Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:53933
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <4E1DC072.8080300@sugarcrm.com>
References: <4E17F5A0.3070409@sugarcrm.com>
	<BC37F785-39A7-4A38-ADBD-482C7D87438B@roshambo.org>
	<4E1B9343.3090000@sugarcrm.com>
	<967B58EB-C704-40CD-AFEE-D0CA2192F4FA@roshambo.org>
	<4E1DC072.8080300@sugarcrm.com>
Date: Wed, 13 Jul 2011 20:11:16 +0200
Message-ID: <CAH-PCH7=08Pqq=5-Z5BA1wpc8sXcS20ohmsq8FGnDm-yQGqbyQ@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: Philip Olson <philip@roshambo.org>, PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [VOTE] 5.4 features vote
From: tyra3l@gmail.com (Ferenc Kovacs)

On Wed, Jul 13, 2011 at 5:57 PM, Stas Malyshev <smalyshev@sugarcrm.com> wro=
te:
> Hi!
>
> On 7/13/11 8:55 AM, Philip Olson wrote:
>>
>> But this topic (removing magic quotes from 5.4) was not proposed on
>> this list, so the vote feels premature. The only related RFC on the
>> matter involves PHP 6, and it isn't specific to MQ. Granted we all
>> don't like MQ, but this "security" feature is enabled by default
>> today so skipping discussion to a simple vote for removal feels
>> wrong.
>
> It was proposed 2 weeks ago, along with other items. If you have anything=
 to
> add now, please do so.

for the record, we had a lenghtly discussion back in november:
http://www.mail-archive.com/internals@lists.php.net/msg48407.html

the general reception was toward removing it for 5.4, but there were
serious concerns about removing it also.
I would also change my vote, I would go with keeping it deprecated,
but turning it off by default (currently it isn't done, but the
suggested development/production inis have this turned off), and
remove it with the next minor version bump.
if we have minor releases in the same timeframe as between 5.3 and
5.4, I'm fine with this.
hopefully the security documentation will be in the better shape and
we can figure out how to communicate such changes better to minimalize
the impact.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu