Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83714
Return-Path: <smalyshev@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 85841 invoked from network); 24 Feb 2015 23:06:09 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 24 Feb 2015 23:06:09 -0000
Authentication-Results: pb1.pair.com smtp.mail=smalyshev@gmail.com; spf=pass; sender-id=pass
Authentication-Results: pb1.pair.com header.from=smalyshev@gmail.com; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.173 as permitted sender)
X-PHP-List-Original-Sender: smalyshev@gmail.com
X-Host-Fingerprint: 209.85.192.173 mail-pd0-f173.google.com  
Received: from [209.85.192.173] ([209.85.192.173:39467] helo=mail-pd0-f173.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 21/9B-24698-DD30DE45 for <internals@lists.php.net>; Tue, 24 Feb 2015 18:06:08 -0500
Received: by pdjy10 with SMTP id y10so214816pdj.6
        for <internals@lists.php.net>; Tue, 24 Feb 2015 15:06:02 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=message-id:date:from:user-agent:mime-version:to:cc:subject
         :references:in-reply-to:content-type:content-transfer-encoding;
        bh=TsaYLu2gK+5LNlNiLrzjiH3OaLMwjtYhr++c8oshtLM=;
        b=l8PgdGmexis8q6Ca1OExwEnGlp3sT0npk8tHNtH2tQtMXW4tkvMtlbF4eqrmRRBhaL
         2INZFdCU++v6kXSXMAfp/ARYHhOGz61jjF0jvhUhvT97+GOc55EM3mwuzMTxbZHPVyKY
         iIWAHJ8SaagGfCj52y4LDh/86UXUVSWSif5hVFQvjRt0XtF2WrjUIxUKpGKUVvVSfjNS
         imVxUVr/NRc6b280xSM6oHBA+Z7QADd51q5cK3ejA7a1ID6v0qg1uVuudoa57PXbcsEf
         53G3mA/6VokAVTWDCsqfma7HxIIEPLSVPskHSItkvzBOPX5A2wJH0RA0EOksPgMt22Ct
         fPow==
X-Received: by 10.68.110.1 with SMTP id hw1mr454655pbb.46.1424819162212;
        Tue, 24 Feb 2015 15:06:02 -0800 (PST)
Received: from Stas-Air.local (108-66-6-48.lightspeed.sntcca.sbcglobal.net. [108.66.6.48])
        by mx.google.com with ESMTPSA id gt10sm35796593pac.32.2015.02.24.15.06.01
        (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Tue, 24 Feb 2015 15:06:01 -0800 (PST)
Message-ID: <54ED03D9.3040804@gmail.com>
Date: Tue, 24 Feb 2015 15:06:01 -0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
CC: =?UTF-8?B?UMOhZHJhaWMgQnJhZHk=?= <padraic.brady@gmail.com>, 
 Dmitry Stogov <dmitry@zend.com>,
 "internals@lists.php.net" <internals@lists.php.net>, 
 Nikita Popov <nikitappv@gmail.com>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com> <CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com> <CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com> <CALwr1Gmmy06_4ZgsvUhcf5m7g06vK2s18qmxKBv1gu+syrsbQA@mail.gmail.com> <54ECD4E3.9040705@gmail.com> <CALwr1GkY_8TN-HwXnRNL0-1oRfQPJvz0_vyJv_ojUTVsFbkNTQ@mail.gmail.com> <54ECF605.7030506@gmail.com> <CAGa2bXZGp5fxu1mPa8bYYSZoxnwpd7Uzq6Be7x3K3HRQxeENPg@mail.gmail.com> <54ECFBA7.7080404@gmail.com> <CAGa2bXZf3Njqf6VWLbmZvsg=rL7x95HPFc3uJC+sySFRiXpbvg@mail.gmail.com>
In-Reply-To: <CAGa2bXZf3Njqf6VWLbmZvsg=rL7x95HPFc3uJC+sySFRiXpbvg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] Script only include/require
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> require('cuteponies.gif) wouldn't work with this RFC.
> move_uploaded_files() prohibits uploading PHP script. 

You seem not to be reading the scenario. The include URL would be
phar://cuteponies.gif/pwnd.php and the uploaded file would be
cuteponies.gif. Your protection would not stop moving .gif file, and
your filename check would pass phar://cuteponies.gif/pwnd.php since it
ends in .php.
-- 
Stas Malyshev
smalyshev@gmail.com