#39997 [Opn]: allow_url_fopen "2.0"
ID: 39997
User updated by: phpnet at gwaihir dot net
Reported By: phpnet at gwaihir dot net
Status: Open
Bug Type: Feature/Change Request
Operating System: all?
PHP Version: 5.2.0
New Comment:
I noticed that it's probably more elegant if this "yes, an URL is ok
here" be an option to set in the stream's context.
Previous Comments:
------------------------------------------------------------------------
[2006-12-31 18:58:45] phpnet at gwaihir dot net
Description:
------------
Securing PHP against accidentally opening a file/stream from a URL
instead of the local filesystem is nice, however allow_url_fopen as it
is, is just too limited, it needs an "explicit only" setting in
addition to just "on" or "off".
In most real world situations, one doesn't want to forbid URL opening
server wide, but it would be way nice if it didn't happen by accidental
security oversight. So, what I'd really want is a setting that allows
URL fopen only if I somehow explicitly tell the function I am using
that it should expect a URL.
[Similar concerns are voiced in the responses here:
http://bugs.php.net/bug.php?id=28684 The poster
is asking for a
different feature though, so continued this seperate request.]
Reproduce code:
---------------
Would go something like this:
PHP.ini:
allow_url_fopen = explicit
Script:
//mode 'u' allows me to open from a URL
fopen(http://example.org/somefile.txt, 'ua+');
//-> should work fine
fopen(http://example.org/somefile.txt, 'a+');
//-> should give a "not allowed" error
Similar ought to go for all functions capable of URL opening, of
course. A default of allow_url_fopen = On still maintains backwards
compatibility.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=39997&edit=1
Thread (3 messages)