5.02 2026-11-03 [ RELEASE NOTES ] - this is a security release fixing a large number of vulnerabilities, several of them exploitable by any client against any script. all users should upgrade - to fix them some default behaviour has changed, see BREAKING CHANGES below - most changes only affect malicious or malformed requests, but please read them before upgrading. where a change could reasonably affect a legitimate application an opt out or migration path is given - the minimum *supported* perl version is now 5.10, however the dist will still install for 5.8 (no guarantees about tests passing however) [ SECURITY ] - denial of service: - CVE-2026-120631: CGI::Cookie->parse (and so CGI->cookie) used a client supplied cookie expires value as a regex, so a Cookie header could make it die or backtrack catastrophically - CVE-2026-120632: a crafted multipart/related Content-Type header caused cubic regex backtracking (~15s of CPU for an 8KB header, no body needed) - CVE-2026-120650: request size, param and upload limits were missing or unenforced: $POST_MAX defaulted to no limit, and was not enforced at all for multipart bodies without a CONTENT_LENGTH (chunked encoding), or for the boundary line of a multipart body without a boundary=; PUTDATA/POSTDATA/PATCHDATA bodies were read into memory in one go; and there was no limit on the number of params or uploads in a request (a 40MB form body took 9s and 1.5GB of memory to parse) - see the new $CGI::MAX_PARAMS and $CGI::MAX_UPLOADS - CVE-2026-120651: an infinite loop reading a short PUT/POST/PATCH body when $DISABLE_UPLOADS was set - CVE-2026-120645: scrolling_list used submitted values as a regex for optgroups - CVE-2026-120646: uploadInfo() dereferenced plain strings as symbolic references, so died when given some, e.g. "0" - header injection / response splitting: - CVE-2026-120639: with autoEscape off, header() decoded HTML entities in extra header values after checking them for newlines, so became CRLF; and multipart_start() and CGI::Push::do_push did no newline checks - CVE-2026-120644: CGI::Cookie path/domain/expires were not checked, so ";" injected other cookie attributes - CVE-2026-120647: the header() -attachment filename did not escape quotes - open redirects, and URLs/forms pointing at other hosts: - CVE-2026-120633: url(), self_url(), virtual_host(), virtual_port() trusted the client supplied X-Forwarded-Host header, and an unvalidated Host, affecting the default redirect() location, start_html(-base=>1) and default start_form() actions - CVE-2026-120638: redirect() HTML decoded its URL after the application had checked it, e.g. "//evil.example/" became "//evil.example/" - CVE-2026-120636: URLs built from the client supplied REQUEST_URI could be protocol relative (//evil.example), absolute-form (http://evil.example/) or have backslashes, and url(-relative=>1) could return e.g. javascript:alert(1) - cross site scripting: - CVE-2026-120643: url()/self_url() could contain a raw single quote (URI->canonical decodes %27) - CVE-2026-120648: comment() text could end the HTML comment - information disclosure: - CVE-2026-120634: CGI::Carp warnings buffered for warningsToBrowser were not reset between requests in persistent environments, so one user's warnings could be shown to another - CVE-2026-120635: multipart parsing differentials (fields smuggled past a filtering proxy or WAF that parses per the RFCs): - the boundary was matched anywhere, not only at the start of a line - the boundary was used without its "--" for some User-Agents - Content-Disposition name/filename were found inside other parameters' quoted values - boundaries over the RFC 2046 limit corrupted and merged parts - other: - CVE-2026-120641: client supplied upload filenames could contain a path, allowing path traversal in applications that use them to save the file - CVE-2026-120640: clients could set POSTDATA/PUTDATA/PATCHDATA/ XForms:Model through the query string or a form field, indistinguishable from the real body (e.g. a cross site HTML form posting to a JSON endpoint) - CVE-2026-120642: under taint mode the upload filename, uploadInfo() values, path_info, Accept(), and some cookie and url_param values were untainted - CVE-2026-120637: an unrecognised REQUEST_METHOD (e.g. OPTIONS) made the process' own command line arguments the request params [ BREAKING CHANGES ] - X-Forwarded-Host is no longer used by url()/self_url()/virtual_host() /virtual_port(), and Host is only used if it is a valid host[:port]. behind a reverse proxy pass the right Host / SERVER_NAME, or set $CGI::TRUST_X_FORWARDED_HOST = 1 - $CGI::POST_MAX now defaults to 128MB, set it to -1 for no limit - $CGI::MAX_PARAMS (10,000) and $CGI::MAX_UPLOADS (1,000) are new limits, set them to -1 for no limit. requests exceeding any of the limits get a "413 Request entity too large" cgi_error - upload filenames (param('upload'), the upload filehandle, and the upload_hook) have any directory part and control characters removed. the raw value is in uploadInfo($fh)->{'Content-Disposition'}, or set $CGI::SANITIZE_UPLOAD_FILENAMES = 0 - redirect() URLs and header() values are no longer HTML unescaped - pass e.g. /x?a=1&b=2, not /x?a=1&b=2 - multipart_start() header names are now capitalised like header()'s - url(-relative=>1) prefixes a result that looks like it has a scheme with ./, and URLs built from REQUEST_URI are reduced to a path on this host (request_uri() still returns the literal value) - url()/self_url() percent encode single quotes - CGI::Cookie dies if path, expires or domain contain ";" or control characters, or domain isn't a valid host name - header() -attachment backslash escapes " and \ in the filename - comment() inserts a space into any "--" in its text - client sent params named POSTDATA, PUTDATA, PATCHDATA or XForms:Model are ignored (an application's own initializer can still set them) - under taint mode more request data is tainted, as listed above, so must be untainted before use in e.g. open() or system() - malformed multipart bodies are rejected: boundaries over 200 characters, a body supplied boundary not starting with --, or a boundary line over 1KB. multipart/related requires the media type to be exactly multipart/related (its parameters may now be in any order) - offline (command line) debugging mode is only used when there is no REQUEST_METHOD and no CGI server, FastCGI or mod_perl - PUTDATA/POSTDATA/PATCHDATA upload_hook callbacks are now called per 4K chunk, as they already were for multipart uploads - the IE 3.01 for Mac / DreamPassport multipart special case is removed [ FIX ] - chunked (no CONTENT_LENGTH) multipart requests without a boundary= always failed, and the boundary line read now works under mod_perl - read_postdata_putdata ignored SPIN_LOOP_MAX, dying on the first zero length read - a second CGI->new in the same request lost cgi_error, and shared the first object's param arrays - optgroup() ignored the documented -novals option - import_names() wiped nested packages when clearing the namespace - an upload whose filename was "0" lost its name - an empty extra header() value came out as a lone " [ META ] - all modules are now version 5.00, including CGI::Cookie (was 4.59) [ TESTING ] - tests for all of the above 4.72 2026-05-05 [ INTERNALS ] - fix regression due to edge case bug introduced in 4.71 (GH #278, thanks to dddonovan) 4.71 2025-09-16 [ INTERNALS ] - the .tmpfiles hash now keys on the $fh->filename . $fh rather than $$fh . $fh - this ensures duplicate filename uploads still resolve to unique files on disk - fixes GH #276 4.70 2025-06-11 [ META ] - remove github/coveralls/travis badges, no meaningful any more - add github actions for CI (GH #273, thanks to esabol) 4.69 2025-06-11 [ REVERT ] - changes in 4.68 - this breaks backwards compatibility clearly not sufficiently covered by tests (see GH #271) 4.68 2025-04-01 [ FIX ] - handle passing of hash keys as args with a mix of dashed and non dashed (GH #270, thanks to kocoureasy for the patch) 4.67 2025-01-08 [ FIX ] - correctly parse unquoted expires cookie values containing embedded commas (GH #268, thanks to rlauer6 for the patch) 4.66 2024-06-04 [ FIX ] - Restore trailing slashes in the ->url call (GH #267) 4.65 2024-06-04 [ TESTING ] - "fix" t/url.t for older Perls (GH #266) 4.64 2024-03-18 [ META ] - pass --no-xattrs to tar in Makefile to fix tar backwards compat (GH #264, thanks to ryandesign) 4.63 2024-03-01 [ FIX ] - ->url returns a string in all cases (GH #263, thanks to Sketch6307) 4.62 2024-03-01 [ FIX ] - ->url now returns the correct thing for ipv6 brackets (GH #259, thanks to eserte) 4.61 2024-01-08 [ ENHANCEMENT ] - Support Paritioned