Warn on http_response_code() after header('HTTP/...')

Fixes GH-18582
Fixes #81451
Closes GH-18962

Co-authored-by: Jakub Zelenka <bukka@php.net>

NEWS

@@ -56,6 +56,10 @@ PHP                                                                        NEWS
 - Reflection:
   . ReflectionConstant is no longer final. (sasezaki)
 
+- SAPI:
+  . Fixed bug GH-18582 and #81451: http_response_code() does not override the
+    status code generated by header(). (ilutov, Jakub Zelenka)
+
 - Standard:
   . Passing strings which are not one byte long to ord() is now deprecated.
     (Girgias)

ext/standard/head.c

@@ -381,6 +381,14 @@ PHP_FUNCTION(http_response_code)
 			}
 			RETURN_FALSE;
 		}
+
+		if (SG(sapi_headers).http_status_line) {
+			php_error_docref(NULL, E_WARNING, "Calling http_response_code() after header('HTTP/...') has no effect");
+			// If it is decided that this should have effect in the future, replace warning with
+			// efree(SG(sapi_headers).http_status_line);
+			// SG(sapi_headers).http_status_line = NULL;
+		}
+
 		zend_long old_response_code;
 
 		old_response_code = SG(sapi_headers).http_response_code;

sapi/cli/tests/gh18582.phpt

@@ -0,0 +1,40 @@
+--TEST--
+GH-18582: Allow http_response_code() to clear HTTP start-line
+--SKIPIF--
+<?php
+include "skipif.inc";
+?>
+--FILE--
+<?php
+include "php_cli_server.inc";
+
+php_cli_server_start(<<<'PHP'
+http_response_code(401);
+header('HTTP/1.1 404 Not Found');
+$is_404 = http_response_code(403);
+$should_be_404_but_is_403 = http_response_code();
+echo $is_404 . PHP_EOL;
+echo $should_be_404_but_is_403 . PHP_EOL;
+PHP);
+
+$host = PHP_CLI_SERVER_HOSTNAME;
+$fp = php_cli_server_connect();
+if (fwrite($fp, "GET / HTTP/1.1\nHost: {$host}\n\n")) {
+    while (!feof($fp)) {
+        echo fgets($fp);
+    }
+}
+fclose($fp);
+?>
+--EXPECTF--
+HTTP/1.1 404 Not Found
+Host: %s
+Date: %s
+Connection: close
+X-Powered-By: %s
+Content-type: text/html; charset=UTF-8
+
+<br />
+<b>Warning</b>:  http_response_code(): Calling http_response_code() after header('HTTP/...') has no effect in <b>%s</b> on line <b>3</b><br />
+404
+403