Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82062
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.171 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXZVR05OAjO3m17g4Ef23Bu+cS_Cu=UGYezrKfLNdK2heQ@mail.gmail.com>
References: <CAGa2bXYzs=5FVF_OXFj+o=S1uq_7fhfMH7Ent9FHfd-ziV_W5Q@mail.gmail.com>
 <CAPwsocGzVu2s9YMTE3qZGtUaUzOmZc9BPs_cfGwOy0AaONGGLg@mail.gmail.com> <CAGa2bXZVR05OAjO3m17g4Ef23Bu+cS_Cu=UGYezrKfLNdK2heQ@mail.gmail.com>
Date: Sat, 7 Feb 2015 04:11:56 +0900
Message-ID: <CAGa2bXbZtKP7NxnfrTHrhU2ZZcFy3NdZakjC9XeSaNHe9YuJGQ@mail.gmail.com>
To: Leigh <leight@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113a304e1e0090050e703440
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Introduce scrpt_path
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a113a304e1e0090050e703440
Content-Type: text/plain; charset=UTF-8

Hi Leigh,

On Sat, Feb 7, 2015 at 3:46 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

>
>>
>> I think this is a better solution than script{,_once}. I definitely
>> prefer it over the previous RFC
>
>
> I thought script()/script_once() is enough, but it's not.
> There are modules uses custom script loaders, including phar. Those loader
> may do whatever they want, therefore detecting/deciding file type (i.e.
> PHP script)
> by file content is wrong.
>

If parser state is used, script() solution would work and may remove
script_path.
Then it's possible try to read files as PHP script by require() excluding
upload_path/open_basedir/OS restriction. I think this is acceptable.

Please note that OS solution does not help to prevent PHP from reading
uploaded
script.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a113a304e1e0090050e703440--