Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83947
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.181 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXbt9FAdRtW1GxDyT+G-4bWBACTso_DOizcSHmmgmSVtmA@mail.gmail.com>
References: <CAGa2bXbt9FAdRtW1GxDyT+G-4bWBACTso_DOizcSHmmgmSVtmA@mail.gmail.com>
Date: Fri, 27 Feb 2015 10:30:25 +0900
Message-ID: <CAGa2bXbPM+txEWVtP5MTw773hVvDZOeZSpS-ObXZ-s7VaY9dcQ@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1136ef967bd473051007d29f
Subject: Re: [RFC][VOTE] Introduce script only include/require
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a1136ef967bd473051007d29f
Content-Type: text/plain; charset=UTF-8

Hi all,

On Thu, Feb 26, 2015 at 7:06 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Vote for script only include/require RFC is started.
> This RFC closes one of the fatal security hole in PHP programs with
> simple patch.
>
> https://wiki.php.net/rfc/script_only_include
> https://github.com/php/php-src/pull/1111
> Vote ends 2015/3/12
>
> It seems there are misunderstandings about the issue and the protection.
> If you would like to vote "no", please read the RFC carefully.
> If you find fatal reason to reject this RFC, it is about arbitrarily code
> execution
> and file exposure, so please let us know the reason why.
>
> If you have question, please ask.
>

I was thinking allow_url_include issue later, but it seems I have to now.
I've written new RFC to address this.

https://wiki.php.net/rfc/allow_url_include

I'll start discussion shortly. If you have comments, please do so here.
It's related to this RFC also.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a1136ef967bd473051007d29f--