cookies in CGI::Cookie (GH #262, thanks to dakkar) 4.60 2023-11-01 [ TESTING ] - move t/changes.t to xt/ as is now broken by the recent rewrite of Test::CPAN::Changes (GH #260) 4.59 2023-10-02 [ FIX ] - Bring VERSION values inline 4.58 2023-10-02 [ FIX ] - Update cookie expires date format (GH #258 , thanks to robbiebow) 4.57 2023-05-01 [ DOCUMENTATION ] - Documentation tweaks around uploadInfo() and hooks (GH #256, thanks to rlauer6) 4.56 2023-03-01 [ TESTING ] - add new cookie field 'Priority' to CGI::Cookie code (GH #253, thanks to Pavel) 4.55 2023-01-03 [ TESTING ] - remove dependency on Test::Deep (GH #254) 4.54 2022-02-03 [ FIX ] - fix use of cache when calling ->cookie (GH #252) - thanks to Sergey Panteleev for the PR 4.53 2021-06-03 [ FIX ] - fix typo in passing of max-age to CGI::Cookie (GH #247) 4.52 2021-05-04 [ FIX ] - sort hash keys for deterministic behaviour (GH #245, GH #246) 4.51 2020-10-01 [ DOCUMENTATION ] - Document support for SameSite=None cookies in CGI::Cookie (GH #244) 4.50 2020-06-22 [ ENHANCEMENT ] - Add APPEND_QUERY_STRING option (GH #243, thanks to stevenh) 4.49 2020-06-08 [ FIX ] - remove deprecation warning as no longer in core (GH #221) 4.48 2020-06-02 [ FIX ] - fix CGI::Cookie->bake() doesn't work with mod_perl redirects (GH #240) - thanks to sherrardb for the PR (GH #241) 4.47 2020-05-01 [ FIX / TESTING ] - fix typo in variable name (GH #239) 4.46 2020-02-03 [ DOCUMENTATION ] - Document support for SameSite=None cookies (GH #238) 4.45 2019-06-03 [ ENHANCEMENT ] - Add support for SameSite=None cookies (GH #237, thanks to Dur09) 4.44 2019-06-03 [ ENHANCEMENT ] - Replace only use of "base" with "parent" (GH #235) 4.43 2019-05-01 [ FIX / TESTING ] - support unquoted multipart/form-data name values (GH #234) 4.42 2019-03-26 [ DOCUMENTATION ] - clarify licence also in Makefile.PL (GH #232) 4.41 2019-03-26 [ DOCUMENTATION ] - clarify licence (GH #232) 4.40 2018-08-15 [ FIX / TESTING ] - support perls < 5.10.1 in Makefile.PL by being more dynamic (GH #229, GH #230, thanks to Aristotle) 4.39 2018-08-13 [ FIX / TESTING ] - specify CONFIGURE_REQUIRES in Makefile.PL so can use TEST_REQUIRES to build with older perls (GH #228) 4.38 2017-12-01 [ TESTING ] - command_line.t: Avoid -I for libs (GH #224, thanks to cpansprout) 4.37 2017-11-01 [ FIX ] - Fix incorrect quoting of ? in ->url (GH #112, GH #222, with thanks to Reuben Thomas) 4.36 2017-03-29 [ ENHANCEMENT ] - Support PATCH HTTP method (thanks to GovtGeek for the... patch) - pass through max_age and samesite to CGI::Cookie->new in the call in CGI->cookie (GH #220) [ FIX ] - skip t/command_line.t on windows as it doesn't work 4.35 2016-10-13 [ FIX ] - revert changes from 4.34 as they broke stuff 4.34 2016-10-13 [ ENHANCEMENT ] - If running from the command line, url_param now picks up parameters given on then command line or on stdin (GH #210) [ DOCUMENTATION ] - documentation for above addition 4.33 2016-09-16 [ DOCUMENTATION ] - clarify that ->param will return the first value if there are multiple values (when not called in list context) 4.32 2016-07-19 [ DOCUMENTATION ] - make perldoc CGI object consistent (GH #205) - clarify reason for absolute URLs (GH #206) [ INTERNALS ] - tweak dependency defs in Makefile.PL (GH #207, GH #208) - (thanks to karenetheridge and kentfredric) 4.31 2016-06-14 [ FEATURES ] - Add SameSite support to Cookie handling (thanks to pangyre) [ INTERNALS ] - The MultipartBuffer package has been renamed to CGI::MultipartBuffer. This has been done in a way to ensure any $MultipartBuffer package variables are still set correctly in CGI::MultipartBuffer. if you are explicitly using MultipartBuffer in a form such as: MultipartBuffer->new your code will break. you should be calling: CGI->new->new_MultipartBuffer( $boundary,$length ); to ensure the correctly package is called. if you are extending the MultipartBuffer package though use of ISA or base (or parent) then you will need to update your code to use CGI::MultipartBuffer - fake using strict and warnings to appease CPANTS Kwalitee - require File::Temp v0.17+ to get seekable file handles (GH #204) 4.28 2016-03-14 [ RELEASE NOTES ] - please see v4.21 Changes for any potentially impacting changes [ SPEC / BUG FIXES ] - undef %QUERY_PARAM in initialize_globals to clean mod_perl env [ TESTING ] - improve test coverage