This release includes a dozen bug fixes and three notable changes.

First, Zend_Gdata has been updated to use HTTPS for those GData services

that support it. This should be a seamless change for most GData users.

Second, Zend_Application now supports “.dist” configuration files.  This

allows you to create the following:

application/

configs/

application.ini.dist

and, while still specifying application.ini as the configuration file,

fall back to the .dist variant. This is useful for working on teams,

where individuals may wish to tailor their configuration environment

without necessarily checking in those environment-specific changes.

Thanks goes out to Wil Moore for this improvement.

Third, Mike van Riel offered to convert the API documentation generation

to DocBlox. We’d already been considering it for ZF2, but on seeing the

flexibility of the templating system, and, more importantly for us in

terms of packaging, the speed and minimal resources it utilizes in

generating the output, we were sold. (API documentation generation time

was reduced from taking 80-100 minutes to less than 10.) You can view

the results for yourself.

http://framework.zend.com/apidoc/1.11/

Issues resolved for this release:

• [ZF-10842]: Test path default ZendX to plugins resources never fails
• [ZF-8751]: add ZendX_Application_Resource as a default plugin path for the bootstrap
• [ZF-10952]: Zend_Cache_Page needs to check if $_SERVER['REQUEST_URI'] is set
• [ZF-10908]: fix on zend_cache save failure process
• [ZF-10881]: ob_get_contents + ob_get_clean can be done by ob_get_clean
• [ZF-10558]: Undefined variable in Zend_Cache_Backend_Static
• [ZF-10963]: Missing closing parenthese in example
• [ZF-10974]: Zend_Db Performance sample code mistake: utilize a combination of vsprintf() and array_walk() to inject the values into the SQL
• [ZF-2953]: Zend_Db_Table_Abstract->insert returns empty value
• [ZF-10734]: Use getName instead of getId when adding element to DisplayGroup
• [ZF-10731]: addDisplayGroup() should automatically call addElement()
• [ZF-10665]: Zend_Http_UserAgent may die on serialization
• [ZF-10985]: Wrong namespace in doc of Zend_Log
• [ZF-10885]: Zend_Log_Formatter_Firebug: add unit tests
• [ZF-9790]: allow to attach a formatter from .ini configuration and do not hardcode formatter class in Log_Writer class
• [ZF-9176]: Zend_Log::factory() does not support formatters
• [ZF-8382]: Zend_Log_Writer_Syslog does not utilize formatter
• [ZF-10884]: Zend_Paginator – Row count column not found
• [ZF-10044]: Zend_Test_PHPUnit_Db_Operation_Truncate doesn’t heed the AUTO_QUOTE_IDENTIFIERS config option
• [ZF-10926]: zf.sh is mixing lines
• [ZF-10509]: Using the functionality of priority to give meaning to the log in the default error controller
• [ZF-10428]: Default ErrorController should log request parameters
• [ZF-9743]: Add Support for typeKey of Property
• [ZF-9532]: Conditional comments in headStyle()
• [ZF-10914]: Zend_XmlRpc_Value converts Integer to String param
• [ZF-10920]: XML_RPC not working
• [ZF-10805]: method docblocks contain invalid @param syntax

This release includes around 80 bug fixes.

You may download ZF 1.11.1 from the Zend Framework site:  http://framework.zend.com/download/latest

For a full list of resolved issues, you can visit the changelog:  http://framework.zend.com/changelog/1.11.1

This release is the culmination of several months of effort by contributors and Zend Framework partners, and offers several key new features, including support for mobile devices and the first stable release of the SimpleCloud API.

You may download the release from the following location:  http://framework.zend.com/download/latest

The following is a summary of new features and capabilities introduced in version 1.11.0

mobile support

==============

Zend Framework 1.11 marks the first release with explicit support for

mobile devices, via the new component Zend_Http_UserAgent. This

component was developed by Raphael Carles. Carles is CTO of Interakting,

the digital agency of Business & Decision Group of France. Interakting

employs 150 PHP professionals to build industrial PHP projects, and its

clients include Canal +/Vivendi, BNP Paribas, Samsung France, Ministry

of Education, Alapage (Orange), Orange Tunisia, and many others. As

such, they have extensive experience in supporting mobile devices, and

stepped forward to contribute to Zend Framework, which they leverage in

their projects.

