Re: Plan regarding fd patch...rc4

From: Date: Tue, 20 May 2003 07:45:39 +0000
Subject: Re: Plan regarding fd patch...rc4
References: 1 2 3 4 5 6 7 8  Groups: php.internals 
Request: Send a blank email to internals+get-1767@lists.php.net to get a copy of this message
Zeev Suraski wrote:
I'm kinda worried about those last-minute fastcgi (and CGI!). Last time we did that we had one of the biggest security holes in PHP's history.
The fix in question is http://bugs.php.net/bug.php?id=23664, which leaves a feature completely broken. If this is possibly to be the last release prior to 5, I think it should go in. The security hole was always there, cleaning up other code allowed it to be hit, and had we ever had a test system in place to test PHP in the way it is used, we probably would have caught it. Anyway, it's no big deal to me if it doesn't go in. Shane

« previous php.internals (#1767) next »