Loading external images from a spreadsheet can subject the caller to security exploits. For those who think they need something between not loading any external images (the default and our strong recommendation) or loading them all unconditionally (the current alternative), a callback can now be provided to indicate whether a specific image is okay to load. We continue to urge caution in using this option.
Fix#1810, just before it turns 6 years old. Reporter thinks it can save time. Easy to implement, especially with the advent of named parameters which were not available when issue was opened.
Issue3982Test mysteriously ran into memory problems when we migrated from Phpunit 9 to 10. It wasn't all that critical a test, so it has been disabled ever since. I finally had some time to research, and the problem is unquestionably with Phpunit's `assertCount` test - it doesn't like something about our array. However, we can easily redo that test by using Php's native `count` function, and testing that result with `assertSame`. I have not yet succeeded at simplifying the test to a state where I am willing to report the bug, but I'll keep trying. In the meantime, the test is recoded, and can now be run successfully. No source code changes.
This will improve round-tripping from Xlsx to Html and back again. The calculated result will still be what is displayed when viewing the result in a browser, but, using the new option, the original formula can be reconstructed when PhpSpreadsheet reads the Html file. The ability to recognize this situation is automatically enabled in Html Reader, however, to avoid BC issues, it needs to be explicitly enabled for Html Writer. A new boolean property `dataFormula` and setter are added to Writer; it will default to current behavior `false` for now, but my plan is to change the default in the next breaking release. I cannot think of a decent use case for a getter, so have not added one.
Fix#4280, an issue with many problems; this is the last one (PR #4281 and PR #4677 dealt with other aspects of the problem). New releases of Excel allow representing TRUE/FALSE as a checked/unchecked checkbox. This requires a change to Styles, as expected. But Excel has implemented it in such a manner that changes are also required to Content_Types and workbook.xml.rels; and a new xml file propertyFeatureBag is also required. Seems like a lot of work for such a small change. A new property is added to Style, but only Xlsx Reader and Writer support it; no other format does.
While reviewing the DefaultValueBinder::dataTypeForValue() method, I noticed that a new Calculation instance is being created for every single cell validation.
Since the Calculation class is quite heavy (initializing components like CyclicReferenceStack and BranchPruner), instantiating it repeatedly causes unnecessary memory and CPU overhead, especially during bulk imports of large spreadsheets.
Changes:
Switched from new Calculation() to Calculation::getInstance() to leverage the existing singleton.
Added state preservation logic for branchPruning to ensure the shared instance remains consistent for other parts of the application.
Wrapped the logic in a finally block to guarantee that the pruning state is restored regardless of success or failure.
No changes were made to the public API, so this is fully backward compatible. I've also added a unit test to verify that formula detection and state isolation work as expected.
Tests:
Added tests/PhpSpreadsheetTests/Cell/DefaultValueBinderTest.php.
The table attributes `border`, `cellspacing`, and `cellpadding` are used in Html Writer. They are deprecated in Html5 in favor of css attributes. Further, their use is redundant or outright wrong. Their use is eliminated. A sample is added to show how equivalents might be used.
It currently always uses PHP_EOL, which, of course, works, but you get slightly different results in Windows and Unix. User can now set line ending to `\n` or `\r\n` to ensure consistent results regardless of environment. Default remains PHP_EOL. We already do this for CSV.
oleibman
dependabot[bot]
xannyprox