Zend_Http_UserAgent performs two responsibilities:

- User-Agent detection

- Device capabilities detection, based on User-Agent

The component includes a “features” adapter mechanism that allows

developers to tie into different backends for the purpose of discovering

device capabilities. Currently, Zend Framework ships with adapters for

the WURFL (Wireless Universal Resource File) API, Tera-WURFL, and

DeviceAtlas, with more planned for the future.

Luca Passani, author and lead of the WURFL project, has provided an

exemption to Zend Framework to provide a non-GPL adapter accessing the

WURFL PHP API.

Additional hooks into the component are provided via a Zend_Application

resource plugin, and a Zend_View helper, allowing developers the ability

to return output customized for the detected device (e.g., alternate

layouts, alternate images, Flash versus HTML5 support, etc.).

Zend_Cloud: SimpleCloud API

===========================

During ZendCon 2009, Zend announced a prototype of the SimpleCloud API.

This API was to provide hooks into cloud-based document storage, queue

services, and file storage.

Zend Framework 1.11.0 markes the first official, stable release of

Zend_Cloud, Zend Framework’s PHP version of the SimpleCloud API. Current

support includes:

- Document Services:

- Amazon SimpleDB

- Windows Azure’s Table Storage

- Queue Services:

- Amazon Simple Queue Service (SQS)

- Windows Azure’s Queue Service

- All adapters supported by Zend_Queue:

- Zend Platform JobQueue

- Memcacheq

- Relational Database

- ActiveMQ

- Storage Services:

- Amazon Simple Storage Service (S3)

- Windows Azure’s Blog Storage

- Nirvanix

- Local filesystem

When using any of the SimpleCloud APIs, your code will be portable

across the various adapters provided, allowing you to pick and choose

your services, as well as try different services until you find one that

suits your application or business needs. Additionally, if you find you

need to code adapter-specific features, you can drop down to the

specific adapter in order to do so.

More adapters will be arriving in the coming months, giving you even

more options!

We thank Wil Sinclair and Stas Malyshev for their assistance in the

initial releases of Zend_Cloud.

Security

========

Several classes in Zend Framework were patched to eliminate the

potential for leaking timing information from the direct comparison of

sensitive data such as plaintext passwords or cryptographic signatures

to user input. These leaks arise from the normal process of comparing

any two strings in PHP. The nature of the leaks is that strings are

often compared byte by byte, with a negative result being returned early

as soon as any set of non-matching bytes is detected. The more bytes

that are equal (starting from the first byte) between both sides of the

comparison, the longer it takes for a final result to be returned. Based

on the time it takes to return a negative or positive result, it is

possible that an attacker could, over many samples of requests, craft a

string that compares positively to another secret string value known

only to a target server simply by guessing the string one byte at a time

and measuring each guess’ execution time. This server secret could be a

plaintext password or the correct cryptographic signature of a request

the attacker wants to execute, such as is used in several open protocols

including OpenID and OAuth. This could obviously enable an attacker to

gain sufficient information to perform a secondary attack such as

masquerading as an authenticated user.

This form of attack is known as a Remote Timing Attack. Timing Attacks

have been problematic in the past but to date have been very difficult

to perform remotely over the internet due to the interference of network

jitter which limits their effectiveness in resolving very small timing

differences. While the internet still poses a challenge to performing

successful Timing Attacks against a remote server, the increasing use of

frameworks on local networks and in cloud computing, where network

jitter may be significantly reduced, raises the distinct possibility

that remote Timing Attacks will become feasible against ever smaller

timing information leaks, such as those leaked when comparing any two

strings. As a precaution, the applied changes implement a fixed time

comparison for several classes which would be attractive targets in any

potential remote Timing Attack. A fixed time comparison function does

not leak any timing information useful to an attacker thus proactively

preventing any future vulnerability to these forms of attack.

We thank Pàdraic Brady for his efforts in identifying and patching these

vulnerabilities.

