[php-src] PR #24450: LiteSpeed: document security considerations for executed paths
| From: | DanielEScherzer | Date: | Mon, 19 Oct 2026 21:11:49 +0000 |
| Subject: | [php-src] PR #24450: LiteSpeed: document security considerations for executed paths | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39619@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24450
Author: DanielEScherzer
Make it clear that the
init_request_info() function is indeed meant to be using
LSAPI_GetScriptFileName() without any validation, and document in the README file that
this lack of validation is another reason why only trusted sources should be granted direct access
to the listener.