PHP Weekly Summary (Issue 2)

PHP Weekly Summary (Issue 2 : 2000/09/03 - 2000/09/10) ------------------------------------------------------ $cover_myself = include("standard_libel_disclaimer.inc"); Each heading is prefixed by the following - NEW: new code being added. TLK: general talk. BUG: a bug being discussed. FIX: maintenance work. REQ: feature request. Table of Contents: ------------------ FIX: networking code TLK: extension specific bug reporting BUG: SRADV00001, PHP file upload security vulnerability NEW: Apache ICU i16n REQ: PHP extension documentation REQ: function aliases NEW: XSLT extension FIX: include[_once],require[_once] inconsistent FIX: networking code -------------------- Stig Venaas continues to make excellent progress on the new code for PHP's networking functions. Thanks to Wez Furlong it looks quite likely that SSL (using the openssl library) will be supported as well. TLK: extension specific bug reporting ------------------------------------- Zak Greant came up with the nifty idea of allowing extension specific bug reporting to make things easier for everyone. as of writing bugs.php.net has already been changed to allow this. nice one Zak! BUG: SRADV00001, PHP file upload security vulnerability ------------------------------------------------------- At approximately 10pm on the 3rd of this month, a message was forwarded to the developers list that had been posted to bugtraq. (see it here - http://www.geocrawler.com/lists/3/Web/5/925/4287115/). An Australian company by the name of "Secure Reality" had released an advisory outlining a problem with file uploads that "will generally lead to a remote attacker being able to read any file on the server that can be read by the user the web server is running as, typically nobody." Rasmus Lerdorf responded to the message within 4 minutes of it hitting the list, with a short term fix that he believed would alleviate the problem. He also recommended two important things: 1. check your upload files are coming from the /tmp directory. 2. make sure non-public documents on your server aren't readable by your webserver software. Ron Chmara jumped in next with a series of comments about the "problem" outlined in the "advisory" only existing if you don't follow any safe coding practices. Stanislav Malyshev pointed out that the $HTTP_POST_FILES array can be used safely - without the risk of a user overwriting any of its contents. Rasmus L. agreed that this was true, but not for PHP3 which does not have that particular variable - and that his patch wasn't intended to be perfect, but a quick fix which he intended to revise. Zeev Suraski posted a request for comments as to whether the latest CVS fixed the problem, as he believed it didn't - and would also cause PHP to crash under certain situations. He committed a patch which he believed would further tighten things up. Ron C. posted again, with a long message about security in general. He also quickly followed up with some code snippets that could be used to avoid the problem without the need for any patches. Stanislav M. agreed with Ron C. that his code would in fact work, but posed the rhetorical question : "aren`t these things supposed to be _easy_ in PHP?". At about this time Jon Ribbens posted a message to the list that did have valid points, but was written in quite an insulting tone. He did prefix it with a warning that he intended for it to be this way. Consequently, he began a thread that was very involved, and got quite a lot of people upset. Now, I prefer to give you a "just the facts ma'am" view of the list, but i feel a special exception can be made for this situation due to the amount of ground that was covered. for those folks that don't like editorializing feel free to skip the next little bit. <editorial mode="soap-box"> Jon is not a stupid guy. Throughout the 3 or so days when every message submitted to the list was basically part of the thread that he started, he had some very valid points. In most areas, his theory was sound. The main problem was implementation. The way he went about speaking to members of the list was very, very blunt - and not within the "expected" norms of net etiquette. Whether he was right or wrong in doing so is not the issue, but *is* what led to the upset of those involved. A personal observation - if you (the reader) are posting to the developers list with a problem, try to phrase it in such a way that puts across your point without dumping on the hard work of those (mostly *unpaid* volunteers) who work on PHP. Doing so will get your problem solved quickly and without fuss. </editorial> Much work has been done in the last week to make changes to the documentation to reflect the possible security hazards discussed above, and to modifying the default behavior of PHP itself. There is also talk of a code audit, and the possible formation of a team dedicated to doing it on a permanent basis. Anyone out there interested should post to the list. NEW: Apache ICU i16n -------------------- Carl W. Brown has been hard at work for multiple charset conversion and support for PHP3&4 using Apache ICU. REQ: PHP extension documentation -------------------------------- The number of requests for documentation on how to write a PHP extension is rising. Anyone who can help in this area, please do. for the time being, the README.SELF-CONTAINED-EXTENSIONS, README.EXT_SKEL, apidoc.txt and apidoc-zend.txt files from the PHP source distribution are a good starting point. I understand that "Web Application Development With PHP" (ISBN:0735709971) has a section about this topic also. (see http://www.phpwizard.net/book/ for more information. note: i am not affiliated with the authors of this book in any way, nor have i read it.). REQ: function aliases --------------------- a request was made again to be able to create a new name or redefine the functionality of an existing function. according to previous feedback from the core developers, it is unlikely this feature will find its way into PHP. (if it does, it will be very limited for security reasons). NEW: XSLT extension ------------------- Sterling Hughes and Derick Rethans continue to make headway on their (highly anticipated) sablotron-based XSLT extension. There were a few rumblings about the possibility of a xalan-based extension, but seeings as the xalan-c++ library is still alpha, i doubt it'll be finished before Sterling and Derick's. FIX: include[_once],require[_once] inconsistent ----------------------------------------------- John from Webmeta spotted a small glitch in the functionality of require_once that has now been fixed in CVS. -- About 1100 messages made their way onto the php-dev list this week, with a large amount of them being bug reports being worked on. A hearty "good job!" to the PHP QA team who continue to methodically burn through the large amount of bugs that are filed. Some good news for "the summary". I've had three separate offers for hosting, the final details of which I am hoping to get wrapped up in the next week or so. Thanks also to everyone who contacted me with feedback for Issue 1. I am really enjoying doing these, and all responses so far have been quite encouraging. thanks for listening! - avi lewin