Commit 16ebafff9af for php
commit 16ebafff9afada536d09ea3a11d35b4b9ea86827
Author: Sjoerd Langkemper <sjoerd-github@linuxonly.nl>
Date: Thu Nov 12 08:11:11 2026 +0100
ext/curl: handle CURLOPT_POSTREDIR as normal long (#23357)
Don't treat CURLOPT_POSTREDIR specially. Just pass its value to curl directly. There is no need to do `& CURL_REDIR_POST_ALL`. Curl already does this internally. The only functional change is that negative numbers will now raise an error, which seems reasonable.
diff --git a/UPGRADING b/UPGRADING
index a4df2335263..875e0555456 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -28,6 +28,9 @@ PHP 8.7 UPGRADE NOTES
converted to an int.
. Nested arrays in CURLOPT_POSTFIELDS now throw a TypeError, instead of being
silently converted to the string "Array".
+ . Negative values for CURLOPT_POSTREDIR are now rejected, making
+ curl_setopt() return false, instead of being silently interpreted as a
+ combination of redirect types.
- PDO:
. PDOStatement::bindColumn() now throws a ValueError when the column name is
diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index 44724428beb..94618e4bf74 100644
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -1892,6 +1892,7 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue
case CURLOPT_TCP_KEEPCNT:
#endif
case CURLOPT_FOLLOWLOCATION:
+ case CURLOPT_POSTREDIR:
lval = zval_get_long(zvalue);
if ((option == CURLOPT_PROTOCOLS || option == CURLOPT_REDIR_PROTOCOLS) &&
(PG(open_basedir) && *PG(open_basedir)) && (lval & CURLPROTO_FILE)) {
@@ -2259,11 +2260,6 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue
error = curl_easy_setopt(ch->cp, option, (curl_off_t)lval);
break;
- case CURLOPT_POSTREDIR:
- lval = zval_get_long(zvalue);
- error = curl_easy_setopt(ch->cp, CURLOPT_POSTREDIR, (long) (lval & CURL_REDIR_POST_ALL));
- break;
-
/* the following options deal with files, therefore the open_basedir check
* is required.
*/