/2302).
+		$time->setTimeZone($tz);
 
 		return $time->format($timestamp_format);
 	}