Re: [RFC][DISCUSSION] Script only includes
| From: | Patrick Schaaf | Date: | Wed, 11 Feb 2015 18:41:47 +0000 |
| Subject: | Re: [RFC][DISCUSSION] Script only includes | ||
| References: | 1 2 3 4 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-82488@lists.php.net to get a copy of this message | ||
Hi,
another one of my weird ideas: what about a script signing mode?
- ini setting containing a HMAC key
- first <?php tag in a file must then have a signature, a la
<?php:Base64encodedstring
- no parsing of files that fail the signature check
- (maybe optional) disabling of eval
Of course such an approach would need, in addition, a locally well defined
place from where updated code is distributed to production servers, which
would then need to implement the signing process. So it's only something
for sane larger shops with a good dev/production split.
best regards
Patrick