Re: [PATCH] potential solution to user streams + allow_url_include=off

Attached is second version of the patch implementing the security model below. The difference to previous version is that the optional argument for stream_wrapper_register is now an integer flag, which allows to extend it in the future. Any comments/objections? >>>> I think the problem could be solved this way: >>>> 1. By default, allow_remote_inclue=0, allow_remote_fopen=1 >>>> 2. Stream can be of three types - remote, local and user/local. >>>> 3. User streams can be declared when registered as either remote or >>>> user/local, remote being the default. >>>> 4. When operation on user/local stream is run, allow_remote_fopen is >>>> disabled if allow_remote_include was disabled. > -- Stanislav Malyshev, Zend Products Engineer stas@zend.com http://www.zend.com/