Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83758
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.45 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <54ED9B5F.60006@lsces.co.uk>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com>
 <CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com>
 <CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com>
 <CALwr1Gmmy06_4ZgsvUhcf5m7g06vK2s18qmxKBv1gu+syrsbQA@mail.gmail.com>
 <54ECD4E3.9040705@gmail.com> <CALwr1GkY_8TN-HwXnRNL0-1oRfQPJvz0_vyJv_ojUTVsFbkNTQ@mail.gmail.com>
 <54ECF605.7030506@gmail.com> <CALwr1GkU_mumpp-34Pp=gKwZzL3KVEW7JpEnqC5MMtcgM_qEbA@mail.gmail.com>
 <CA+kxMuT-jQaT9xyk9dmONdpTz-h0LfWcvu_-caibjvu3XmQuTw@mail.gmail.com>
 <54ED8E9F.80803@lsces.co.uk> <CAGa2bXYMPE7jP3=U7Frp+D9eC_Q-CQxo6Tkh3EDrJHQk5V-aRw@mail.gmail.com>
 <54ED9B5F.60006@lsces.co.uk>
Date: Wed, 25 Feb 2015 19:07:05 +0900
Message-ID: <CAGa2bXYUNWWCYqw8fqtRFn=zWn8SZF9gFPUCcLvsQ6aXHew1CQ@mail.gmail.com>
To: Lester Caine <lester@lsces.co.uk>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a114322388f9491050fe6ceed
Subject: Re: [PHP-DEV] [RFC] Script only include/require
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a114322388f9491050fe6ceed
Content-Type: text/plain; charset=UTF-8

Hi Lester,

On Wed, Feb 25, 2015 at 6:52 PM, Lester Caine <lester@lsces.co.uk> wrote:

> Totally understand what you are trying to do, and if the users you are
> trying to protect actually downloaded PHP direct from the PHP site it
> may stand a chance of actually doing that, but it's adding restrictions
> that WILL break other distributions so either they have to re-work what
> they do, or switch it off anyway. The people you are trying to protect
> are going to be downloading a distribution that may well be using
> 'obvious mistakes' such as .inc or .php5 in addition to .php
>
> There have been attempts in the past to make 'script only' files and and
> these same sort of restrictions, but the fallout did prove more of a
> problem. Example ... one of the legacy sites I just had to move stopped
> doing any of the navigation stuff and would not send a contact email.
> Was working fine previously ... but when I actually started looking at
> the code strangely the pages were all .html ... yep ... a complex site
> with lots of content which had originally been hand coded and at some
> point a few little bits of php had been added in. My nginx setup had
> disabled processing .html pages so broken site. I don't want to rename
> all of the files to .php ... I don't need to ... so I've created a
> php-fpm for .html only and we are working again. Only a few hours wasted
> but the sort of thing we have to be able to cope with!
>

I understand people do all kinds of things.
Therefore, I'm allowing

ini_set('zend.script_extension', ''); // Disable protections at all.

It's users choice if they use systematically secure configuration or not.
However, providing systematically secure method/configuration is our
responsibility. IMHO.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a114322388f9491050fe6ceed--