Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:27536
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain googlemail.com designates 66.249.92.175 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=googlemail.com; s=beta;
        h=received:message-id:date:from:reply-to:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=Iftwz1uIGi+XFH7Hvnf9MSZldyPNl2IRGQ2Wpe67t6iemWOIU2SYtDJ7VYRuqyKsnurFWx9RghpANVZFs9caDRkWSBPolf6SLLxJUmDGH15m+oyb95Pfqdu1GLVK9xo/VutN90spV9b4/wLVCCtzpr7rc6+jfRiWS6qqriIe+Fk=
Message-ID: <10845a340701190034y54d4a7fbhea323c5901355e77@mail.gmail.com>
Date: Fri, 19 Jan 2007 08:34:42 +0000
Reply-To: RQuadling@GoogleMail.com
To: "PHP Internals" <internals@lists.php.net>
In-Reply-To: <45AFDACB.4040007@php.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <45AD76C3.5030303@php.net>
	 <84D1223A-9B47-4076-B1AE-85659525C21D@bitxtender.com>
	 <45AFDACB.4040007@php.net>
Subject: Re: [PHP-DEV] allow_url_fopen / allow_url_include and fine grained control
From: rquadling@googlemail.com ("Richard Quadling")

Sort of thinking out loud and not really sure if this is possible, but
if a wrapper is NOT present (specifically denied) in allow_url_fopen,
but "user" is present, could a user defined wrapper emulate the
missing one, thereby bypassing the restriction?

On 18/01/07, Sara Golemon <pollita@php.net> wrote:
> > I assume this would also mean all userland stream wrappers become is_url=1?
> >
> > Anyway, +1.
> >
> This patch, by itself, doesn't affect the is_urlness of userspace
> wrappers.  Whether or not we change their designation is up to a
> separate concensus (I'm in favor of it for the record).
>
> Funnily enough though, Pierre and I were just discussing the problem of
> userspace wrappers.  Specifying all potential userspace wrapper names in
> a whitelist style allow_url_fopen setting isn't realistic, so we thought
> it might be a good idea to add a sort of "meta-wrapper" name to be used
> in the whitelist style.  e.g.   allow_url_fopen=file,http,ftp,user
> would allow those first three wrappers explicitly by name, plus any
> userdefined wrapper (regardless of specific name).  For completeness, we
> might also add a metawrapper called "internal" for "All non-userspace
> based wrappers", though the specific usefulness of that is a little more
> iffy...
>
> -Sara
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>


-- 
-----
Richard Quadling
Zend Certified Engineer : http://zend.com/zce.php?c=ZEND002498&r=213474731
"Standing on the shoulders of some very clever giants!"