Re: Re: cvs: pearweb /public_html/trackback trackback-admin.php

On Sat, 22 Oct 2005 01:46:52 -0400, Greg Beaver wrote: > Let me absolutely clear: there have been a large number of "fixing > broken commit" commit messages over the past 2-3 months in pearweb. > This is a pattern not specifically related to any one commit, otherwise > I would not mention it. Might be, I haven't noticed it that much, maybe my memory is failing me. > Even so, register_globals has been disabled in PHP by default since PHP > version 4.2, and the security problems with register_globals have been > known for several years. We have yet to have had an attack, as far as I > know. Doesn't mean all is fine, it was on in pearweb because it is a legacy code. > Why the sudden need to change the code without testing it? This is a > bogus argument. No code was changed actually, just php.ini option, the result was because of poorly written code, since we didn't have any test cases nor man power to prowl the whole web site on their own envs to locate all problems, then it was taken the route of of closing the holes and fixing a long the way, as far as I know and I noticed when Pierre changed the register globals off then he tried to fix as many issues as he could locate locally, so he tried, he asked me to test also but I didn't have time nor did I have a dev env up, tho I can't recall if he asked someone else or posted to the ML, think Martin was even online at the same time. > Committing code without testing it is asking for both fatal errors and > whole new security vulnerabilities. > > If it is too much to ask that we test code before committing, then I > suggest we take a SERIOUS look at our priorities. Nobody said people should commit with out testing, I'm just saying having a policy about this is nothing but stupid and drives people away. - Helgi