Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83880
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.179 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <54EEDE8E.6070201@gmail.com>
References: <CAGa2bXbt9FAdRtW1GxDyT+G-4bWBACTso_DOizcSHmmgmSVtmA@mail.gmail.com>
	<CAGa2bXb5QEKOggRbUnmVHuib=P_tJ9_W+QyMa_SCpc7RmSCgSA@mail.gmail.com>
	<54EE50CF.9090508@gmail.com>
	<CALwr1GmoAxfbKvJYVLeL3wPXEKKbu1jKGkTFcG0KQ_Ogx172sA@mail.gmail.com>
	<54EE5A39.9040401@gmail.com>
	<CAGa2bXYWQCZA8_-EpQcb_Af7DT-_FV7HdfAHZrVt4V7i7vEURg@mail.gmail.com>
	<54EEDE8E.6070201@gmail.com>
Date: Thu, 26 Feb 2015 09:49:48 +0000
Message-ID: <CALwr1Gmac2SA_1S9_OfThtzSQdWDyL-Qtjs0H5RzVjS4xZhrMA@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Re: [RFC][VOTE] Introduce script only include/require
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi Yasuo,

On 26 February 2015 at 08:51, Stanislav Malyshev <smalyshev@gmail.com> wrot=
e:
> Hi!
>
>> This can be prevented by restricting phar archive name or forbid all
>> URI name at all. The latter is better choice.
>
> If by "all uri" you mean all streams, that would be very high burden,
> which may break many applications using streams, including phar handling.
>
>> There is design problem obviously. The reason why phar:// is allowed is
>> that "allow_url_include" is not INI_ALL.
>
> The reason why phar is allowed is because phar is not a remote stream,
> so access to phar is the same as access to local file system, which is
> necessary for include anyway. The contents of phar is in the same domain
> as contents of local filesystem, that's why no distinction is made.
>

Agreeing with Stanislav on this one. While it may appear attractive to
limit the phar: protocol, it's a fairly vital extension of the
filesystem that we should be wary of tampering with.

It would probably be more productive to clarify the status of phar:
URLs in the docs for allow_url_include, if only to emphasise that it's
not covered by that setting.

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com