Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81891
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.44 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAPwsocGh_-SYiWceEg=5go8G1bUs+CWUBb9uv_2Oh7AZhBxd8A@mail.gmail.com>
References: <CAGa2bXZMxxXBOQ=NdbNtzgrjjvdomV8zOr+Z4zASZU4+JHmqyw@mail.gmail.com>
 <CAGa2bXbf=hzbZ9eH6JVnMM0+6OeTQvAoqBe44g8qxFAAr9u9Kw@mail.gmail.com>
 <CAG1choq8S_EkdS22SFO+443u_LYVB-Z-b2ra6RK8sDhrJKc-VQ@mail.gmail.com>
 <CAGa2bXbJyK=2GCmGDw7PAh0ib=EL9GO7FFGf0X6VyAWqfR8EAA@mail.gmail.com>
 <CADajX4CHHdSpUfLfjhwrtdzmJfg9di4FpfeVEzBG4P7K7B+e0w@mail.gmail.com> <CAPwsocGh_-SYiWceEg=5go8G1bUs+CWUBb9uv_2Oh7AZhBxd8A@mail.gmail.com>
Date: Thu, 5 Feb 2015 19:20:53 +0900
Message-ID: <CAGa2bXY36wVN50sQ=MTYi+X6664+NYqMhsYFVZ9jeFZ1DXBg9Q@mail.gmail.com>
To: Leigh <leight@gmail.com>
Cc: Adam Harvey <aharvey@php.net>, reeze <reeze@php.net>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c11a980e8cfd050e54aba9
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] script() and script_once()
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c11a980e8cfd050e54aba9
Content-Type: text/plain; charset=UTF-8

Hi Leigh,

On Thu, Feb 5, 2015 at 5:31 PM, Leigh <leight@gmail.com> wrote:

> On 5 February 2015 at 05:37, Adam Harvey <aharvey@php.net> wrote:
> > I'm not totally clear on what this RFC is proposing, honestly. Is the
> > new script statement meant to only include files that are entirely
> > wrapped in <?php and ?> tags? Are files included that way assumed to
> > be PHP and don't require <?php and ?> tags? Something else?
> >
>
> This is my initial reaction to the RFC, it doesn't state the
> _specific_ difference between include/script. I understand what was
> proposed in the nophptags RFC, but I have to make an assumption for
> this RFC.
>
> My assumption is that you want script* to not require <?php to begin
> parsing. i.e. including /etc/passwd would be a parse failure.


I'm proposing *SCRIPT* only inclusion. This can be done by

 - allowing "<?php" only at to top of script
 - not allowing "?>" anywhere (We may allow at the end possibly)

Those who do not understand my point.
Please search by "PHP LFI" or "PHP file inclusion" for real life
security issues.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c11a980e8cfd050e54aba9--