Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:61966
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain richgray.com from 209.85.212.176 cause and error)
Message-ID: <501A9A1A.5090809@richgray.com>
Date: Thu, 02 Aug 2012 17:17:46 +0200
Reply-To: rich@richgray.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:14.0) Gecko/20120713 Thunderbird/14.0
MIME-Version: 1.0
To: Ferenc Kovacs <tyra3l@gmail.com>
CC: Lester Caine <lester@lsces.co.uk>, 
 "internals@lists.php.net" <internals@lists.php.net>
References: <501A69B4.4040401@lsces.co.uk> <501A73B8.3030009@richgray.com> <CAH-PCH7wvanKkS=f=sMfQk2y9wRnHK8XVkr1+Vj+ge96cervnA@mail.gmail.com>
In-Reply-To: <CAH-PCH7wvanKkS=f=sMfQk2y9wRnHK8XVkr1+Vj+ge96cervnA@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] register_globals work arounds
From: rich@richgray.com (rich gray)

On 02/08/2012 15:56, Ferenc Kovacs wrote:
>
>
> On Thu, Aug 2, 2012 at 2:34 PM, rich gray <rich@richgray.com 
> <mailto:rich@richgray.com>> wrote:
>
>
>     On 02/08/2012 13:51, Lester Caine wrote:
>
>         OK
>
>
>     IMO - this should be posted on PHP general not internals -- have
>     you tried extract() ?
>     http://fr2.php.net/extract
>
>     Rich
>
>
> unconditionally extracting variables from user-controller arrays into 
> the current/global scope was really a bad decision, if you don't know 
> why, pls. check the documentation ( 
> http://php.net/manual/en/security.globals.php )
> one could use extract() to simulate the behavior of register_globals, 
> but with that you would be vulnerable to the same attack vectors, so 
> we shouldn't support that imo.
> for a long term fix, one has to read through all of the codebase, 
> discover the implicit references of the global variables (this is one 
> of the many problems with register_globals) and replace them with 
> explicit references.
> so in this example:
> <?php
> include './bootstrap.php';
> if($admin){
>
> }
> else{
>
> }
>
> one has to discover where does the $admin variable come from, and 
> replace it with $_SESSION['admin'] for example
> it is a painful process and can't really be automated. :(
>

I agree using extract() is bad as was register_globals but (as I read 
his original post) he wanted a solution to simulate register_globals = 1 
and I gave it to him - still not sure why this is being discussed on 
internals but hey...