Re: safe_mode and ENFORCE_SAFE_MODE

> Any idea why php_fopen_wrapper() accepts the ENFORCE_SAFE_MODE option? > Shouldn't it just check PG(safe_mode) like it does in most places? This > means that places that call php_fopen_wrapper() and don't explicitly pass > the ENFORCE_SAFE_MODE option aren't really safe_mode'ed even under > safe_mode. It makes little sense. Well, the obvious answer is that there are places where we use the wrapper without wanting to enforce safe mode. Like when we are loading fonts from the GD extension, for example. It would be inconvenient to copy a directory full of GD fonts into each user's web space. > Another thing is why do we still have the --enable-safe-mode compile > switch? safe_mode can be set by the system php.ini file. No code as far as > I saw actually gives a shit about the PHP_SAFE_MODE being defined by > ./configure. IMO yet another thing we can nuke. We have a number of such switches which simply change the default setting. magic-quotes and short-tags from the top of my head. -Rasmus