Re: Providing sandboxed versions of include and require language constructs
| From: | Ángel González | Date: | Wed, 07 Mar 2012 21:34:54 +0000 |
| Subject: | Re: Providing sandboxed versions of include and require language constructs | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-58755@lists.php.net to get a copy of this message | ||
On 07/03/12 00:04, Adam Jon Richardson wrote:
> It would be the responsibility of the framework or CMS or application
> to protect against this type of attack (which they do quite well.)
> When you can force a plugin to work through your API, you can take
> appropriate measures. When the plugin can avoid working through, say,
> a file API that protects against misuse by using the internal file
> functions, this is a much more difficult issue to mitigate.
The key point is precisely, how do you ensure they can only call your API?