Re: [RFC][DISCUSSION] Remove allow_url_include INI
| From: | Yasuo Ohgaki | Date: | Fri, 27 Feb 2015 06:59:11 +0000 |
| Subject: | Re: [RFC][DISCUSSION] Remove allow_url_include INI | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-83966@lists.php.net to get a copy of this message | ||
Hi Xinchen,
On Fri, Feb 27, 2015 at 3:55 PM, Xinchen Hui <laruence@php.net> wrote:
> hmm, does that means, if this RFC won't pass, then script only include
> RFC should also be rejected?
>
> if yes, then maybe you should put them together?
>
Sorry I just sent previous mail before your mail.
We need to fix this regardless of
https://wiki.php.net/rfc/script_only_include
If we have both, we close the door for "arbitrarily script execution".
(I mean almost the same as other language level)
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net