From 8392633f97e01241703139159518b900345d9abc Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Wed, 15 Oct 2025 21:45:10 +0200
Subject: [PATCH] Fix getNamedItemNS() incorrect namespace check

Accidentally introduced while refactoring iterator handling.
The check ordering of namespace vs spec compliance was wrong.

Closes GH-20185.
---
 NEWS                                          |  3 +++
 ext/dom/obj_map.c                             |  8 +++---
 ...ute_getNamedItemNS_incorrect_ns_check.phpt | 26 +++++++++++++++++++
 3 files changed, 33 insertions(+), 4 deletions(-)
 create mode 100644 ext/dom/tests/modern/xml/attribute_getNamedItemNS_incorrect_ns_check.phpt

diff --git a/NEWS b/NEWS
index 774434d5a55..353df7d7a89 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,9 @@ PHP                                                                        NEWS
     (ilutov)
   . Fixed bug GH-19844 (Don't bail when closing resources on shutdown). (ilutov)
 
+- DOM:
+  . Fix getNamedItemNS() incorrect namespace check. (nielsdos)
+
 - FPM:
   . Fixed bug GH-19817 (Decode SCRIPT_FILENAME issue in php 8.5).
     (Jakub Zelenka)
diff --git a/ext/dom/obj_map.c b/ext/dom/obj_map.c
index 9c017c4d11a..84fae3bad57 100644
--- a/ext/dom/obj_map.c
+++ b/ext/dom/obj_map.c
@@ -515,11 +515,11 @@ static xmlNodePtr dom_map_get_ns_named_item_prop(dom_nnodemap_object *map, const
 {
 	xmlNodePtr nodep = dom_object_get_node(map->baseobj);
 	if (nodep) {
-		if (php_dom_follow_spec_intern(map->baseobj)) {
-			return (xmlNodePtr) php_dom_get_attribute_node(nodep, BAD_CAST ZSTR_VAL(named), ZSTR_LEN(named));
+		if (ns) {
+			return (xmlNodePtr) xmlHasNsProp(nodep, BAD_CAST ZSTR_VAL(named), BAD_CAST ns);
 		} else {
-			if (ns) {
-				return (xmlNodePtr) xmlHasNsProp(nodep, BAD_CAST ZSTR_VAL(named), BAD_CAST ns);
+			if (php_dom_follow_spec_intern(map->baseobj)) {
+				return (xmlNodePtr) php_dom_get_attribute_node(nodep, BAD_CAST ZSTR_VAL(named), ZSTR_LEN(named));
 			} else {
 				return (xmlNodePtr) xmlHasProp(nodep, BAD_CAST ZSTR_VAL(named));
 			}
diff --git a/ext/dom/tests/modern/xml/attribute_getNamedItemNS_incorrect_ns_check.phpt b/ext/dom/tests/modern/xml/attribute_getNamedItemNS_incorrect_ns_check.phpt
new file mode 100644
index 00000000000..dc8c1f87c14
--- /dev/null
+++ b/ext/dom/tests/modern/xml/attribute_getNamedItemNS_incorrect_ns_check.phpt
@@ -0,0 +1,26 @@
+--TEST--
+getNamedItemNS() incorrect namespace check
+--EXTENSIONS--
+dom
+--CREDITS--
+veewee
+--FILE--
+<?php 
+
+$xml = Dom\XMLDocument::createFromString(<<<EOXML
+<?xml version="1.0" encoding="UTF-8"?>
+<note
+      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+      xsi:noNamespaceSchemaLocation="note-nonamespace1.xsd http://localhost/note-nonamespace2.xsd"
+      xsi:schemaLocation="http://www.happy-helpers1.com note-namespace1.xsd http://www.happy-helpers2.com http://localhost/note-namespace2.xsd">
+</note>
+EOXML
+);
+$documentElement = $xml->documentElement;
+$attributes = $documentElement->attributes;
+$schemaLocation = $attributes->getNamedItemNS('http://www.w3.org/2001/XMLSchema-instance', 'schemaLocation');
+var_dump($schemaLocation->textContent);
+
+?>
+--EXPECT--
+string(116) "http://www.happy-helpers1.com note-namespace1.xsd http://www.happy-helpers2.com http://localhost/note-namespace2.xsd"