on request types (GH #199, GH #200) - improve test coverage on CGI::Carp 4.27 2016-03-02 [ RELEASE NOTES ] - please see v4.21 Changes for any potentially impacting changes [ INTERNALS ] - fix a couple of warnings in test harness - add taint flag to example file_upload - fix a warnings in STORE subroutine 4.26 2016-02-04 [ RELEASE NOTES ] - please see v4.21 Changes for any potentially impacting changes [ SPEC / BUG FIXES ] - sort HTML attributes by default (GH #106, GH #196) [ DOCUMENTATION ] - clarifications about HTML function non removal 4.25 2015-12-17 [ RELEASE NOTES ] - please see v4.21 Changes for any potentially impacting changes [ DOCUMENTATION ] - fix link to CONTRIBUTING file (thanks to Manwar for the fix) - clarify that "soft" deprecation means that the HTML functions are deprecated but will not raise any deprecation warnings [ SPEC / BUG FIXES ] - make the list context warning only happen once per process (or thread) to prevent excessive log noise in long running or in persistent processes (thanks to @dadamail for the suggestion) 4.23 2015-12-17 [ RELEASE NOTES ] - Documentation fixes only - please see v4.21 Changes for any potentially impacting changes [ DOCUMENTATION ] - add LICENSE file and LICENSE info to Makefile.PL 4.22 2015-10-16 [ RELEASE NOTES ] - Documentation fixes only - please see v4.21 Changes for any potentially impacting changes [ DOCUMENTATION ] - fix typos in CONTRIBUTING file - links to docs, stackoverflow and perlmonks - clarify deprecation policy on HTML functions (GH #188) - mention HTML::Tiny in CGI::HTML::Functions (thanks to osfameron for the suggestion) 4.21 2015-06-16 [ RELEASE NOTES ] - CGI.pm is now considered "done". See also "mature" and "legacy" Features requests and non-critical issues will be outright rejected. The module is now in maintenance mode for critical issues only. - This release removes the AUTOLOAD and compile optimisations from CGI.pm that were introduced into CGI.pm twenty (20) years ago as a response to its large size, which meant there was a significant compile time penalty. - This optimisation is no longer relevant and makes the code difficult to deal with as well as making test coverage metrics incorrect. Benchmarks show that advantages of AUTOLOAD / lazy loading / deferred compile are less than 0.05s, which will be dwarfed by just about any meaningful code in a cgi script. If this is an issue for you then you should look at running CGI.pm in a persistent environment (FCGI, etc) - To offset some of the time added by removing the AUTOLOAD functionality the dependencies have been made runtime rather than compile time. The POD has also been split into its own file. CGI.pm now contains around 4000 lines of code, which compared to some modules on CPAN isn't really that much - This essentially deprecates the -compile pragma and ->compile method. The -compile pragma will no longer do anything, whereas the ->compile method will raise a deprecation warning. More importantly this also REMOVES the -any pragma because as per the documentation this pragma needed to be "used with care or not at all" and allowing arbitrary HTML tags is almost certainly a bad idea. If you are using the -any pragma and using arbitrary tags (or have typo's in your code) your code will *BREAK* - Although this release should be back compatible (with the exception of any code using the -any pragma) you are encouraged to test it throughly as if you are doing anything out of the ordinary with CGI.pm (i.e. have bugs that may have been masked by the AUTOLOAD feature) you may see some issues. - References: GH #162, GH #137, GH #164 [ SPEC / BUG FIXES ] - make the list context warning in param show the filename rather than the package so we have more information on exactly where the warning has been raised from (GH #171) - correct self_url when PATH_INFO and SCRIPT_NAME are the same but we are not running under IIS (GH #176) - Add the multi_param method to :cgi export (thanks to xblitz for the patch and tests. GH #167) - Fix warning for lack of HTTP_USER_AGENT in CGI::Carp (GH #168) - Fix imports when called from CGI::Fast, restores the import of CGI functions into the callers namespace for users of CGI::Fast (GH leejo/cgi-fast#11 and GH leejo/cgi-fast#12) - Fix regression of tmpFileName when calling with a plain string (GH #178, thanks to