Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83384
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.44 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CALwr1GkH6QhbtVoF-61jZqsqPrcfedg5KXRxz6o5Mt3r-h0xQQ@mail.gmail.com>
References: <CAGa2bXZ_Q4Ytz5HgcmBoKNPzUaCh6vLETkyyd-jVsR9df60RPg@mail.gmail.com>
 <CALwr1GkH6QhbtVoF-61jZqsqPrcfedg5KXRxz6o5Mt3r-h0xQQ@mail.gmail.com>
Date: Sat, 21 Feb 2015 18:52:07 +0900
Message-ID: <CAGa2bXa+kKCxRvTyAVED-h3NbnhC+Q0FuYS_tDOgK8nDdC4pcw@mail.gmail.com>
To: =?UTF-8?Q?P=C3=A1draic_Brady?= <padraic.brady@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11423caea83a80050f9621ef
Subject: Re: [PHP-DEV] [RFC] [FINAL DISCUSSION] Script only include/require
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11423caea83a80050f9621ef
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Padraic,

On Sat, Feb 21, 2015 at 5:18 PM, P=C3=A1draic Brady <padraic.brady@gmail.co=
m>
wrote:

> Does this have any impact on allow_url_include or has that setting
> been retained?
>
> Yes, folk do indeed try to do this, for example hitting up Google:
>
> http://www.quora.com/Why-do-include-and-require_once-not-work-with-remote=
-files
>

allow_url_include=3DOff is kept.

Attacker can easily place *.php files on remote servers.
I guess PHP also allows php://input without it, doesn't it?
php://input allows script execution via post.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11423caea83a80050f9621ef--