Re: Re: [RFC] No PHP tags
| From: | Yasuo Ohgaki | Date: | Fri, 14 Feb 2014 01:01:35 +0000 |
| Subject: | Re: Re: [RFC] No PHP tags | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-72576@lists.php.net to get a copy of this message | ||
Hi Rasmus,
On Fri, Feb 14, 2014 at 9:00 AM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:
> Striving to make PHP more secure for neophyte developers is always a
> worthy goal, but it needs to be done in a way that doesn't make things
> worse. I think this particular approach would make things worse by
> needlessly complicating things.
>
I agree that needless complexity should be avoided.
Switching template mode on and off is tricky, although existing codes can be
secured without many lines of change. There are options for LFI mitigation.
There might be convincing solution. I cannot think of one now, though.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net