Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:43975
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain pooteeweet.org from 88.198.8.16 cause and error)
Cc: Michael Shadle <mike503@gmail.com>,
 Nathan Rixham <nrixham@gmail.com>,
 PHP Development <internals@lists.php.net>
Message-ID: <C74C4F67-7603-4A6F-82D0-AF3D10665AD1@pooteeweet.org>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
In-Reply-To: <4A0D2648.3050802@lerdorf.com>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v935.3)
Date: Fri, 15 May 2009 10:32:07 +0200
References: <bd9320b30905141018q1ebeb994t9676d4d5085a0d6b@mail.gmail.com>	 <4A0C9516.8060808@gmail.com> <bd9320b30905141733l424179eak67bd287fc134a74d@mail.gmail.com> <4A0D2648.3050802@lerdorf.com>
Subject: Re: [PHP-DEV] Re: Why does $_REQUEST exist?
From: mls@pooteeweet.org (Lukas Kahwe Smith)


On 15.05.2009, at 10:22, Rasmus Lerdorf wrote:

> Michael Shadle wrote:
>> On Thu, May 14, 2009 at 3:03 PM, Nathan Rixham <nrixham@gmail.com>  
>> wrote:
>>
>>> bc? all the reasoning in the world won't justify it to 1 million  
>>> businesses
>>> running php 4 code which is reliant on $_REQUEST behind the scenes.
>>>
>>> although it would generate a tonne of freelance work :p
>>
>> that code has to change for 5.3 or 6.0 anyway.
>>
>> now is the time to yank out some of the legacy crap. we don't want  
>> PHP
>> to be like windows, do we?
>
> The more stuff like this we remove, the harder it becomes for people  
> to
> quickly move to newer, faster and more secure versions of PHP.  That
> causes way more frustration for everyone than a few "ugly" legacy
> features.  If there is a decent technical reason, performance or
> security, then we need to take a hard look at it.  In this case, the
> thing we should be looking at isn't whether we should remove $_REQUEST
> but whether we should remove cookie data from it.  Many configurations
> already do that, including all of my own, and there is a strong valid
> security reason for not including cookies in $_REQUEST.  Most people  
> use
> $_REQUEST to mean GET or POST, not realizing that it could also  
> contain
> cookies and as such bad guys could potentially do some cookie  
> injection
> tricks and break naive applications.


Its already fixed in 5.3. There is a new ini option that defines what  
should go into $_REQUEST. See the following blog post for details:
http://www.suspekt.org/2008/10/01/php-53-and-delayed-cross-site-request-forgerieshijacking/

Also a lot of work was put into restructuring the php.ini files we  
ship with PHP.

regards,
Lukas Kahwe Smith
mls@pooteeweet.org