Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:59844 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 70506 invoked from network); 13 Apr 2012 02:01:18 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 13 Apr 2012 02:01:18 -0000 Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.170 as permitted sender) X-PHP-List-Original-Sender: yohgaki@gmail.com X-Host-Fingerprint: 209.85.161.170 mail-gx0-f170.google.com Received: from [209.85.161.170] ([209.85.161.170:42224] helo=mail-gx0-f170.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 41/E3-00290-DE8878F4 for ; Thu, 12 Apr 2012 22:01:17 -0400 Received: by ggmb2 with SMTP id b2so1644066ggm.29 for ; Thu, 12 Apr 2012 19:01:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date :x-google-sender-auth:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=8bZNpNjo6JXOs2Mr/SbMBoSjfwosiTwujxvBqOSMnW0=; b=GwubKZp7mrNHI3aaYE2z4p7oouZkbfmct1OuxHZaAiibZhyDpnz69tNFi8cpPCIkfj OfyXDbkvtWSD77BDMDnJBlwstn6OexDeRDYyBfByvSc+A2w8N174AfO0itEZnBw3t59d rjdCOSFVzmUiRg0C2YPrAYDN7A4QJWNs6fffR8F64LA0JyAv/fc4+FoMChi+Z/FRHF9+ UdmwS7Ns+gH54NagZOiTpa8MGMGQL/VWYND84HRgHTyPVT2XDB5Kv0HVkgGqySt+RO7C 7J0mlxcz04hnNXVsSmsnysY2PgKZ5Xfes2Je7gbcn9cNKLBve51cbkwlN3jA4T0+TfB/ XNKQ== Received: by 10.236.195.34 with SMTP id o22mr140902yhn.75.1334282474794; Thu, 12 Apr 2012 19:01:14 -0700 (PDT) MIME-Version: 1.0 Sender: yohgaki@gmail.com Received: by 10.146.86.14 with HTTP; Thu, 12 Apr 2012 19:00:33 -0700 (PDT) In-Reply-To: References: <4F8539E0.1090701@sugarcrm.com> <4F859063.1010401@lerdorf.com> <4F862AAC.90003@lerdorf.com> <4F86761A.9010801@lsces.co.uk> <4F876E36.1020400@gmail.com> <4F87799D.4060601@sugarcrm.com> Date: Fri, 13 Apr 2012 11:00:33 +0900 X-Google-Sender-Auth: JbpMcB0hofHwSxTrf66ofJNcmrs Message-ID: To: Stas Malyshev Cc: PHP internals Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Subject: Re: [PHP-DEV] Re: Disabling PHP tags by php.ini and CLI options From: yohgaki@ohgaki.net (Yasuo Ohgaki) Hi, 2012/4/13 Yasuo Ohgaki : > Hi, > > 2012/4/13 Stas Malyshev : >> Hi! >> >>> If I exclude current code, then introducing script only include will be >>> preferred one. I preferred dedicated statement for it though. >>> >>> include >>> include_once >>> require >>> require_once >>> script >>> script_once >> >> I have a thought here. To implement script/script_once you don't need it >> to be a language construct. A function would do just as fine. Why not >> make an extension having these two functions, put it on PECL and see if >> people will be using it? >> For extreme adopters, you could even make php.ini switch that overrides >> include/require and redirects them to your script functions. Shouldn't >> be impossible to do, I think. > > Good idea. > > I think it's possible as a Zend engine module. It may be possible > as normal module if compiler hook can be used. I guess it is now. > > It provides optional security by accident. (Someone called =A0LFI syntax > error an accident and I like it) I wish the other RFC author > implement this. > > Regards, I just briefly read tokenizer code. We can simply scan tokens and validate then executes. So it's a very simple module to write. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net