Re: potential solution to user streams + allow_url_include=off

On Fri, May 18, 2007 10:51 am, Greg Beaver wrote: > The solution: > ============= > Add a new function: stream_wrapper_set_local() So, basically, your function would be similar to: "I'm removing the safety from the gun with which I might shoot myself in the foot." :-) :-) :-) Would it be applied on an individual stream only, or could we consider allowing something not unlike: stream_wrapper_set_local('phar://*'); as a sort of "glob" where only streams that fit the pattern are white-listed. phar://* is probably a bad example... 'phar:///usr/local/lib/php_libs/*' would seem to me to be a pretty clear way to express that phar files found in the local file system at that path are kosher, but nothing else is being white-listed in this call. This would, I think, provide a better balance between security and usability. I have no idea if what I suggest is reasonable to implement or not. It just seems like it "should" be and would be more useful to application developers than having to whitelist streams individually... In fact, I suspect that if you have to call this function on each stream individually, the masses will end up doing something that boils down to: <?php stream_wrapper_set_local($_GET['foo']); include($_GET['foo']); ?> because they'll wrap it up in 20 levels of function calls and OOP obfuscation^H^H^H^H^H^H^H^H^H abstraction, and not realize they've just blown away the safety barrier when they call: stream_wrapper_set_local($stream); down in the guts of their code. YMMV -- Some people have a "gift" link here. Know what I want? I want you to buy a CD from some indie artist. http://cdbaby.com/browse/from/lynch Yeah, I get a buck. So?