Re: Re: A couple of potential security issues with sessions and glob() in safe_mode

Hi, On Thu, 1 Jul 2004 06:17:07 +0100 Wez Furlong <kingwez@gmail.com> wrote: > Even better, if you do discover something that might be exploitable, > you should keep your mouth shut and instead send mail to > security@php.net where, among a handful of others, Stefan will also > read your message. But these bugs have already been dismissed as "bogus" / "by design" at first. Since there currently seem to be an understanding of "Of course it is supposed to work this way", I don't think it's the same kind of exploit as if I found a buffer overflow or anything like that. This is more a political decision whether or not we would like PHP to behave this way. (I will resend the post to security@php.net later today if necessary) -- - Peter Brodersen