Merge branch 'PHP-5.5' into PHP-5.6

* PHP-5.5:
  Keep 308-399 HTTP response codes when header('Location:') is called.

NEWS

@@ -10,6 +10,8 @@ PHP                                                                        NEWS
   . Fixed bug #67390 (insecure temporary file use in the configure script).
     (Remi) (CVE-2014-3981)
   . Fixed bug #67392 (dtrace breaks argument unpack). (Nikita)
+  . Fixed bug #67428 (header('Location: foo') will override a 308-399 response
+    code). (Adam)
 
 - Fileinfo:
   . Fixed bug #67410 (fileinfo: mconvert incorrect handling of truncated pascal

ext/standard/tests/general_functions/header_redirection_001.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Location: headers change the status code
+--CGI--
+--FILE--
+<?php
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 302 Moved Temporarily
+Location: http://example.com/
+--EXPECT--

ext/standard/tests/general_functions/header_redirection_002.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Location: headers override non-201 and 3xx response codes
+--CGI--
+--FILE--
+<?php
+header("HTTP/1.1 418 I'm a Teapot");
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 302 Moved Temporarily
+Location: http://example.com/
+--EXPECT--

ext/standard/tests/general_functions/header_redirection_003.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Location: headers respect the header() response code parameter
+--CGI--
+--FILE--
+<?php
+header('Location: http://example.com/', true, 404);
+?>
+--EXPECTHEADERS--
+Status: 404 Not Found
+Location: http://example.com/
+--EXPECT--

ext/standard/tests/general_functions/header_redirection_004.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Location: headers respect the header() response code parameter
+--CGI--
+--FILE--
+<?php
+header('Location: http://example.com/', true, 404);
+?>
+--EXPECTHEADERS--
+Status: 404 Not Found
+Location: http://example.com/
+--EXPECT--

ext/standard/tests/general_functions/header_redirection_005.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 201 response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 201 Created');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 201 Created
+Location: http://example.com/
+--EXPECT--

ext/standard/tests/general_functions/header_redirection_006.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 300 Multiple Choices response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 300 Multiple Choices');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 300 Multiple Choices
+Location: http://example.com/
+--EXPECT--

ext/standard/tests/general_functions/header_redirection_007.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 301 Moved Permanently response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 301 Moved Permanently');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 301 Moved Permanently
+Location: http://example.com/
+--EXPECT--

ext/standard/tests/general_functions/header_redirection_008.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 302 Found response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 302 Found');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 302 Found
+Location: http://example.com/
+--EXPECT--

ext/standard/tests/general_functions/header_redirection_009.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 303 See Other response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 303 See Other');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 303 See Other
+Location: http://example.com/
+--EXPECT--

ext/standard/tests/general_functions/header_redirection_010.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 304 Not Modified response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 304 Not Modified');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 304 Not Modified
+Location: http://example.com/
+--EXPECT--

ext/standard/tests/general_functions/header_redirection_011.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 305 Use Proxy response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 305 Use Proxy');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 305 Use Proxy
+Location: http://example.com/
+--EXPECT--

ext/standard/tests/general_functions/header_redirection_012.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 307 Temporary Redirect response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 307 Temporary Redirect');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 307 Temporary Redirect
+Location: http://example.com/
+--EXPECT--

ext/standard/tests/general_functions/header_redirection_013.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 308 Permanent Redirect response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 308 Permanent Redirect');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 308 Permanent Redirect
+Location: http://example.com/
+--EXPECT--

ext/standard/tests/general_functions/header_redirection_014.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 399 Choose Your Own Adventure response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 399 Choose Your Own Adventure');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 399 Choose Your Own Adventure
+Location: http://example.com/
+--EXPECT--

main/SAPI.c

@@ -825,7 +825,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 					"0", sizeof("0") - 1, PHP_INI_USER, PHP_INI_STAGE_RUNTIME);
 			} else if (!STRCASECMP(header_line, "Location")) {
 				if ((SG(sapi_headers).http_response_code < 300 ||
-					SG(sapi_headers).http_response_code > 307) &&
+					SG(sapi_headers).http_response_code > 399) &&
 					SG(sapi_headers).http_response_code != 201) {
 					/* Return a Found Redirect if one is not already specified */
 					if (http_response_code) { /* user specified redirect code */