Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:27582
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain googlemail.com designates 66.249.92.171 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=googlemail.com; s=beta;
        h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=n6kB6+L+hp3kk/dlItFD3xgD2wHwjc4N/nTrCadh+VFpquU+Yops6TFLPtQAkLvLXdyt13dkFjQRXjG6eCdelnDAx4OJFemcHgG1dv/ZoIMCHprqgkXRV6efVGC1y8pe719bpPM1hMkHz6WH8q3fFLY+7msPQOHak6E2KspdNn8=
Message-ID: <10845a340701220324k66be2ecaiedc94051956d1176@mail.gmail.com>
Date: Mon, 22 Jan 2007 11:24:11 +0000
Reply-To: RQuadling@GoogleMail.com
To: ceo@l-i-e.com
Cc: "Sara Golemon" <pollita@php.net>, internals@lists.php.net
In-Reply-To: <62752.209.254.223.2.1169444659.squirrel@www.l-i-e.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <45AD76C3.5030303@php.net>
	 <62752.209.254.223.2.1169444659.squirrel@www.l-i-e.com>
Subject: Re: [PHP-DEV] allow_url_fopen / allow_url_include and fine grained control
From: rquadling@googlemail.com ("Richard Quadling")

Hmm. Yes. I see. Moot indeed.

On 22/01/07, Richard Lynch <ceo@l-i-e.com> wrote:
> On Tue, January 16, 2007 7:07 pm, Sara Golemon wrote:
> > allow_url_fopen and allow_url_include continue to accept boolean flags
> > in order to behave just as they do now:   true/on allows anything,
> > false/off allows only those wrappers without the is_url bit set.
>
> +1, fwiw.
>
> As far as the "user" being able to implement something otherwise
> dis-allowed...
>
> Well, yeah, they could.
>
> I'm not sure who would really turn off an internal wrapper, then turn
> on "user" then be upset that somebody coded a work-around for a
> blocked internal wrapper...  I mean, that just seems like an unlikely
> real-world sequence of events, in any decent work-place...
>
> I suppose if it's the case of malicious code getting executed, there'd
> be a point, but really, once you have arbitrary malicious PHP code
> getting executed on your box, it's kind of moot if they can then
> download more PHP code to execute, isn't it?...
>
> --
> Some people have a "gift" link here.
> Know what I want?
> I want you to buy a CD from some starving artist.
> http://cdbaby.com/browse/from/lynch
> Yeah, I get a buck. So?
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>


-- 
-----
Richard Quadling
Zend Certified Engineer : http://zend.com/zce.php?c=ZEND002498&r=213474731
"Standing on the shoulders of some very clever giants!"