Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:16960
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
	s=dog; d=crynwr.com;
	b=lM2gCyk94dcnvfi2dRHTQhtlyQ7iCzikcFCgjPE4Kl4U6dV9SGRL3E3wRKvU9icR  ;
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <17089.18702.450236.614561@desk.crynwr.com>
Date: Tue, 28 Jun 2005 08:56:46 -0400
To: internals@lists.php.net
In-Reply-To: <42C0F4DA.4000605@php.net>
References: <42BDDC82.6020208@ohgaki.net>
	<17088.52397.92440.326561@desk.crynwr.com>
	<42C0CF76.6090203@lerdorf.com>
	<42C0F4DA.4000605@php.net>
Subject: Re: [PHP-DEV] allow_url_fopen should be INI_ALL
From: nelson@crynwr.com (Russell Nelson)

Stefan Esser writes:
 > I agree with Rasmus. Remote URL Includes are dieing out.

That's not what Rasmus said.

 > Most released advisories are SQL Injections nowadays and well maybe
 > Russells next mail says: mysql_query() considered harmful.

When the top Google result for 'php security flaw' returns
mysql_query() instead of include(), I will agree that you are correct.

 > Ohhh btw Russell, if you really consider include harmful, then simply 
 > install the Hardening-Patch for PHP and live with it.

I'm not trying to fix this for me.  Clearly there are at least a
half-dozen things I could do to fix the problem for myself[!].  I
believe that the problem's cause is the design of the language
intrinsic.  Therefore, fixing the problem for myself doesn't address
the cause of the problem.  It just prevents me from seeing the problem
anymore.  The problem is still there.

[!] The first six:
 1) rm -rf php
 2) don't allow my users access to php.
 3) audit all code written by my users.
 4) turn allow_url_fopen off.
 5) install Hardening.
 6) write my own patch removing url_fopen capability from 'include'.

-- 
--My blog is at     blog.russnelson.com         | If you want to find
Crynwr sells support for free software  | PGPok | injustice in economic
521 Pleasant Valley Rd. | +1 315-323-1241       | affairs, look for the
Potsdam, NY 13676-3213  |                       | hand of a legislator.