Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57212
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <4F04BCF9.30802@lerdorf.com>
References: <CABBJUpc7T2QZm8QiitQ0wZ5RsY=3Jwy_UERSvLT9unNYtJ1mZA@mail.gmail.com>
	<CABBJUpcVkYwU4zN0dG2b+jYkppnY9HR8wm7FV0tnmGt6ky5wQg@mail.gmail.com>
	<CABBJUpeN4iJ6mVUKEEz8qxY25zxTmwg8EigpsmxnZGz5xshMhw@mail.gmail.com>
	<4F048A03.4070408@sugarcrm.com>
	<CAH-PCH69gV88qnQ7OHhGHSt70oD7f9Z_HCFD7dfW6SmBR6z2tQ@mail.gmail.com>
	<4F04A172.7080509@sugarcrm.com>
	<CAH-PCH5BUsrXKLtk6JWCOA8d5+2DxSke3UAnbBraJyGP-YnQnA@mail.gmail.com>
	<4F04AA8E.6020701@sugarcrm.com>
	<CAH-PCH6YH3ZxH5XzEm6+gsikaHjyL-pdHyAs=OnFhWqHk0CctQ@mail.gmail.com>
	<4F04AD6D.80608@php.net>
	<CAF+90c-6XrWJnL4vOQjjPm=N=fWrMy31wHOeXGccv+KRq5DrVw@mail.gmail.com>
	<4F04B071.8080102@php.net>
	<CAKxcST9NhATxVLrOVP9h2Qy9GfuuzreeVMBtH0EqdZf7jPhytg@mail.gmail.com>
	<4F04B44D.6080208@thelounge.net>
	<4F04BCF9.30802@lerdorf.com>
Date: Wed, 4 Jan 2012 22:01:01 +0100
Message-ID: <CAH-PCH5NLbDH9K3abJ70Z0AMjfwRNcjk5xE6aSs4cvpBR2_k5Q@mail.gmail.com>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
Cc: Reindl Harald <h.reindl@thelounge.net>, internals@lists.php.net
Content-Type: multipart/alternative; boundary=00235429e0b8fb462e04b5ba1c3f
Subject: Re: [PHP-DEV] Re: another fix for max_input_vars.
From: tyra3l@gmail.com (Ferenc Kovacs)

--00235429e0b8fb462e04b5ba1c3f
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Jan 4, 2012 at 9:56 PM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:

> On 01/04/2012 12:19 PM, Reindl Harald wrote:
> >
> >
> > Am 04.01.2012 21:07, schrieb Paul Dragoonis:
> >
> >> I agree with Rasmus here. A lot of people keep display_errors
> >> on, even when they shouldn't.
> >
> > it is not the job of a programming language stop admins from
> > beeing stupid - the defaults have to be sane and this is
> > display_error OFF, if somebody decides for whateever reason to turn
> > it on it is not yours or anybody others decision to ignore the
> > setting here, and there and there also but there not
>
> Yes, but display_errors is not off by default, that is the problem. If
> we could get away with turning display_errors off by default, then I
> agree that we don't need this. As it is currently, the default setup,
> if people don't do anything, will result in a security problem because
> of this.
>
> -Rasmus
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>
I just got the tip that this error is only shown if display_startup_errors
is set to true, and because it is in the startup routine the file path in
the error message (which is the real infoleak) would only point to "unknown
0".
If somebody has the time to double check/test this, it would be nice.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--00235429e0b8fb462e04b5ba1c3f--