Dojo Support

============

Zend Framework’s default Dojo Toolkit version has been bumped to version

1.5.0, which includes the new dojox.mobile component, a simple framework

for client-side mobile applications.

SimpleDB Support

================

Zend Framework has provided support for Amazon’s Simple Storage Service

(S3), Simple Queue Service (SQS), and Elastic Cloud Compute (EC2)

platforms for several releases. Zend Framework 1.11.0 adds support for

SimpleDB, Amazon’s non-relational document storage database offering.

Support is available for all SimpleDB operations via

Zend_Service_Amazon_SimpleDb.

Zend Framework’s SimpleDB adapter was originally written by Wil

Sinclair.

eBay Findings API Support

=========================

eBay has an extensive REST API, allowing developers to build

applications interacting with their extensive data. Zend Framework

1.11.0 includes Zend_Service_Ebay_Findings, which provides complete

support for the eBay Findings API. This API allows developers to query

eBay for details on active auctions, using categories or keywords.

Zend_Service_Ebay was contributed by Renan de Lima, Ramon Henrique

Ornelas, and Don Bosco Nguyen Van Hoi.

MariaDB Compatibility

=====================

Zend_Db’s mysql and Pdo_Mysql adapters are fully MariaDB compatible, and

the documentation has been updated to reflect configuration options for

this fork of MySQL.

New Configuration Formats

=========================

Zend_Config has been a quite popular component in Zend Framework, and

has offerred adapters for PHP arrays, XML, and INI configuration files.

Zend Framework 1.11.0 now offers two additional configuration formats:

YAML and JSON.

Zend_Config_Yaml provides a very rudimentary YAML-parser that should

work with most configuration formats. However, it also allows you to

specify an alternate YAML parser if desired, allowing you to lever tools

such as PECL’s ext/syck or Symfony’s YAML component, sfYaml.

Zend_Config_Json leverages the Zend_Json component, and by extension

ext/json.

Both adapters have support for PHP constants, as well as provide the

ability to write configuration files based on configuration objects.

Stas Malyshev created both adapters for Zend Framework; Zend_Config_Json

also had assistance from Sudheer Satyanarayana.

URL Shortening

==============

Zend_Service_ShortUrl was added for this release. The component provides

a simple interface for use with most URL shortening services, defining

simply the methods “shorten” and “unshorten”. Adapters for two services,

http://jdem.cz and http://tinyurl.com, are provided with this release.

Zend_Service_ShortUrl was contributed by Martin Hujer.

Additional View Helpers

=======================

Several new view helpers are now exposed:

- Zend_View_Helper_UserAgent ties into the Zend_Http_UserAgent

component, detailed above. It gives you access to the UserAgent

instance, allowing you to query for the device and capabilities.

- Zend_View_Helper_TinySrc is an additional portion of Zend Framework’s

mobile offering for version 1.11.0. The helper ties into the TinySrc

API, allowing you to a) provide device-specific image sizes and

formats for your site, and b) offload generation of those images to

this third-party service. The helper creates img tags pointing to the

service, and provides options for specifying adaptive sizing and

formats.

- Zend_View_Helper_Gravatar ties into the Gravatar API, allowing you to

provide avatar images for registered users that utilize the Gravatar

service. This helper was contributed by Marcin Morawski.

This release is the culmination of several months of effort by contributors and Zend Framework partners, and offers several key new features, including support for mobile devices and the first stable release of the SimpleCloud API.

This release is of BETA quality, and should be used for testing purposes only, not production.

New Features in Zend Framework 1.11

Mobile Support

Zend Framework 1.11 marks the first release with explicit support for

mobile devices, via the new component Zend_Http_UserAgent. This

component was developed by Raphael Carles. Carles is CTO of Interakting,

the digital agency of Business & Decision Group of France. Interakting

employs 150 PHP professionals to build industrial PHP projects, and its

clients include Canal +/Vivendi, BNP Paribas, Samsung France, Ministry

of Education, Alapage (Orange), Orange Tunisia, and many others. As

such, they have extensive experience in supporting mobile devices, and

stepped forward to contribute to Zend Framework, which they leverage in

their projects.

