Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:65013
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain webstart.fr from 74.125.82.172 cause and error)
MIME-Version: 1.0
In-Reply-To: <50EBE585.80709@sugarcrm.com>
References: <50E90DD1.7040204@sugarcrm.com>
	<CAOfKkdTAV9qY_sxzORzhBjH0kRbkJr8XF+sU5eik=SGw582Nng@mail.gmail.com>
	<50EA6DD3.1040401@sugarcrm.com>
	<CAOfKkdSMgVGpKbkzwG4kNaJRbk9kZsc14z2Cs4CB9B1rAAs=9g@mail.gmail.com>
	<50EBE585.80709@sugarcrm.com>
Date: Thu, 17 Jan 2013 13:42:57 -0500
Message-ID: <CAOfKkdQ+OYe7tTQik5-XCXo9MyauWh0EnC-uf=eyX-wOi7xeyQ@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading
From: pierrick@webstart.fr (Pierrick Charron)

Hi Stas,

What's the status of this fix ?

Thanks
Pierrick

On 8 January 2013 04:23, Stas Malyshev <smalyshev@sugarcrm.com> wrote:
> Hi!
>
>> Looks good to me, just it could be great to add a new cURL option at
>> the same time to disable the '@' usage so that someone working with
>> the new ext/curl version can disable it and therefore send values
>> starting by @
>
> That is a good suggestion, I'll add CURL_SAFE_POSTFIELDS which would
> disable the @ option.
>
> --
> Stanislav Malyshev, Software Architect
> SugarCRM: http://www.sugarcrm.com/
> (408)454-6900 ext. 227