Newsgroups: php.internals,php.internals Path: news.php.net Xref: news.php.net php.internals:29638 php.internals:29640 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 84902 invoked by uid 1010); 21 May 2007 20:01:52 -0000 Delivered-To: ezmlm-scan-internals@lists.php.net Delivered-To: ezmlm-internals@lists.php.net Received: (qmail 84870 invoked from network); 21 May 2007 20:01:52 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 21 May 2007 20:01:52 -0000 Authentication-Results: pb1.pair.com header.from=ceo@l-i-e.com; sender-id=unknown Authentication-Results: pb1.pair.com smtp.mail=ceo@l-i-e.com; spf=permerror; sender-id=unknown Received-SPF: error (pb1.pair.com: domain l-i-e.com from 67.139.134.202 cause and error) X-PHP-List-Original-Sender: ceo@l-i-e.com X-Host-Fingerprint: 67.139.134.202 o2.hostbaby.com FreeBSD 4.7-5.2 (or MacOS X 10.2-10.3) (2) Received: from [67.139.134.202] ([67.139.134.202:2735] helo=o2.hostbaby.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 80/00-19007-5AAF1564 for ; Mon, 21 May 2007 16:01:44 -0400 Received: (qmail 93509 invoked by uid 98); 21 May 2007 20:01:38 -0000 Received: from 127.0.0.1 by o2.hostbaby.com (envelope-from , uid 1013) with qmail-scanner-2.01 (clamdscan: 0.88.7/3273. Clear:RC:1(127.0.0.1):. Processed in 0.071359 secs); 21 May 2007 20:01:38 -0000 Received: from localhost (HELO l-i-e.com) (127.0.0.1) by localhost with SMTP; 21 May 2007 20:01:38 -0000 Received: from 216.230.84.67 (SquirrelMail authenticated user ceo@l-i-e.com) by www.l-i-e.com with HTTP; Mon, 21 May 2007 15:01:38 -0500 (CDT) Message-ID: <51759.216.230.84.67.1179777698.squirrel@www.l-i-e.com> In-Reply-To: <7d5a202f0705181647r5dae4d46y3d95e320f47a9d34@mail.gmail.com> References: <464DCB8C.90803@chiaraquartet.net> <7d5a202f0705181647r5dae4d46y3d95e320f47a9d34@mail.gmail.com> Date: Mon, 21 May 2007 15:01:38 -0500 (CDT) To: "Cristian Rodriguez" Cc: internals@lists.php.net Reply-To: ceo@l-i-e.com User-Agent: Hostbaby Webmail MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal Subject: Re: [PHP-DEV] potential solution to user streams + allow_url_include=off From: ceo@l-i-e.com ("Richard Lynch") On Fri, May 18, 2007 6:47 pm, Cristian Rodriguez wrote: > 2007/5/18, Greg Beaver : > >> > include $_GET['dumb']; >> ?> >> > > What about permanently removing this (mis) "feature" ?? , Im yet to > hear any valid reason or example to continue to permit this remote > include thingy, all examples I have seen are bogus and broken.. does > anyone really think there are valid use cases ? (note that Im talking > about include* and require* only ;) ) There are some limited valid uses on an Intranet where a single master source of some high-level include files is maintained on a separate server... That's pretty trivial to work-around with rsync or similar, though, so I don't know that this is a deal-breaker for anybody... There are some folks who might have a valid white-list approach with PCRE for what they include, and pass it around as a variable, however. Especially those who are into highly-dynamic languages, with zillions of include files. I'm not sure how you'd get rid of only $_GET and friends but keep any regular old variables without something like the "taint" model that was proposed and, I think, still being worked on. -- Some people have a "gift" link here. Know what I want? I want you to buy a CD from some indie artist. http://cdbaby.com/browse/from/lynch Yeah, I get a buck. So?