Re: allow_url_include and php:/data:
| From: | Ilia Alshanetsky | Date: | Sun, 05 Nov 2006 16:08:05 +0000 |
| Subject: | Re: allow_url_include and php:/data: | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-26342@lists.php.net to get a copy of this message | ||
I think it'd be wrong to consider networked file system as non-local. Mostly because many times there are no ways to identify them reliable and the fact this is a perfectly valid usage that if disallowed by default would break a large number of applications.
On 4-Nov-06, at 4:12 PM, Peter Brodersen wrote:
On Sat, 04 Nov 2006 12:40:01 -0800, in php.internals rasmus@lerdorf.com (Rasmus Lerdorf) wrote:Ilia AlshanetskyYeah, we probably should. Had a chat with Wez about it too. Here is the patch. I think this catches the cases we are interested in: http://lerdorf.com/php/is_url.diff If someone could doublecheck it against those attacks it would be helpful.Would requests to a smbserver, e.g. \\10.20.30.40\evil\malicious_php_code.txt be prevented as well? It seems like smbserver requests are regarded as part of the default filesystem wrapper. --- Peter Brodersen -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php