Simon McVittie for the report and fix) [ FEATURES ] - CGI::Carp now has $CGI::Carp::FULL_PATH for displaying the full path to the offending script in error messages - CGI now has env_query_string() for getting the value of QUERY_STRING from the environment and not that fiddled with by CGI.pm (which is what query_string() does) (GH #161) - CGI::ENCODE_ENTITIES var added to control which chracters are encoded by the call to the HTML::Entities module - defaults to &<>"' (GH #157 - the \x8b and \x9b chars have been removed from this list as we are concerned more about unicode compat these days than old browser support.) [ DOCUMENTATION ] - Fix some typos (GH #173, GH #174) - All *documentation* for HTML functionality in CGI has been moved into its own namespace: CGI::HTML::Functions - although the functionality continues to exist within CGI.pm so there are no code changes required (GH #142) - Add missing documentation for env variable fetching routines (GH #163) [ TESTING ] - Increase test coverage (GH #3) [ INTERNALS ] - Cwd made a TEST_REQUIRES rather than a BUILD_REQUIRES in Makefile.PL (GH #170) - AutoloadClass variables have been removed as AUTOLOAD was removed in v4.14 so these are no longer necessary (GH #172 thanks to alexmv) - Remove dependency on constant - internal DEBUG, XHTML_DTD and EBCDIC constants changes to $_DEBUG, $_XHTML_DTD, and $_EBCDIC 4.13 2014-12-18 [ RELEASE NOTES ] - CGI::Pretty is now DEPRECATED and will be removed in a future release. Please see GH #162 (https://github.com/leejo/CGI.pm/issues/162) for more information and discussion (also GH #140 for HTML function deprecation discussion: https://github.com/leejo/CGI.pm/issues/140) [ TESTING ] - fix t\rt-84767.t for failures on Win32 platforms related to file paths 4.11 2014-12-02 [ SPEC / BUG FIXES ] - more hash key ordering bugs fixed in HTML attribute output (GH #158, thanks to Marcus Meissner for the patch and test case) [ REFACTORING ] - escapeHTML (and unescapeHTML) have been refactored to use the functions exported by the HTML::Entities module (GH #157) - change BUILD_REQUIRES to TEST_REQUIRES in Makefile.PL as these are test dependencies not build dependencies (GH #159) [ DOCUMENTATION ] - replace any remaining uses of indirect object notation (new Object) with the safer Object->new syntax (GH #156) 4.10 2014-11-27 [ SPEC / BUG FIXES ] - favour -content-type arg in header if -type and -charset options are also passed in (GH #155, thanks to kaoru for the test case). this change also sorts the hash keys in the rearrange method in CGI::Util meaning the order of the arrangement will always be the same for params that have multiple aliases. really you shouldn't be passing in multiple aliases, but this will make it consistent should you do that [ DOCUMENTATION ] - fix some typos 4.09 2014-10-21 [ RELEASE NOTES ] - with this release the large backlog of issues against CGI.pm has been cleared. All fixes have been made in the versions 4.00 and above so if you are upgrading from 3.* you should thoroughly test your code against recent versions of CGI.pm - an effort has been made to retain back compatibility against previous versions of CGI.pm for any fixes made, however some changes related to the handling of temporary files may have consequences for your code - please refer to the RELEASE NOTES for version 4.00 and above for all recent changes and file an issue on github if there has been a regression. - please do *NOT* file issues regarding HTML generating functions, these are no longer being maintained (see perldoc for rationale) [ SPEC / BUG FIXES ] - tweak url to DTRT when the web server is IIS (RT #89827 / GH #152) - fix temporary file handling when dealing with multiple files in MIME uploads (GH #154, thanks to GeJ for the test case) 4.08 2014-10-18 [ DOCUMENTATION ] - note that calling headers without a -charset may lead to a nonsensical charset being added to certain content types due to the default and the workaround - remove documentation stating that calls to escapeHTML with a changed charset force numeric encoding of all characters, because that does not happen - documentation tweaks for calling param() in list context and the addition of multi_param() [ SPEC / BUG FIXES ] - don't sub out PATH_INFO in url if PATH_INFO is the same as SCRIPT_NAME (RT #89827) - add multi_param() method