Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:16904
Return-Path: <johannes@php.net>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 41632 invoked by uid 1010); 26 Jun 2005 08:20:12 -0000
Delivered-To: ezmlm-scan-internals@lists.php.net
Delivered-To: ezmlm-internals@lists.php.net
Received: (qmail 41617 invoked from network); 26 Jun 2005 08:20:12 -0000
Received: from unknown (HELO php.net) (127.0.0.1)
  by localhost with SMTP; 26 Jun 2005 08:20:12 -0000
X-Host-Fingerprint: 82.165.35.142 thinkforge.org Linux 2.4/2.6
Received: from ([82.165.35.142:6947] helo=mail.mayflowersystem.com)
	by pb1.pair.com (ecelerity 1.2 r(5656M)) with SMTP
	id E4/F1-22648-B356EB24 for <internals@lists.php.net>; Sun, 26 Jun 2005 04:20:11 -0400
Received: (qmail 24056 invoked by uid 60010); 26 Jun 2005 08:20:07 -0000
Received: from 82.135.71.14 by mail (envelope-from <johannes@php.net>, uid 89) with qmail-scanner-1.24 
	(uvscan: v4.3.20/v4362. spamassassin: 2.63.  
	Clear:RC:1(82.135.71.14):. 
	Processed in 0.502751 secs); 26 Jun 2005 08:20:07 -0000
Received: from unknown (HELO ?192.168.1.102?) (schlueter@mayflower.de@82.135.71.14)
	by 0 with (RC4-MD5 encrypted) SMTP; 26 Jun 2005 08:20:06 -0000
To: internals@lists.php.net
Date: Sun, 26 Jun 2005 10:19:09 +0200
User-Agent: KMail/1.8
References: <42BDDC82.6020208@ohgaki.net>
In-Reply-To: <42BDDC82.6020208@ohgaki.net>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-2022-jp"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-ID: <200506261019.09608.johannes@php.net>
Subject: Re: [PHP-DEV] allow_url_fopen should be INI_ALL
From: johannes@php.net (Johannes Schlueter)

Hi,
On Sunday 26 June 2005 00:36, Yasuo Ohgaki wrote:
> I would like to see these changes in PHP 5.1 and PHP 4.4, since this
> is security related changes.

Right, it's a security related thing: Only the administrator can decide wether 
any application should be able to do url_fopens or not. If an application 
needs it the administrator can check it and enable it by host/directory.

johannes