Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82059
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.43 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAPwsocGzVu2s9YMTE3qZGtUaUzOmZc9BPs_cfGwOy0AaONGGLg@mail.gmail.com>
References: <CAGa2bXYzs=5FVF_OXFj+o=S1uq_7fhfMH7Ent9FHfd-ziV_W5Q@mail.gmail.com>
 <CAPwsocGzVu2s9YMTE3qZGtUaUzOmZc9BPs_cfGwOy0AaONGGLg@mail.gmail.com>
Date: Sat, 7 Feb 2015 03:46:20 +0900
Message-ID: <CAGa2bXZVR05OAjO3m17g4Ef23Bu+cS_Cu=UGYezrKfLNdK2heQ@mail.gmail.com>
To: Leigh <leight@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1133c9629103a6050e6fd8b0
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Introduce scrpt_path
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a1133c9629103a6050e6fd8b0
Content-Type: text/plain; charset=UTF-8

Hi Leigh,

On Fri, Feb 6, 2015 at 9:53 PM, Leigh <leight@gmail.com> wrote:

> On 6 February 2015 at 12:02, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> > Hi all,
> >
> > This RFC was renamed from "script() and script_once()".
> > Original proposal had defect. It wasn't perfect.
> >
> > This RFC proposes "script_path" INI directive to eliminate
> > file/script inclusion at all via require().
> >
> > https://wiki.php.net/rfc/script_path
>
> Couple of fixes and questions
>


> > Introduce script_path and download_path
> > Introduce script_path INI that specify directories that execution is
> allowed and upload_path
>
> Change download_path to upload_path.
>

Yes, I'll fix it.


>
> > PHP script detection by file content is **NOT** impossible
> > Therefore, PHP script detection by file content is impossible.
>
> I assume that you want to say impossible in both places?
>

Yes


>
> > include()/require() is source of file/script inclusion for a long time
> > Only require()/require_once() is affected.
>
> Is this on purpose? Is there a reason that include is not affected?
>

include()/require() supports URI include. This is the reason why.


>
> I think this is a better solution than script{,_once}. I definitely
> prefer it over the previous RFC


I thought script()/script_once() is enough, but it's not.
There are modules uses custom script loaders, including phar. Those loader
may do whatever they want, therefore detecting/deciding file type (i.e. PHP
script)
by file content is wrong.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a1133c9629103a6050e6fd8b0--