Re: Security Issues

Guys, Please read the advisory. You simply can't say that register_globals=off wouldn't have resulted in more secure apps, because there are *3* examples (or more, I don't remember) there of applications that would have not been exploitable had register_globals=on was in effect! Unless we make the very unlikely assumption that these are the only apps that were vulnerable (and from what I understand in the advisory, pretty much any app they checked was vulnerable at one point or another), saying that setting register_globals to off is going to improve security is pretty much a fact, and not an opinion. Zeev At 03:15 27/07/2001, Björn Schotte wrote:

* Rasmus Lerdorf wrote: significantly more secure PHP scripts out there. It will simply cause scripts to break in non-obvious ways and the knee-jerk fix will be to swear at those annoying PHP folks and then turn register_globals on, or they will do something like: foreach($HTTP_POST_VARS as $key=>$val) $$key = $val; foreach($HTTP_GET_VARS as $key=>$val) $$key = $val; foreach($HTTP_COOKIE_VARS as $key=>$val) $$key = $val; I fully agree here with Rasmus and I also think this will be the workaround for most people -- if one _does_ care about security, he even knows what and how to do nowadays. I don't think turning register_globals to off will evangelize people to develop more secure scripts/applications. --

PHP Schulungen und                        | International PHP Conference
Schulungsmaterial:                        |             05. - 07.11.2001
http://thinkphp.de/                       |      Astron Hotel, Frankfurt

http://rent-a-phpwizard.de/schulungen.php | http://www.php-kongress.de/

-- Zeev Suraski <zeev@zend.com> CTO & co-founder, Zend Technologies Ltd. http://www.zend.com/