Re: [RFC][DISCUSSION] Remove allow_url_include INI
| From: | Stanislav Malyshev | Date: | Sat, 28 Feb 2015 04:53:16 +0000 |
| Subject: | Re: [RFC][DISCUSSION] Remove allow_url_include INI | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-84067@lists.php.net to get a copy of this message | ||
Hi!
> I have no intention to change current include/require syntax, except adding
> 2nd parameter.
This is a bit misleading since include is not a function, so there's no
1st parameter. Instead, it's a syntax construct. Of course, syntax
construct's grammar can be changed, though I'm not sure if that wouldn't
lead to unexpected effects in the parser. But maybe not.
Bigger issue is that if somebody is knowledgeable enough in security to
go and change their code to use this option, why they aren't
knowledgeable enough to fix their includes so this option is not required?
--
Stas Malyshev
smalyshev@gmail.com