Re: Comments on PHP security
| From: | Alain Williams | Date: | Thu, 18 Jan 2007 09:04:43 +0000 |
| Subject: | Re: Comments on PHP security | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-27515@lists.php.net to get a copy of this message | ||
On Wed, Jan 17, 2007 at 11:18:50AM -0800, Stanislav Malyshev wrote:
> >Which functions am I forgetting?
>
> All using php_stream_open*. I see 38 files in the php source tree using
> this function. You probably would have to go to each of them and change
> each instance to support your flag. That's the safe mode story again -
> you plug 90% quickly and then spend forever trying to plug the rest.
I am with Arnold on this one. Implement a patch that fixes the source of most of
the problems, tidy the rest at leisure. Better to get an effective fix quickly
than wait forever for perfection.
--
Alain Williams
Linux Consultant - Mail systems, Web sites, Networking, Programmer, IT Lecturer.
+44 (0) 787 668 0256 http://www.phcomp.co.uk/
Parliament Hill Computers Ltd. Registration Information: http://www.phcomp.co.uk/contact.php
#include <std_disclaimer.h>