Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:58912
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain webstart.fr from 209.85.210.46 cause and error)
MIME-Version: 1.0
In-Reply-To: <4F5D3569.8050307@sugarcrm.com>
References: <CAOfKkdQMOgxBmKSo3DHaJZeHFe4fAOzg8a7amA9_--1=CeSBjA@mail.gmail.com>
	<4F5C5540.8010204@sugarcrm.com>
	<CAORXhG+=Tpzad-OxdWNcZdjvJDrF7jVOtiQ9PGvymL9HQAFEwA@mail.gmail.com>
	<4F5D3569.8050307@sugarcrm.com>
Date: Tue, 13 Mar 2012 08:32:35 -0400
Message-ID: <CAOfKkdTJSiFajM5SgfVhoYwE6NRo1D8G0Tv=jiRS5Wky4VDwkA@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: Tom Boutell <tom@punkave.com>, Internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] CURL file posting
From: pierrick@webstart.fr (Pierrick Charron)

We could add a flag to disable the @ usage but I'm against having the
'@' usage disabled by default. This BC break would be in my opinion
too big.

An other solution would be to have something like (We will also have
to add the type and filename support to this solution so this is just
a first proposal) :

curl_setopt($curl_handle, CURLOPT_HTTPPOSTFIELDS, array(
    'firstname' => 'pierrick',
    'lastname' => array(CURL_FORMSTR, 'charron'),
    'lastname' => array(CURL_FORMFILE, '/home/pierrick/picture.png')
);

Pierrick





Otherwise the safest way for people is to use http_build_query on
their parameter array.

Pierrick

On 11 March 2012 19:29, Stas Malyshev <smalyshev@sugarcrm.com> wrote:
> Hi!
>
>> I'd sure like a PHP extension that didn't have this obvious and nasty bug:
>>
>> https://bugs.php.net/bug.php?id=46439
>
>
> This doesn't look good. Documentation does say the @ prefix exists, but it
> has very high potential of creating security holes for unsuspecting people.
> open_basedir would help limit the impact, but still it's not a good thing.
> Any ideas on fixing it without breaking the BC?
> --
> Stanislav Malyshev, Software Architect
> SugarCRM: http://www.sugarcrm.com/
> (408)454-6900 ext. 227
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>