Re: Security Issues

At 08:32 7/27/2001, Zeev Suraski wrote the following: -------------------------------------------------------------- Zeev, while I'll applaud to the changes you propose, I suggest this happens in 4.1. I know, this is really a cosmetic change only, and doesn't justify the bump from the perspective of the PHP developers, but is a major one from the perspective of a PHP user. Defaulting error_reporting to E_ALL, and turning register_globals off means 99% percent of current applications won't work, and given the current behavior of zend_error(), where PHP basically reports bogus line numbers (http://www.php.net/bugs.php?id=1225) this is really hard to get around. With 4.1, it'll be clear that a massive change is coming. I'd vote for 4.7 (current state of things) -> 4.1 (register_globals off, error_reporting E_ALL). Other than that, hip hip hurray!!! >The way I think we should go about this is: > >(a) Improve the accessibility of the track vars array by shortening their names to $_GET[], >$_POST[], etc. and possibly making them implicitly available inside functions. This can be done >relatively quickly. >(b) Get the word out that as of PHP 4.0.8, register_globals will be off, so that app authors >will have a chance to fix their apps. >(c) Release 4.0.7 with the new improved track vars, but with register_globals still set to on >(d) Release 4.0.8 with register_globals set to off > >We can (and probably should) make the E_NOTICE change at the same time. > >Zeev > > >-- >PHP Development Mailing List <http://www.php.net/> >To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net >For additional commands, e-mail: php-dev-help@lists.php.net >To contact the list administrators, e-mail: php-list-admin@lists.php.net ------end of quote------ cynic@mail.cz ------------- And the eyes of them both were opened and they saw that their files were world readable and writable, so they chmoded 600 their files. - Book of Installation chapt 3 sec 7