to allow calling of param() in list context without having to disable the $LIST_CONTEXT_WARN flag (see RELEASE NOTES for version 4.05 on why calling param() in list context could be a bad thing) 4.07 2014-10-12 [ RELEASE NOTES ] - please see changes for v4.05 [ TESTING ] - typo and POD fixes, add test to check POD and compiles 4.06 2014-10-10 [ RELEASE NOTES ] - please see changes for v4.05 [ DOCUMENTATION ] - make warning on list context call of ->param more lenient and don't warn if called with no arguments 4.05 2014-10-08 [ RELEASE NOTES ] - this release includes *significant* refactoring of temporary file handling in CGI.pm. See "Changes in temporary file handling" in perldoc - this release adds a warning for when the param method is called in list context, see the Warning in the perldoc for the section "Fetching the value or values of a single named parameter" for why this has been added and how to disable this warning [ DOCUMENTATION ] - change AUTHOR INFORMATION to LICENSE to please Kwalitee [ TESTING ] - t/arbitrary_handles.t to check need for patch in RT #54055, it turns out there is no need - the first argument to CGI->new can be an arbitrary handle - add test case for incorrect unescaping of redirect headers (RT #61120) - add tests for the handle method (RT #85074, thanks to TONYC@cpan.org) [ SPEC / BUG FIXES ] - don't set binmode on STDOUT/STDERR/STDIN if a none standard layer is already set on them on none UNIX platforms (RT #57524) - make XForms:Model data accesible through POSTDATA/PUTDATA param (RT #75628) - prevent corruption of POSTDATA/PUTDATA when -utf8 flag is used and use tempfiles to handle this data (RT #79102, thanks anonymous) - unescape request URI *after* having removed the query string to prevent removal of ? chars that are part of the original URI (and were encoded) (RT #83265) - fix q( to qq( in CGI::Carp so $@ is correct interpolated (RT #83360) - don't call ->query_string in url unless -query is passed (RT #87790) (optimisation and fits the current documented behaviour) 4.04 2014-09-04 [ RELEASE NOTES ] - this release removes some long deprecated modules/functions and includes refactoring to the temporary file handling in CGI.pm. if you are doing anything out of the ordinary with regards to temp files you should test your code before deploying this update as temp files may no longer be stored in previously used locations [ REMOVED / DEPRECATIONS ] - startform and endform methods removed (previously deprecated, you should be using the start_form and end_form methods) - both CGI::Apache and CGI::Switch have been removed as these modules 1) have been deprecated for *years*, and 2) do nothing whatsoever [ SPEC / BUG FIXES ] - handle multiple values in X-Forwarded-Host header, we follow the logic in most other frameworks and take the last value from the list (RT #54487) - reverse the order of TEMP dir placement for WINDOWS: TEMP > TMP > WINDIR (RT #71799, thanks to jeff@math.tntech.edu), this returns the behaviour to pre e24d04e9bc5fda7722444b02fec135d8cc2ff488 but with the undefined fix still in place - refactor CGITempFile::find_tempdir to use File::Spec->tmpdir (related: RT #71799) - fix warnings when QUERY_STRING has empty key=value pairs (RT #54511) - pad custom 500 status response messages to > 512 for MSIE (RT #81946) - make Vars tied hash delete method return the value deleted from the hash making it act like perl's delete (RT #51020) [ TESTING ] - add .travis.yml (https://travis-ci.org) - test case for RT #53966 - disallow filenames with ~ char - test case for RT #55166 - calling Vars to get the filename does not return a filehandle, so this cannot be used in the call to uploadinfo, also update documentation for the uploadInfo to show that ->Vars should not be used to get the filename for this method - fix t/url.t to pass on Win32 platforms that have the SCRIPT_NAME env variable set (RT #89992) - add procedural call tests for upload and uploadInfo to confirm these work as should (RT #91136) [ DOCUMENTATION ] - tweak perldoc for -utf8 option (RT #54341, thanks to Helmut Richter) - explain the HTML generation functions should no longer be used and that they may be deprecated in a future release 4.03 2014-07-02 [ REMOVED / DEPRECATIONS ] - the -multiple option to popup_menu is now IGNORED as this did not function correctly. If