Zend_Http_UserAgent performs two responsibilities:

• User-Agent detection

• Device capabilities detection, based on User-Agent

The component includes a “features” adapter mechanism that allows

developers to tie into different backends for the purpose of discovering

device capabilities. Currently, the only shipped adapter is for the

WURFL (Wireless Universal Resource File) API.

Luca Passani, author and lead of the WURFL project, has provided an

exemption to Zend Framework to provide a non-GPL adapter accessing the

WURFL PHP API.

Additional hooks into the component are provided via a Zend_Application

resource plugin, and a Zend_View helper, allowing developers the ability

to return output customized for the detected device (e.g., alternate

layouts, alternate images, Flash versus HTML5 support, etc.).

Zend_Cloud: SimpleCloud API

During ZendCon 2009, Zend announced a prototype of the SimpleCloud API.

This API was to provide hooks into cloud-based document storage, queue

services, and file storage.

Zend Framework 1.11.0 markes the first official, stable release of

Zend_Cloud, Zend Framework’s PHP version of the SimpleCloud API. Current

support includes:

• Document Services:

□ Amazon SimpleDB

□ Windows Azure’s Table Storage

• Queue Services:

□ Amazon Simple Queue Service (SQS)

□ Windows Azure’s Queue Service

□ All adapters supported by Zend_Queue:

☆ Zend Platform JobQueue

☆ Memcacheq

☆ Relational Database

☆ ActiveMQ

• Storage Services:

□ Amazon Simple Storage Service (S3)

□ Windows Azure’s Blog Storage

□ Nirvanix

□ Local filesystem

When using any of the SimpleCloud APIs, your code will be portable

across the various adapters provided, allowing you to pick and choose

your services, as well as try different services until you find one that

suits your application or business needs. Additionally, if you find you

need to code adapter-specific features, you can drop down to the

specific adapter in order to do so.

More adapters will be arriving in the coming months, giving you even

more options!

Security

Several classes in Zend Framework were patched to eliminate the

potential for leaking timing information from the direct comparison of

sensitive data such as plaintext passwords or cryptographic signatures

to user input. These leaks arise from the normal process of comparing

any two strings in PHP. The nature of the leaks is that strings are

often compared byte by byte, with a negative result being returned early

as soon as any set of non-matching bytes is detected. The more bytes

that are equal (starting from the first byte) between both sides of the

comparison, the longer it takes for a final result to be returned. Based

on the time it takes to return a negative or positive result, it is

possible that an attacker could, over many samples of requests, craft a

string that compares positively to another secret string value known

only to a target server simply by guessing the string one byte at a time

and measuring each guess’ execution time. This server secret could be a

plaintext password or the correct cryptographic signature of a request

the attacker wants to execute, such as is used in several open protocols

including OpenID and OAuth. This could obviously enable an attacker to

gain sufficient information to perform a secondary attack such as

masquerading as an authenticated user.

This form of attack is known as a Remote Timing Attack. Timing Attacks

have been problematic in the past but to date have been very difficult

to perform remotely over the internet due to the interference of network

jitter which limits their effectiveness in resolving very small timing

differences. While the internet still poses a challenge to performing

successful Timing Attacks against a remote server, the increasing use of

frameworks on local networks and in cloud computing, where network

jitter may be significantly reduced, raises the distinct possibility

that remote Timing Attacks will become feasible against ever smaller

timing information leaks, such as those leaked when comparing any two

strings. As a precaution, the applied changes implement a fixed time

comparison for several classes which would be attractive targets in any

potential remote Timing Attack. A fixed time comparison function does

not leak any timing information useful to an attacker thus proactively

preventing any future vulnerability to these forms of attack.

We thank Padraic Brady for his efforts in identifying and patching these

vulnerabilities.

Dojo Support

Zend Framework’s default Dojo Toolkit version has been bumped to version 1.5.0.

SimpleDB Support

Zend Framework has provided support for Amazon’s Simple Storage Service

(S3), Simple Queue Service (SQS), and Elastic Cloud Compute (EC2)

platforms for several releases. Zend Framework 1.11.0 adds support for

SimpleDB,

Amazon’s non-relational document storage database offering. Support is

available for all SimpleDB operations via Zend_Service_Amazon_SimpleDb.

