Re: PHP 8 is_file/is_dir input handling
| From: | privat) | Date: | Wed, 02 Dec 2020 08:44:39 +0000 |
| Subject: | Re: PHP 8 is_file/is_dir input handling | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-112366@lists.php.net to get a copy of this message | ||
Am 02.12.20 um 09:18 schrieb Christian Schneider:
Am 01.12.2020 um 21:13 schrieb Reindl Harald (privat) <harry@rhsoft.net>:https://en.wikipedia.org/wiki/Web_application_firewall and sanitize userinput while i don't see much legit usecases where userinout from outside makes it to is_file/is_dir without calling that a security issue anywaysAm 01.12.20 um 21:09 schrieb Stanislav Malyshev:Out of curiosity: What is your fix?my server would trigger a mail every 15 minutes wioth all warnings and notices to enforce fixing the issuewe are running error_reporting E_ALL for 17 years now and don't distinct between notice / warning / error, it has to be fixed - periodSurely you do. Your code continues to run after warning/notice but stops after the error. It's impossible to ignore that. Unless you have an error handler that does exit() after a notice (which I have hard time believing, honestly, but who knows), there is a very major distinction.