you require a menu with multiple selections use the scrolling_list method. (RT #30057) [ SPEC / BUG FIXES ] - support redirects in mod_perl2, or fall back to using env variable for up to 5 redirects, when getting the query string (RT #36312) - CGI::Cookie now correctly supports the -max-age argument, previously if this was passed the value of the -expires argument would be used meaning there was no way to supply *only* this argument (RT #50576) - make :all actually import all methods, except for :cgi-lib, and add :ssl to the :standard import (RT #70337) [ DOCUMENTATION ] - clarify documentation regarding query_string method (RT #48370) - links fixed in some perldoc (Thanks to Michiel Beijen) [ TESTING ] - add t/changes.t for testing this Changes file - test case for RT #31107 confirming multipart parsing is to spec - improve t/rt-52469.t by adding a timeout check 4.02 2014-06-09 [ NEW FEATURES ] - CGI::Carp learns noTimestamp / $CGI::Carp::NO_TIMESTAMP to prevent timestamp in messages (RT #82364, EDAVIS@cpan.org) - multipart_init and multipart_start learn -charset option (RT #22737) [ SPEC / BUG FIXES ] - Support multiple cookies when passing an ARRAY ref with -set-cookie (RT #15065, JWILLIAMS@cpan.org) [ DOCUMENTATION ] - Made licencing information consistent and remove duplicate comments about licence details, corrected location to report bugs (RT #38285) 4.01 2014-05-27 [ DOCUMENTATION ] - CGI.pm hasn't been removed from core *just* yet, but will be soon: http://perl5.git.perl.org/perl.git/commitdiff/e9fa5a80 4.00 2014-05-22 [ INTERNALS ] - CGI::Fast split out into its own distribution, related files and tests removed - developer test added for building with perlbrew [ DOCUMENTATION ] - Update perldoc to explain that CGI.pm has been removed from perl core - Make =head2 perldoc less shouty (RT #91140) - Tickets migrated from RT to github issues (both CGI and CGI.pm distributions) - Repointing bugtracker at newly forked github repo and note that Lee Johnson is the current maintainer. - Bump version to 4.00 for clear boundary of above changes Version 3.65 Feb 11, 2014 [INTERNALS] - Update Makefile to refine where CGI.pm gets installed (Thanks to bingo, rjbs: https://github.com/markstos/CGI.pm/pull/30) Version 3.64 Nov 23, 2013 [BUG FIXES] - Avoid warning about "undefined variable in user_agent in some cases (RT#72882) [INTERNALS] - Avoiding warning about "unitialized value" in when calling user_agent() in some cases. (RT#72882, perl@max-maurer.de) - Update minimum required version in Makefile.PL to 5.8.1. It had already been updated to 5.8.1 in the CGI.pm module in 3.53. - Fix POD errors reported by newer pod2man (Thanks to jmdh) - Typo fixes, (dsteinbrunner). - use deprecate.pm on perls 5.19.0 and later. (rjbs). [DOCUMENTATION] - Update CGI::Cookie docs to reflect that HttpOnly is widely supported now. Version 3.63 Nov 12, 2012 [SECURITY] - CR escaping for Set-Cookie and P3P headers was improved. There was potential for newline injection in these headers. (Thanks to anazawa, https://github.com/markstos/CGI.pm/pull/23) Version 3.62, Nov 9th, 2012 [INTERNALS] - Changed how the deprecated endform function was defined for compatibility with the development version of Perl. - Fix failures in t/tmpdir.t when run as root https://github.com/markstos/CGI.pm/issues/22, RT#80659) - Made it possible to force a sorted order for things like hash attributes so that tests are not dependent on a particular hash ordering. This will be required in modern perls which will change the ordering per process. (Yves, RT#80659) Version 3.61 Nov 2nd, 2012 (No code changes) [INTERNALS] - formatting of CGI::Carp documentation was improved. Thanks to benkasminbullock. - un-TODO some tests in t/tmpdir.t that were passing in most cases. More on this: https://github.com/markstos/CGI.pm/issues/19# https://github.com/markstos/CGI.pm/commit/cc73dc9807b0fabb56b3cdf1a9726588b2eda0f7 Version 3.60 Aug 15th, 2012 [BUG FIXES] - In some caes, When unescapeHTML() hit something it didn't recognize with an ampersand and and semicolon, it would throw away the semicolon and ampersand. It now does a better job. of preserving content it doesn't recognize. Thanks to CEBJYRE@cpan.org (RT#75595) - Remove trailing newline after
