Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:64637
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain webstart.fr from 74.125.82.176 cause and error)
MIME-Version: 1.0
In-Reply-To: <50EA6DD3.1040401@sugarcrm.com>
References: <50E90DD1.7040204@sugarcrm.com>
	<CAOfKkdTAV9qY_sxzORzhBjH0kRbkJr8XF+sU5eik=SGw582Nng@mail.gmail.com>
	<50EA6DD3.1040401@sugarcrm.com>
Date: Mon, 7 Jan 2013 10:39:10 -0500
Message-ID: <CAOfKkdSMgVGpKbkzwG4kNaJRbk9kZsc14z2Cs4CB9B1rAAs=9g@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading
From: pierrick@webstart.fr (Pierrick Charron)

Looks good to me, just it could be great to add a new cURL option at
the same time to disable the '@' usage so that someone working with
the new ext/curl version can disable it and therefore send values
starting by @

Pierrick

On 7 January 2013 01:40, Stas Malyshev <smalyshev@sugarcrm.com> wrote:
> Hi!
>
> I've added the pull request for the CURLFile here:
> https://github.com/php/php-src/pull/255
>
> No procedural API yet, I'm not really sure if we need it, it's not that
> hard writing "new CurlFile()". But if needed I can add it there.
> Everybody please take a look and see if you notice any problems or
> missing stuff there. Tests are there and they pass for me :)
>
> --
> Stanislav Malyshev, Software Architect
> SugarCRM: http://www.sugarcrm.com/
> (408)454-6900 ext. 227