Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82485
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.169 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXZsANJz_RvsBvC9yBhac+ukHYUngA=GjLOgcqTTPbpGhg@mail.gmail.com>
References: <CAGa2bXZsANJz_RvsBvC9yBhac+ukHYUngA=GjLOgcqTTPbpGhg@mail.gmail.com>
Date: Thu, 12 Feb 2015 02:43:46 +0900
Message-ID: <CAGa2bXYU-9fk7nRVe3+iBDnE2KjEmzXLJ0zZsqG39iuV0ZgERg@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c2d274029368050ed38ead
Subject: Re: [RFC][DISCUSSION] Script only includes
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c2d274029368050ed38ead
Content-Type: text/plain; charset=UTF-8

Hi all,

On Tue, Feb 10, 2015 at 9:52 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Some of you are tired with this topic, but please take a look the RFC
>
> [RFC] Script only includes - this is 3rd version.
> https://wiki.php.net/rfc/script_only_include
>
> Please let me know what you like or dislike.
>

This proposal has defect.
I was excluding old proposals and it turned out old proposal was better.
Thank you Stas.

There was proposal that limit script execution only for certain filename
extension(s).

Currently, PHP has text script and phar script loader. If we limit script
filenames,
then all users has to do is checking filename extensions.
We have null byte injection protection for filename already.

This would be the simplest and works well against script inclusion.

Comments are appreciated.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c2d274029368050ed38ead--