Re: Comments on PHP security
| From: | Stefan Esser | Date: | Sun, 14 Jan 2007 11:23:20 +0000 |
| Subject: | Re: Comments on PHP security | ||
| References: | 1 2 3 4 5 6 7 8 9 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-27440@lists.php.net to get a copy of this message | ||
Greg,
i was not talking about providing all the different versions of include.
For me it is a broken application design to include anything out of an
URL wrapper.
However it would also be fine to just have allow_url_include affect all
URLs and to be
setable by ini_set() and be turned off by default.
Insane applications can then turn it on/off for every REMOTE URL they need.
Aside from that there could be a setting for the admin to completely
disallow URLs marked as is_URL.
Stefan Esser