Re: dangerous handling of security bugs

Am 13.07.2010 14:29, schrieb Pierre Joye: > hi, > > On Tue, Jul 13, 2010 at 1:50 PM, Reindl Harald <h.reindl@thelounge.net> wrote: > >> http://bugs.php.net/bug.php?id=42836 > > The answer was clear WHAT is here clear? Someone is closing a bugreport without understanding the problem > it is a default comment we use instead of RTFM. Then show me where it is documentated that php6 takes a random configuration for vhost-settings? <VirtualHost *> DocumentRoot /var/www/docroot1 ServerName docroot1 <Directory "/var/www/docroot1"> php_admin_value open_basedir "/var/www/docroot1" </Directory> </VirtualHost> <VirtualHost *> DocumentRoot /var/www/docroot2 ServerName docroot2 <Directory "/var/www/docroot2"> php_admin_value open_basedir "/var/www/docroot2" </Directory> </VirtualHost> Come on, show me the part of rtfm where it is described that if you call "http://docroot1/" php is throwing a error that the files are not in "/var/www/docroot2" per random in both directions and with every reload you can have luck and it matches! And after such actions you wonder why someone is stopping testing snaphots? really? > bugs.php.net is not meant to be a support channel. Exlain me where it is support FOR ME to fixing such bugs? It is support FROM ME taking a fucking snapshot and test it and your point of view is very strange >> http://bugs.php.net/bug.php?id=42077 > > What's wrong here? Bug fixed with explanation and all that. > > All in all, what I'm trying to tell you is that contributions are > always welcome, as well as bug report. But to be upset only because > your report was not seen as bug won't help (same here for this > discussion). What was wrong here? It was a change in core-behavior and closed as bogus At this time i had to write a private mail because as bogus closed bugreports was not commentable AFTER an angry private mail to the one who closed the bugreport he reopened with "Re-opening and assign to Stas who has something cooking up for this." So waht will you tell me? That it is ok that anyone who did not make the change is closing something he do not understand until someone gets crazy about this? This is waht i call "stoopid defense" and showing testers that there help is not wanted. If someone understands a bugreport not in the first 5 seconds he should leave it in peace until another one understands it or make a question, but not close it

Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc