Re: Security Issues

Well, we actually could just bump the version number to 4.1.0 for these changes alone. I don't think we should wait for *any* of the other changes that people had in mind for a major or semi major version, but bumping the number to 4.1.0 instead of staying at 4.0.8 is probably a good idea. Zeev At 23:56 26/07/2001, Cynic wrote:

At 08:32 7/27/2001, Zeev Suraski wrote the following: -------------------------------------------------------------- Zeev, while I'll applaud to the changes you propose, I suggest this happens in 4.1. I know, this is really a cosmetic change only, and doesn't justify the bump from the perspective of the PHP developers, but is a major one from the perspective of a PHP user. Defaulting error_reporting to E_ALL, and turning register_globals off means 99% percent of current applications won't work, and given the current behavior of zend_error(), where PHP basically reports bogus line numbers (http://www.php.net/bugs.php?id=1225) this is really hard to get around. With 4.1, it'll be clear that a massive change is coming. I'd vote for 4.7 (current state of things) -> 4.1 (register_globals off, error_reporting E_ALL). Other than that, hip hip hurray!!! The way I think we should go about this is: (a) Improve the accessibility of the track vars array by shortening their names to $_GET[], $_POST[], etc. and possibly making them implicitly available inside functions. This can be done relatively quickly. (b) Get the word out that as of PHP 4.0.8, register_globals will be off, so that app authors will have a chance to fix their apps. (c) Release 4.0.7 with the new improved track vars, but with register_globals still set to on (d) Release 4.0.8 with register_globals set to off We can (and probably should) make the E_NOTICE change at the same time. Zeev -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net For additional commands, e-mail: php-dev-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net ------end of quote------ cynic@mail.cz ------------- And the eyes of them both were opened and they saw that their files were world readable and writable, so they chmoded 600 their files.

    - Book of Installation chapt 3 sec 7

-- Zeev Suraski <zeev@zend.com> CTO & co-founder, Zend Technologies Ltd. http://www.zend.com/