Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83382
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.175 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZ_Q4Ytz5HgcmBoKNPzUaCh6vLETkyyd-jVsR9df60RPg@mail.gmail.com>
References: <CAGa2bXZ_Q4Ytz5HgcmBoKNPzUaCh6vLETkyyd-jVsR9df60RPg@mail.gmail.com>
Date: Sat, 21 Feb 2015 08:18:45 +0000
Message-ID: <CALwr1GkH6QhbtVoF-61jZqsqPrcfedg5KXRxz6o5Mt3r-h0xQQ@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [RFC] [FINAL DISCUSSION] Script only include/require
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Does this have any impact on allow_url_include or has that setting
been retained?

Yes, folk do indeed try to do this, for example hitting up Google:
http://www.quora.com/Why-do-include-and-require_once-not-work-with-remote-f=
iles

Paddy

On 21 February 2015 at 01:06, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi all,
>
> I think this will be the final discussion before vote.
> This RFC is to make PHP stronger against script inclusion attacks just li=
ke
> other languages.
>
> https://wiki.php.net/rfc/script_only_include
>
> I hope everyone will like this proposal.
> Thank you all who have participated to discussions.
>
> Those who are not involved, this is the time to check this RFC.
>
> Thank you.
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net



--=20

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative