Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:55828 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 47595 invoked from network); 16 Oct 2011 23:56:08 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 16 Oct 2011 23:56:08 -0000 Authentication-Results: pb1.pair.com header.from=pierre.php@gmail.com; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=pierre.php@gmail.com; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.42 as permitted sender) X-PHP-List-Original-Sender: pierre.php@gmail.com X-Host-Fingerprint: 209.85.213.42 mail-yw0-f42.google.com Received: from [209.85.213.42] ([209.85.213.42:52154] helo=mail-yw0-f42.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 3A/6B-07463-51F6B9E4 for ; Sun, 16 Oct 2011 19:56:06 -0400 Received: by ywt32 with SMTP id 32so420191ywt.29 for ; Sun, 16 Oct 2011 16:56:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=REXi/UejYuatnU/GTjBPuf9hMIXEZOEJqPK8aOvKLGg=; b=RN86nMd054lhJOeNnhlGLZGdFb41I4lB1Z6SzCwIcZtUoHR9iHcCh0f0hIXldsiWw4 rEk0y3QxgeaDAErF3YI+i3GONm1QXfSAO0zwI46M5VpWzIz0NEwbYy69wYYM+nhyBlex ii1H/YhCQ4V7EFBEI6mgLTKH5RrHRDtS6BzVg= MIME-Version: 1.0 Received: by 10.236.177.66 with SMTP id c42mr23242452yhm.14.1318809362363; Sun, 16 Oct 2011 16:56:02 -0700 (PDT) Received: by 10.147.170.17 with HTTP; Sun, 16 Oct 2011 16:56:02 -0700 (PDT) In-Reply-To: <4E9B61EC.3090604@sugarcrm.com> References: <4E969596.4090704@akbkhome.com> <4E970257.2010906@sugarcrm.com> <4E977A4B.4020609@akbkhome.com> <4E977D07.4010503@lerdorf.com> <4E9A1E93.6050804@sugarcrm.com> <4E9B2D02.2080206@sugarcrm.com> <4E9B61EC.3090604@sugarcrm.com> Date: Mon, 17 Oct 2011 01:56:02 +0200 Message-ID: To: Stas Malyshev Cc: Rasmus Lerdorf , Alan Knowles , "internals@lists.php.net" Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [PHP-DEV] is_a fix for 5.4 and HEAD From: pierre.php@gmail.com (Pierre Joye) On Mon, Oct 17, 2011 at 12:59 AM, Stas Malyshev wrote: > Yes, the security problem was present before the fix was applied No, it was not. See the examples in the links I pasted earlier. The code was safe, under controlled context, before this change has applied. With the change the code becomes unsafe under uncontrolled context. That's not acceptable and besides the BC break, it introduce a security flaw. As stated many times, by many persons, in the previous discussion(s). Cheers, -- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org