Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72462
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.169 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXZCBxJczqX6FKz0T0_iV9LzdeHkw46c17NQsanuCCJ9rA@mail.gmail.com>
References: <CAGa2bXYU0+eVgnDCkqpG6AWvLCX9gV3+5nzoeD-RJge8Rtw-dQ@mail.gmail.com>
 <CAGa2bXZCBxJczqX6FKz0T0_iV9LzdeHkw46c17NQsanuCCJ9rA@mail.gmail.com>
Date: Wed, 12 Feb 2014 03:11:03 +0900
Message-ID: <CAGa2bXZikjBa_-pG-VcKswfRQo8Faz_aFEJnDyDCwheJ793Jpw@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0160b61890008d04f2256317
Subject: Re: [RFC] No PHP tags
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e0160b61890008d04f2256317
Content-Type: text/plain; charset=UTF-8

Hi all,

Let me rephrase more accurately. Does anyone argue that following fact is
debatable?

Local script inclusion is *much grater security threat* than local script
expose.

"Local script expose" is the only drawback of this RFC.
Currently, insecure include()/require() allows script execution.
With this RFC, insecure include()/require() may allow script expose.

If users care to script expose, they can simply add "<?php" at the top of
script
as it is now if script contains security sensitive data.
(Correction: Script expose could not be obvious.)

We can make secure program with register_globals=On as well as embed
everything by default. The same argument applies here. IMHO.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net


On Wed, Feb 12, 2014 at 2:42 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> Let me rephrase. Does anyone argue that the fact
>
> Local script inclusion is *much grater security threat* than local script
> expose.
>
> "Local script expose" is the only drawback of this RFC.
> Currently, insecure include()/require() allows script execution.
> With this RFC, insecure include()/require() may allow script expose.
>
> Latter is obvious error as it shows wrong behavior while script execution
> is
> not obvious at all. If user care to script expose, they can simply add
> "<?php"
> at the top of script as it is now.
>
> We can make secure program with register_globals=On as well as embed
> everything by default. The same argument applies here. IMHO.
>
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>
>
> On Mon, Feb 10, 2014 at 4:35 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
>> Hi all,
>>
>> "Optional PHP tags by php.ini and CLI options" RFC has been discussed
>> very long time.
>>
>> https://wiki.php.net/rfc/nophptags
>>
>> I would like to know is there anyone who would like not to have
>> this. I think it's good counter measure for LFI, but you might have
>> different perspective.
>>
>> If it is possible, I would like to address as much as opinions possible
>> before voting.
>>
>> Are there anyone who think we should have this?
>> What is the reason?
>>
>> Thank you
>>
>> --
>> Yasuo Ohgaki
>> yohgaki@ohgaki.net
>>
>>
>

--089e0160b61890008d04f2256317--