Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:26342
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 64.233.162.207 as permitted sender)
DomainKey-Status: good
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:in-reply-to:references:mime-version:content-type:message-id:cc:content-transfer-encoding:from:subject:date:to:x-mailer:sender;
        b=SYPL4i1GjugBoWo6kwNhAhyUBfIyGrXd+x+MXTy8JfLZBmXE/xzLfRKkUoe8kaoiPDX+N75OXfAnZhewkh5BY1TRT+hTBWo+9S+fL658ZdbAu7By4WaJdtaqCZGFNhgu0PgGqaPdrWCD8kqhbHh+1cEJnuZoHk5AMDikZoHnMXU=
In-Reply-To: <aqvpk2df25h8lc2s6326i8igoh20uj6q1v@4ax.com>
References: <454C5E50.4030108@zend.com> <454CFAA1.10104@lerdorf.com> <aqvpk2df25h8lc2s6326i8igoh20uj6q1v@4ax.com>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-ID: <1EA6BEDC-ED17-4FE7-BDB1-B5E5C4FC4BFB@prohost.org>
Cc: rasmus@lerdorf.com (Rasmus Lerdorf),
  <internals@lists.php.net>
Content-Transfer-Encoding: 7bit
Date: Sun, 5 Nov 2006 11:08:05 -0500
To: Peter Brodersen <penguin@php.net>
Sender: Ilia Alshanetsky <iliaal@gmail.com>
Subject: Re: [PHP-DEV] allow_url_include and php:/data:
From: ilia@prohost.org (Ilia Alshanetsky)

I think it'd be wrong to consider networked file system as non-local.  
Mostly because many times there are no ways to identify them reliable  
and the fact this is a perfectly valid usage that if disallowed by  
default would break a large number of applications.


On 4-Nov-06, at 4:12 PM, Peter Brodersen wrote:

> On Sat, 04 Nov 2006 12:40:01 -0800, in php.internals
> rasmus@lerdorf.com (Rasmus Lerdorf) wrote:
>
>> Yeah, we probably should.  Had a chat with Wez about it too.  Here is
>> the patch.  I think this catches the cases we are interested in:
>>
>>  http://lerdorf.com/php/is_url.diff
>>
>> If someone could doublecheck it against those attacks it would be  
>> helpful.
>
>
> Would requests to a smbserver, e.g.
> \\10.20.30.40\evil\malicious_php_code.txt be prevented as well? It
> seems like smbserver requests are regarded as part of the default
> filesystem wrapper.
>
> -- 
> - Peter Brodersen
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>

Ilia Alshanetsky