Zend Framework’s SimpleDB adapter was originally written by Wil Sinclair.

eBay Findings API Support

eBay has an extensive REST API, allowing developers to build

applications interacting with their extensive data. Zend Framework

1.11.0 includes Zend_Service_Ebay_Findings, which provides complete

support for the eBay Findings API. This API allows developers to query

eBay for details on active auctions, using categories or keywords.

Zend_Service_Ebay was contributed by Renan de Lima and Ramon Henrique

Ornelas.

New Configuration Formats

Zend_Config has been a quite popular component in Zend Framework, and

has offerred adapters for PHP arrays, XML, and INI configuration files.

Zend Framework 1.11.0 now offers two additional configuration formats:

YAML and JSON.

Zend_Config_Yaml provides a very rudimentary YAML-parser that should

work with most configuration formats.  However, it also allows you to

specify an alternate YAML parser if desired, allowing you to lever tools

such as PECL’s ext/syck or Symfony’s YAML component, sfYaml.

Zend_Config_Json leverages the Zend_Json component, and by extension

ext/json.

Both adapters have support for PHP constants, as well as provide the

ability to write configuration files based on configuration objects.

Stas Malyshev created both adapters for Zend Framework; Zend_Config_Json

also had assistance from Sudheer Satyanarayana.

URL Shortening

Zend_Service_ShortUrl was added for this release. The component provides

a simple interface for use with most URL shortening services, defining

simply the methods “shorten” and “unshorten”. Adapters for two services,

http://jdem.cz and http://tinyurl.com, are provided with this release.

Zend_Service_ShortUrl was contributed by Martin Hujer.

Additional View Helpers

Several new view helpers are now exposed:

• Zend_View_Helper_UserAgent ties into the Zend_Http_UserAgent

component, detailed above. It gives you access to the UserAgent

instance, allowing you to query for the device and capabilities.

• Zend_View_Helper_TinySrc is an additional portion of Zend

Framework’s mobile offering for version 1.11.0.  The helper ties

into the TinySrc API, allowing you to a) provide device-specific

image sizes and formats for your site, and b) offload generation of

those images to this third-party service. The helper creates img

tags pointing to the service, and provides options for specifying

adaptive sizing and formats.

• Zend_View_Helper_Gravatar ties into the Gravatar API, allowing you

to provide avatar images for registered users that utilize the

Gravatar service. This helper was contributed by Marcin Morawski.

This release includes more than 30 bug fixes.

You may download it from the Zend Framework site: http://framework.zend.com/download/latest

For a full list of resolved issues, you can visit the changelog: http://framework.zend.com/changelog/1.10.6

Issues resolved for this release:

