Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82127
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.50 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAN=kQJfi_stYqQEnvwcVYu1TmdT3fozewQZvKchWJi56Y3JGkA@mail.gmail.com>
References: <CAGa2bXYzs=5FVF_OXFj+o=S1uq_7fhfMH7Ent9FHfd-ziV_W5Q@mail.gmail.com>
 <CAN=kQJcmBQZr4nabAUoiASymb8eJxZV6d+RODcPwoNUf3_VG9A@mail.gmail.com>
 <CAGa2bXa8pEaChqVt1LuJUXMq92kiGtXQG0z9gubRoOpHNu-4hw@mail.gmail.com> <CAN=kQJfi_stYqQEnvwcVYu1TmdT3fozewQZvKchWJi56Y3JGkA@mail.gmail.com>
Date: Sun, 8 Feb 2015 18:03:06 +0900
Message-ID: <CAGa2bXYpEaM5uSWRX24jYG1zjeZ=JA8nvY19D6GABRWA-_FvqQ@mail.gmail.com>
To: Matthew Leverton <leverton@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0160c7107b88e5050e8fee6d
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Introduce scrpt_path
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e0160c7107b88e5050e8fee6d
Content-Type: text/plain; charset=UTF-8

Hi Matthew,

On Sat, Feb 7, 2015 at 5:29 AM, Matthew Leverton <leverton@gmail.com> wrote:

> On Fri, Feb 6, 2015 at 1:02 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> >
> > Basically, it's administrative solution. Application should set these
> > setting
> > or administrator should.
> >
> > Library shouldn't touch the setting, otherwise they hit their own foot.
> >
> If this was a PHP_INI_PERDIR setting, then I wouldn't really mind as much.
>
> But as PHP_INI_USER, I don't like it at all.


How about allow to set the ini only once during execution?

To all, please give some feedback. There is option 5(Leave as it is), too!

I would like to know your preference. Multiple choices are OK ( +1 / -1 )
Comments are appreciated.

1. script_path INI. (Defines script path. Almost perfect solution with
upload_path INI) [1]

2. upload_path INI. (Exception path in script_path. Protection against
require('../../upload/evil');) [1]

3. require_embed INI (Enable/disable require()/require_once() embed(script
only) mode. Temp INI) [2]

4. script()/script_once() [3]  (No INI switch. Read only scripts. The same
as require()/require_once(), require_embed=On )

5. Leave as it is now (No protection against file inclusion & execution
attacks.)


[1] script_path defines script directory, upload_path defines exceptions
under script_path.
[2] require_embed is not described in current RFC. It's INI for
enable/disable script only mode.
require_embed should be REMOVED few years later.
[3] script/script_once is not described in current RFC. It read/execute
script only file.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e0160c7107b88e5050e8fee6d--