Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82065
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.53 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXYzs=5FVF_OXFj+o=S1uq_7fhfMH7Ent9FHfd-ziV_W5Q@mail.gmail.com>
References: <CAGa2bXYzs=5FVF_OXFj+o=S1uq_7fhfMH7Ent9FHfd-ziV_W5Q@mail.gmail.com>
Date: Sat, 7 Feb 2015 04:46:09 +0900
Message-ID: <CAGa2bXb5pvKwS01YWk28EePLr9TH3pkra_DndxdBYy-u8R6mRw@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0160c7107d6345050e70aef0
Subject: Re: [RFC][DISCUSSION] Introduce scrpt_path
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e0160c7107d6345050e70aef0
Content-Type: text/plain; charset=UTF-8

Hi all,

On Fri, Feb 6, 2015 at 9:02 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> This RFC was renamed from "script() and script_once()".
> Original proposal had defect. It wasn't perfect.
>
> This RFC proposes "script_path" INI directive to eliminate
> file/script inclusion at all via require().
>
> https://wiki.php.net/rfc/script_path
>
> It's work in progress, but I would like to start discuss.
>
>
I would like to know your preference. Multiple choices are OK ( +1 / -1 )
Comments are appreciated.

1. script_path INI. (Defines script path. Almost perfect solution with
upload_path INI) [1]

2. upload_path INI. (Exception path in script_path. Protection against
require('../../upload/evil');) [1]

3. require_embed INI (Enable/disable require()/require_once() embed(script
only) mode. Temp INI) [2]

4. script()/script_once() [3]  (No INI switch. Read only scripts. The same
as require()/require_once(), require_embed=On )

5. Leave as it is now (No protection against file inclusion & execution
attacks.)


[1] script_path defines script directory, upload_path defines exceptions
under script_path.
[2] require_embed is not described in current RFC. It's INI for
enable/disable script only mode.
require_embed should be REMOVED few years later.
[3] script/script_once is not described in current RFC. It read/execute
script only file.

Thank you!

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e0160c7107d6345050e70aef0--