Re: allow_url_include and php:/data:
| From: | Stanislav Malyshev | Date: | Sun, 05 Nov 2006 18:22:12 +0000 |
| Subject: | Re: allow_url_include and php:/data: | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-26363@lists.php.net to get a copy of this message | ||
Ilia Alshanetsky wrote:
What's to say /drive/smb or letter:// is not an SMB device? Also why break perfectly valid applications that perform operations on networked file systems?Well, it's the same as asking why break valid apps that perform operations on URL. Because of security policy - i.e., if we choose to have security policy that disallows running code with non-local origin influenced by user data - we must do it full nine yards, not "we won't give it to you by http, but you are welcome to do it by smb". Now, if it would be not allowed by default by Windows (AFAIK it is allowed) or there's known way to restrict that from Windows (which I don't know of) - then we may defer this task to the OS, but if there's none, then I don't see how http here would differ from smb... If we say including file from http source is not OK, then why would including file from smb source ok? -- Stanislav Malyshev, Zend Products Engineer stas@zend.com http://www.zend.com/