Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72496
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.182 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <52FB0920.8040903@lsces.co.uk>
References: <CAGa2bXYU0+eVgnDCkqpG6AWvLCX9gV3+5nzoeD-RJge8Rtw-dQ@mail.gmail.com>
 <CAGa2bXZCBxJczqX6FKz0T0_iV9LzdeHkw46c17NQsanuCCJ9rA@mail.gmail.com>
 <52FA67A4.3030708@lerdorf.com> <CAGa2bXaHTCx+8=BJH-L+KqANo9NtEML3cp2sJqgv1jmGLYXaGg@mail.gmail.com>
 <52FAB58E.3080701@lsces.co.uk> <CAGa2bXbSD2xnOfptvZZu5Bj-L1LV5n213xB5C=haAd1vX8dfog@mail.gmail.com>
 <52FB0920.8040903@lsces.co.uk>
Date: Wed, 12 Feb 2014 15:26:21 +0900
Message-ID: <CAGa2bXaGo-drN1FWS2wk50OgT-YNaRVdaHYThBYD8ZrqNuX0Eg@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e013c674e25abb104f22fa95f
Subject: Re: [PHP-DEV] Re: [RFC] No PHP tags
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e013c674e25abb104f22fa95f
Content-Type: text/plain; charset=UTF-8

Hi Lester,

On Wed, Feb 12, 2014 at 2:39 PM, Lester Caine <lester@lsces.co.uk> wrote:

> LFI is the one that will allow corrupted files containing .php tags to run
> if you have not taken care of them while they are being uploaded. ONLY
> permanently disabling embedding will guarantee that these files do not get
> accidentally loaded. i.e. 'changes the spirit of PHP too much' ...
>
> ----
>   function render_template($template, $template_vars) {
>     ini_set('template_mode', 'on'); // Older PHP ignores
>     include($template, $template_vars); // Or use any other method to
> render.
>
>     ini_set('template_mode', 'off'); // Older PHP ignores
>   }
> ----
>
> Simply pushes the problem around a little and still requires that
> '$template' does not point at a file that contains embedded nasties?
> include($template.'.php', $template_vars); does the job a lot easier?
>

Since current PHP has null byte attack protection,
this is good enough protection. I agree.

The objectives of this RFC is to make PHP as secure as other languages.
Other language
developers do the same silly mistakes, yet almost all of them were not
considered as
"critical security issues" unlike PHP. This is what I would like to change.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e013c674e25abb104f22fa95f--