#41156 [NEW]: url_fopen default value

From: c dot heutger at psw dot net Operating system: irrelevant PHP version: 4.4.6 PHP Bug Type: PHP options/info functions Bug description: url_fopen default value Description: ------------ Meanwhile you installed a big warning in PHP installation on register_globals and default them to off, there is no warning at all and it is per default on on url_fopen, although with using of includes, this variable opens any hackers from outside a door inside your applications (e.g. used by opensurveypilot). So we had in the last time many hackins as this variable is on either by default installation or by templates like distributed via SWsofts Virtuozzo or with Plesk. This value should be warned the same and set to off by default like the register_globals. Reproduce code: --------------- Try to refer any http:// ressource in e.g. opensurveypilot files using include and url_fopen is on Expected result: ---------------- Hacked sites if it's like default url_fopen off by default in future PHP versions Actual result: -------------- A big security whole for lame code and programmers still open. -- Edit bug report at http://bugs.php.net/?id=41156&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=41156&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=41156&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=41156&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=41156&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=41156&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=41156&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=41156&r=needscript Try newer version: http://bugs.php.net/fix.php?id=41156&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=41156&r=support Expected behavior: http://bugs.php.net/fix.php?id=41156&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=41156&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=41156&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=41156&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=41156&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=41156&r=dst IIS Stability: http://bugs.php.net/fix.php?id=41156&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=41156&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=41156&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=41156&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=41156&r=mysqlcfg