Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:16914
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <42BF9A46.4060108@ohgaki.net>
Date: Mon, 27 Jun 2005 15:18:46 +0900
User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317)
MIME-Version: 1.0
To: Stefan Esser <sesser@php.net>
CC: messju mohr <messju@lammfellpuschen.de>, 
	Matthew Charles Kavanagh <matthew@teh.ath.cx>,
	internals@lists.php.net
References: <42BDDC82.6020208@ohgaki.net> <01.6A.54439.491DEB24@pb1.pair.com> <20050626164101.GA11586@dune> <42BEE432.6090307@teh.ath.cx> <20050626175638.GB11586@dune> <42BEEED1.6010602@php.net>
In-Reply-To: <42BEEED1.6010602@php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Re: allow_url_fopen should be INI_ALL
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

I think most of us can agree following statement

"allow_url_fopen = ON" is dangerous and the feature is not
useful most of the times.

Stefan Esser wrote:
>> It's not stupid to prevent them from being made. But that's not what
>> an admin does. When the admin comes into play, the application is
>> already "made" and employed. The admin just prevents it from working
>> as the
>> developer and the qa-team intended.
> 
> 
> The admin is deciding what is allowed on his system and what not. Any
> application that cannot deal with different setups is simply broken.
> 
> Same for register_globals/magic_quotes_gpc. If your application does not
> behave in the same way with any of these features turned on or off, it
> is simply broken.

I think you missed my point.

- allow_url_fopen is ON by default.
- allow_url_fopen is INI_SYSTEM directive (i.e. Cannot change this setting from script)

Obviously, current setting is not secure than

- allow_url_fopen = OFF
- allow_url_fopen = INI_ALL

Later setting is more secure and one can use allow_url_fopen feature when it is needed.

-- 
Yasuo Ohgaki