Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:83879 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 65558 invoked from network); 26 Feb 2015 09:48:40 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 26 Feb 2015 09:48:40 -0000 Authentication-Results: pb1.pair.com smtp.mail=php@beccati.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=php@beccati.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain beccati.com designates 176.9.114.167 as permitted sender) X-PHP-List-Original-Sender: php@beccati.com X-Host-Fingerprint: 176.9.114.167 spritz.beccati.com Received: from [176.9.114.167] ([176.9.114.167:53549] helo=mail.beccati.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id A1/00-65287-5FBEEE45 for ; Thu, 26 Feb 2015 04:48:39 -0500 Received: (qmail 16895 invoked from network); 26 Feb 2015 09:41:51 -0000 Received: from home.beccati.com (HELO ?192.168.1.202?) (88.149.176.119) by mail.beccati.com with SMTP; 26 Feb 2015 09:41:51 -0000 Message-ID: <54EEEA57.8060602@beccati.com> Date: Thu, 26 Feb 2015 10:41:43 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 MIME-Version: 1.0 To: Yasuo Ohgaki , "internals@lists.php.net" References: In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [PHP-DEV] [RFC][VOTE] Introduce script only include/require From: php@beccati.com (Matteo Beccati) Hi Yasuo, I have voted no, as I believe too that the change will give a false sense of security. In my past experience, numerous exploited applications I've seen had php scripts (php-shells or just outputting malicious code) dropped to the file system and most of the times the extension was ".php". Cheers On 25/02/2015 23:06, Yasuo Ohgaki wrote: > Hi all, > > Vote for script only include/require RFC is started. > This RFC closes one of the fatal security hole in PHP programs with > simple patch. > > https://wiki.php.net/rfc/script_only_include > https://github.com/php/php-src/pull/1111 > Vote ends 2015/3/12 > > It seems there are misunderstandings about the issue and the protection. > If you would like to vote "no", please read the RFC carefully. > If you find fatal reason to reject this RFC, it is about arbitrarily code > execution > and file exposure, so please let us know the reason why. > > If you have question, please ask. > > Thank you for voting. > > -- > Yasuo Ohgaki > yohgaki@ohgaki.net > -- Matteo Beccati Development & Consulting - http://www.beccati.com/