Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83430
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.48 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <c48headlmkkhe2dc6jjflahdejl104044s@4ax.com>
References: <CAGa2bXZ_Q4Ytz5HgcmBoKNPzUaCh6vLETkyyd-jVsR9df60RPg@mail.gmail.com>
 <c48headlmkkhe2dc6jjflahdejl104044s@4ax.com>
Date: Sun, 22 Feb 2015 06:18:59 +0900
Message-ID: <CAGa2bXYjADF6GGWqrf7MmMA7aXA9ZSUR_cwVz4ufAsPMRGmuTw@mail.gmail.com>
To: Jan Ehrhardt <phpdev@ehrhardt.nl>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113aa7d21114a0050f9fba60
Subject: Re: [PHP-DEV] Re: [RFC] [FINAL DISCUSSION] Script only include/require
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a113aa7d21114a0050f9fba60
Content-Type: text/plain; charset=UTF-8

Hi Jan,

On Sun, Feb 22, 2015 at 12:33 AM, Jan Ehrhardt <phpdev@ehrhardt.nl> wrote:

> Yasuo Ohgaki in php.internals (Sat, 21 Feb 2015 10:06:24 +0900):
> >I think this will be the final discussion before vote.
> >This RFC is to make PHP stronger against script inclusion attacks just
> like
> >other languages.
> >
> >https://wiki.php.net/rfc/script_only_include
> >
> >I hope everyone will like this proposal.
>
> Am I correct in assuning that files with extensions like .inc, .install,
> .module will not be included by default anymore if this RFC is accepted?
> And that only a change in the php.ini can make those files includable?
>
> Drupal uses files like these, even in Drupal 8 beta. Would not that be a
> big obstacle for installing Drupal, especially at shared hosters where
> the user has no control over php.ini?
>

I forgot to write INI type.
The INI is INI_ALL, so users may use any filename extensions.

I added.

Thank you.

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a113aa7d21114a0050f9fba60--