Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82041
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.179 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXYzs=5FVF_OXFj+o=S1uq_7fhfMH7Ent9FHfd-ziV_W5Q@mail.gmail.com>
References: <CAGa2bXYzs=5FVF_OXFj+o=S1uq_7fhfMH7Ent9FHfd-ziV_W5Q@mail.gmail.com>
Date: Fri, 6 Feb 2015 12:53:47 +0000
Message-ID: <CAPwsocGzVu2s9YMTE3qZGtUaUzOmZc9BPs_cfGwOy0AaONGGLg@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Introduce scrpt_path
From: leight@gmail.com (Leigh)

On 6 February 2015 at 12:02, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi all,
>
> This RFC was renamed from "script() and script_once()".
> Original proposal had defect. It wasn't perfect.
>
> This RFC proposes "script_path" INI directive to eliminate
> file/script inclusion at all via require().
>
> https://wiki.php.net/rfc/script_path

Couple of fixes and questions

> Introduce script_path and download_path
> Introduce script_path INI that specify directories that execution is allowed and upload_path

Change download_path to upload_path.

> PHP script detection by file content is **NOT** impossible
> Therefore, PHP script detection by file content is impossible.

I assume that you want to say impossible in both places?

> include()/require() is source of file/script inclusion for a long time
> Only require()/require_once() is affected.

Is this on purpose? Is there a reason that include is not affected?


I think this is a better solution than script{,_once}. I definitely
prefer it over the previous RFC