Re: Two SOAP Issues

> On Mon, 18 Mar 2002 10:26:18 -0800, Dietrich Ayala wrote: > > >The first version of the server required that the user call a method that > >'registered' each function to be exposed as a service. > >The server would then deny requests for functions that weren't > >'registered'. This wasn't very popular, I got lots of requests to not > >make this mandatory. > > > >I think that it should be mandatory by default in PEAR, and maybe have > >a class level variable in the server to toggle it. > > +1. > > IMO it should be PEARs aim to be as secure as possible concerning such > topics. Exposing *every* function via SOAP by default can soon lead > into security holes and that's not what PEAR is intended to ;-). > > - Martin > > -- > Martin Jansen, <mail@martin-jansen.de> > http://www.martin-jansen.de/ I agree. In my opinion only user-defined functions should be allowed to be called. If people want to get their boxes rooted or thrashed, they have the option of extending classes at their site. I have not gotten to play with SOAP (although I bathe daily) but I do not think the intent is to allow native functions to be called. Regards, Brian Abent