Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:26335 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 67746 invoked by uid 1010); 5 Nov 2006 05:51:56 -0000 Delivered-To: ezmlm-scan-internals@lists.php.net Delivered-To: ezmlm-internals@lists.php.net Received: (qmail 67731 invoked from network); 5 Nov 2006 05:51:56 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 5 Nov 2006 05:51:56 -0000 Authentication-Results: pb1.pair.com header.from=stas@zend.com; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=stas@zend.com; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain zend.com designates 212.25.124.162 as permitted sender) X-PHP-List-Original-Sender: stas@zend.com X-Host-Fingerprint: 212.25.124.162 mail.zend.com Linux 2.5 (sometimes 2.4) (4) Received: from [212.25.124.162] ([212.25.124.162:63091] helo=mail.zend.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 43/10-00849-8FB7D454 for ; Sun, 05 Nov 2006 00:51:56 -0500 Received: (qmail 5930 invoked from network); 5 Nov 2006 05:50:24 -0000 Received: from unknown (HELO ?127.0.0.1?) (192.168.2.101) by internal.zend.office with SMTP; 5 Nov 2006 05:50:24 -0000 Message-ID: <454D7BE9.7040004@zend.com> Date: Sat, 04 Nov 2006 21:51:37 -0800 Organization: Zend Technologies User-Agent: Thunderbird 1.5.0.7 (Windows/20060909) MIME-Version: 1.0 To: Peter Brodersen CC: Rasmus Lerdorf , internals@lists.php.net References: <454C5E50.4030108@zend.com> <454CFAA1.10104@lerdorf.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [PHP-DEV] allow_url_include and php:/data: From: stas@zend.com (Stanislav Malyshev) > Would requests to a smbserver, e.g. > \\10.20.30.40\evil\malicious_php_code.txt be prevented as well? It > seems like smbserver requests are regarded as part of the default > filesystem wrapper. Good point. Generally I'd say it belongs to the OS, but I'm not sure if you can restrict this from OS side? -- Stanislav Malyshev, Zend Products Engineer stas@zend.com http://www.zend.com/