note 51011 added to features.remote-files

"It's important to understand that remote files included/required into your script are NOT run on your server (as previous posts have suggested). " WRONG. (this killed us our rootserver, and some CERTs have it published like http://www.heise.de/newsticker/meldung/51838) this is actually the greatest security hole in php and I want it FIXED. atleast change the PHP_INI_ALL of allow_url_fopen to PHP_INI_SYSTEM or something like that. currently it is something like that: ini_set( allow_url_fopen, "1"); include($_GET["i_am_remotecontrolled"]); and every customer on our rootserver can bring in his hacking-kit. luckily we have nearly no customers who are able to have their own scripts. ---- Manual Page -- http://www.php.net/manual/en/features.remote-files.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+51011 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+51011&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+51011&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+51011&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+51011&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+51011&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+51011&report=yes Search -- http://master.php.net/manage/user-notes.php