Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82466
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lsces.co.uk from 217.147.176.214 cause and error)
Message-ID: <54DB2B54.9010307@lsces.co.uk>
Date: Wed, 11 Feb 2015 10:13:40 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: internals@lists.php.net
References: <CAGa2bXZsANJz_RvsBvC9yBhac+ukHYUngA=GjLOgcqTTPbpGhg@mail.gmail.com> <alpine.DEB.2.11.1502110932570.5941@whisky.home.derickrethans.nl>
In-Reply-To: <alpine.DEB.2.11.1502110932570.5941@whisky.home.derickrethans.nl>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Script only includes
From: lester@lsces.co.uk (Lester Caine)

On 11/02/15 09:34, Derick Rethans wrote:
>> Some of you are tired with this topic, but please take a look the RFC
>> > 
>> > [RFC] Script only includes - this is 3rd version.
>> > https://wiki.php.net/rfc/script_only_include
>> > 
>> > Please let me know what you like or dislike.
> Con:
> - It introduces an INI option that changes PHP's behaviour. 
> - How do you know what is a PHP script? Surely not be checking that the 
>   first 4 chars are "<?php" ?

First 5? ...

Yasuo ... I don't think this is going in the right direction. The
principals are right, but we have been through a lot of this trying to
secure included files in the past and nothing has worked yet. I don't
think that anything implemented in a PHP distribution will change what
is happening in practice?

-- 
Lester Caine - G8HFL
-----------------------------
Contact - http://lsces.co.uk/wiki/?page=contact
L.S.Caine Electronic Services - http://lsces.co.uk
EnquirySolve - http://enquirysolve.com/
Model Engineers Digital Workshop - http://medw.co.uk
Rainbow Digital Media - http://rainbowdigitalmedia.co.uk