• [ZF-9877]: Initialize Zend_Translate cache from application configuration
• [ZF-8007]: using own namespace for resource plugins
• [ZF-9960]: Zend_Auth_Adapter_DbTable
• [ZF-7510]: Zend_Auth_Adapter_DbTable to use the default adapter
• [ZF-9963]: Color management in Zend/Barcode/Renderer/Pdf.php
• [ZF-9950]: Class name wrong, current is name Zend_Pdf_Color_RGB
• [ZF-9941]: Zend_Currency::toCurrency() options
• [ZF-9891]: Zend_Date::equals() issues when 2 objects have different TZs
• [ZF-9885]: CLONE -logging not found translations does not work with Zend_Validate, Zend_Form_Element_Multi, Zend_Dojo_Form_Element_DijitMulti
• [ZF-9944]: Zend_Form_Element_File loses breakChainOnFailure option if NotEmpty validator is not supplied
• [ZF-9896]: Zend_Form::getValidValues(): dont’t return values for ignored elements
• [ZF-9168]: Zend Form Element Captcha Decorator
• [ZF-8622]: Zend_Form_Element::setDecorators() can’t set what getDecorators() returned
• [ZF-7552]: Same type decorators are lost when getting and setting back decorators
• [ZF-5197]: Decorator aliases are lost when Zend_Form_Element_Captcha adds its own decorators in ‘render’ method
• [ZF-9894]: Typo in Zend_Http_Client Advanced
• [ZF-9416]: Zend_Json_Encoder creates invalid JSON for Zend_Json_Decoder
• [ZF-10024]: Autoloader doesn not make use of PHP5.3 closures as callbacks
• [ZF-9937]: Problems with arrays
• [ZF-9889]: Wrong test for exists locale
• [ZF-9655]: Zend_Locale::getTranslation method (‘LanguageToTerritory’ type) description
• [ZF-7603]: Syslog writer facility should be long
• [ZF-8914]: Specifying numeric parameter name for page link generates incorrect URL
• [ZF-10019]: Zend_Oauth_Consumer::getAccessToken() overrides request parameters if oauth_verifier exists.
• [ZF-7732]: Zend_Pageinator : clearPageItemCache()’s var “$cleanTags” is not required.
• [ZF-6989]: Zend_Paginator DbSelect should not use Select object in serialization
• [ZF-9750]: Spelling in constructor Zend Pdf
• [ZF-8791]: Error: Pdf file syntax error. ‘startxref’ keyword expected. Offset – 0×2180.
• [ZF-9976]: Zend_Translate_Adapter rerouting problem
• [ZF-9938]: Malformed tag in documentation/manual/en/module_specs/Zend_Translate-Additional.xml
• [ZF-9967]: Can’t disable locale in IBAN validator
• [ZF-9930]: Spanish translation for Zend_Validate messages
• [ZF-9871]: Ignore next validators
• [ZF-9295]: escape callback doesn’t accept additional params

You may download it from the Zend Framework site: http://framework.zend.com/download/latest

A couple weeks ago, the Dojo Foundation announced a security advisory regarding Dojo Toolkit, which Zend Framework bundles in its releases.

The new releases of Zend Framework incorporate the updates made to Dojo Toolkit.

You can read more about the advisory on the Zend Framework security blog: http://framework.zend.com/security

For a full list of non-security-related, resolved issues, you can visit the changelog: http://framework.zend.com/changelog/1.10.3

* Zend_Barcode, contributed by Mickael Perraud

* Zend_Cache_Backend_Static, contributed by Pádraic Brady

* Zend_Cache_Manager, contributed by Pádraic Brady

* Zend_Exception – previous exception support, contributed by Marc Bennewitz

* Zend_Feed_Pubsubhubbub, contributed by Pádraic Brady

* Zend_Feed_Writer, contributed by Pádraic Brady

* Zend_Filter_Boolean, contributed by Thomas Weidner

* Zend_Filter_Compress/Decompress, contributed by Thomas Weidner

* Zend_Filter_Null, contributed by Thomas Weidner

* Zend_Log::factory(), contributed by Mark van der Velden and Martin Roest (of ibuildings)

* Zend_Log_Writer_ZendMonitor, contributed by Matthew Weier O’Phinney

* Zend_Markup, contributed by Pieter Kokx

* Zend_Oauth, contributed by Pádraic Brady

* Zend_Serializer, contributed by Marc Bennewitz

* Zend_Service_DeveloperGarden, contributed by Marco Kaiser

* Zend_Service_LiveDocx, contributed by Jonathan Marron

* Zend_Service_WindowsAzure, contributed by Maarten Balliauw

* Zend_Validate_Barcode, contributed by Thomas Weidner

* Zend_Validate_Callback, contributed by Thomas Weidner

* Zend_Validate_CreditCard, contributed by Thomas Weidner

* Zend_Validate_PostCode, contributed by Thomas Weidner

* Zend_Pdf parsing speed has been improved by around 40%

* Additions to Zend_Application resources, including Cachemanager, Dojo, Jquery, Layout, Log, Mail, and Multidb (contributed primarily by Dolf Schimmel)

* Refactoring of Zend_Loader::loadClass() to conform to the PHP Framework Interop Group reference implementation, which allows for autoloading PHP 5.3 namespaced code

* Updated Dojo version to 1.4

Zend_Tool was refactored to eliminate issues and bottlenecks, as well as to add a number of new features:

* New CLI runner with home directory and configuration support

* New providers for Model generation, DbAdapter setup, Layouts and Form Generation

* Default project structure comes with logging support in the ErrorController