Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82061
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.42 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAN=kQJcmBQZr4nabAUoiASymb8eJxZV6d+RODcPwoNUf3_VG9A@mail.gmail.com>
References: <CAGa2bXYzs=5FVF_OXFj+o=S1uq_7fhfMH7Ent9FHfd-ziV_W5Q@mail.gmail.com>
 <CAN=kQJcmBQZr4nabAUoiASymb8eJxZV6d+RODcPwoNUf3_VG9A@mail.gmail.com>
Date: Sat, 7 Feb 2015 04:02:20 +0900
Message-ID: <CAGa2bXa8pEaChqVt1LuJUXMq92kiGtXQG0z9gubRoOpHNu-4hw@mail.gmail.com>
To: Matthew Leverton <leverton@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e014953ecbccf44050e7011a1
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Introduce scrpt_path
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e014953ecbccf44050e7011a1
Content-Type: text/plain; charset=UTF-8

Hi Matthew,

On Sat, Feb 7, 2015 at 1:45 AM, Matthew Leverton <leverton@gmail.com> wrote:

> On Fri, Feb 6, 2015 at 6:02 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> > https://wiki.php.net/rfc/script_path
> >
> > It's work in progress, but I would like to start discuss.
> >
>
> I don't really like it; but I don't really like most INI-based solutions.
>

One possible alternative is use of parser state and use only upload_path.
This way, we can remove one INI.


>
> I agree that this is a problem with poorly written code, but at the
> same time I don't know that a good solution is to compensate in this
> regard. Bad programmers will always be bad programmers. Now we're
> giving them a crutch that almost encourages unchecked includes by
> relying on an INI configuration. What happens if you are using
> multiple libraries and they are each overriding their (and your)
> settings? It just feels messy.
>

Basically, it's administrative solution. Application should set these
setting
or administrator should.

Library shouldn't touch the setting, otherwise they hit their own foot.


>
> The same thing could be accomplished config-less with a callback
> system that is triggered on script includes (if any callback returns
> false, an error is thrown), but I think I'd dislike that for similar
> reasons.


If upload path is located under docroot, we must use per dir INI and set

engine=off

This requires administrative task (or Apache should enable .htaccess)
Unlike upload_path, this couldn't prevent PHP from loading like

require('../../upload/evilfile');

Since my goal is to make PHP as secure as other languages, this case
may be ignored.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e014953ecbccf44050e7011a1--