Re: Comments on PHP security
| From: | Stefan Esser | Date: | Sat, 13 Jan 2007 17:46:06 +0000 |
| Subject: | Re: Comments on PHP security | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-27432@lists.php.net to get a copy of this message | ||
My 2cents,
the actually best would be to completely forbid the usage of URLs inside
include/require and
introduce a new keyword: include_url that works like the current include
would work and
rename allow_url_include into allow_dangerous_urls (for include_url only).
Basically this would protect everyone from URL includes with no way
around and if someone
really really wants this dangerous feature he has to explicitly request
it via include_url.
Stefan Esser