tag inserted by startform and start_form. It can cause rendering problems in some cases. Thanks to SJOHNSTON@cpan.org (RT#67719) - Workaround "Insecure Dependency" warning generated by some versions of Perl (RT#53733). Thanks to degatcpan@ntlworld.com, klchu@lbl.gov and Anonymous Monk [DOCUMENTATION] - Clarify that when -status is used, the human-readable phase should be included, per RFC 2616. Thanks to SREZIC@cpan.org (RT#76691). [INTERNALS] - More tests for header(), thanks to Ryo Anazawa. - t/url.t has been fixed on VMS. Thanks to cberry@cpan.org (RT#72380) - MANIFEST patched so that t/multipart_init.t is included again. Thanks to shay@cpan.org (RT#76189) Version 3.59 Dec 29th, 2011 [BUG FIXES] - We no longer read from STDIN when the Content-Length is not set, preventing requests with no Content-Length from freezing in some cases. This is consistent with the CGI RFC 3875, and is also consistent with CGI::Simple. However, the old behavior may have been expected by some command-line uses of CGI.pm. Thanks to Philip Potter and Yanick Champoux. See RT#52469 for details: https://rt.cpan.org/Public/Bug/Display.html?id=52469 [INTERNALS] - remove tmpdirs more aggressively. Thanks to rjbs (RT#73288) - use Text::ParseWords instead of ancient shellwords.pl. Thanks to AlexBio. - remove use of define(@arr). Thanks to rjbs. - spelling fixes. Thanks to Gregor Herrmann and Alessandro Ghedini. - fix test count and warning in t/fast.t. Thanks to Yanick. Version 3.58 Nov 11th, 2011 [DOCUMENTATION] - Clarify that using query_string() only has defined behavior when using the GET method. (RT#60813) Version 3.57 Nov 9th, 2011 [INTERNALS] - test failure in t/fast.t introduced in 3.56 is fixed. (Thanks to zefram and chansen). - Test::More requirement has been bumped to 0.98 Version 3.56 Nov 8th, 2011 [SECURITY] Use public and documented FCGI.pm API in CGI::Fast CGI::Fast was using an FCGI API that was deprecated and removed from documentation more than ten years ago. Usage of this deprecated API with FCGI >= 0.70 or FCGI <= 0.73 introduces a security issue. (Thanks to chansen) [INTERNALS] - tmp files are now cleaned up on VMS ( RT#69210, thanks to cberry@cpan.org ) - Fixed test failure: done_testing() added to url.t (Thanks to Ryan Jendoubi) - Clarify preferred bug submission location in docs, and note that Mark Stosberg is the current maintainer. Version 3.55 June 3rd, 2011 [THINGS THAT MAY BREAK YOUR CODE] url() was fixed to return "PATH_INFO" when it is explicitly requested with either the path=>1 or path_info=>1 flag. If your code is running under mod_rewrite (or compatible) and you are calling self_url() or you are calling url() and passing path_info=>1, These methods will actually be returning PATH_INFO now, as you have explicitly requested, or has self_url() has requested on your behalf. The PATH_INFO has been omitted in such URLs since the issue was introduced in the 3.12 release in December, 2005. This bug is so old your application may have come to depend on it or workaround it. Check for application before upgrading to this release. Examples of affected method calls: $q->url(-absolute => 1, -query => 1, -path_info => 1 ) $q->url(-path=>1) $q->url(-full=>1,-path=>1) $q->url(-rewrite=>1,-path=>1) $q->self_url(); Version 3.54, Apr 28, 2011 No code changes [INTERNALS] - Address test failures in t/tmpdir.t, thanks to Niko Tyni. Some tests here are failing on some platforms and have been marked as TODO. Version 3.53, Apr 25, 2011 [NEW FEATURES] - The DELETE HTTP verb is now supported. (RT#52614, James Robson, Eduardo Ari�o de la Rubia) [INTERNALS] - Correct t/tmpdir.t MANIFEST entry. (RT#64949) - Update minimum required Perl version to be Perl 5.8.1, which has been out since 2003. This allows us to drop some hacks and exceptions (Mark Stosberg) Version 3.52, Jan 24, 2011 [DOCUMENTATION] - The documentation for multi-line header handling was been updated to reflect the changes in 3.51. (Mark Stosberg, ntyni@iki.fi) [INTERNALS] - Add missing t/tmpfile.t file. (RT#64949) - Fix warning in t/cookie.t (RT#64570, Chris Williams, Rainer Tammer, Mark Stosberg) - Fixed logic bug in t/multipart_init.t (RT#64261, Niko Tyni) Version 3.51, Jan 5, 2011 [NEW FEATURES] - A new option to set $CGI::Carp::TO_BROWSER = 0, allows you to explicitly exclude a particular scope from triggering printing to the browser when fatatlsToBrowser is set. (RT#62783, Thanks to papowell) - The