Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:83966 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 84937 invoked from network); 27 Feb 2015 06:59:54 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 27 Feb 2015 06:59:54 -0000 Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.49 as permitted sender) X-PHP-List-Original-Sender: yohgaki@gmail.com X-Host-Fingerprint: 209.85.216.49 mail-qa0-f49.google.com Received: from [209.85.216.49] ([209.85.216.49:47050] helo=mail-qa0-f49.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 7A/C2-32582-9E510F45 for ; Fri, 27 Feb 2015 01:59:54 -0500 Received: by mail-qa0-f49.google.com with SMTP id w8so11443239qac.8 for ; Thu, 26 Feb 2015 22:59:51 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=6iZqeSczN5bOThdUV9RRf653f1z7V+R6VeE2lYQJFiM=; b=1F+wzHbkHJdeQDQdeM65Jh8BE4VZ6aovBs3/Qe9S5iIBM0vs+1KxoI2S2G+4kyNVGm Bc41cawrgfPfpqv4gn0NEhtUCEpyftN7h3BLJfiGc/fHmztnhvOLcO3hLsBA3u4qdBAV s4vEHbrlNos8NpdL8ocaCJ91O3XMUOK53D/WeGeCPi1lPmPsM9JdWX1MAwZLWx4Ar5o3 JmZMABxv0f6fhMOao6HQOU0D7HGBLkLL9JpvnwMWNWa52JQ/jnv8jh1XUvZl+q6ZRJju Gswg2DNUQ9hmgl/iEhGBBwRno68LYSy+DqtRmPvzauTA6SwTtJAHRxfsYTN0WoU+U9yC FAWw== X-Received: by 10.229.111.197 with SMTP id t5mr2577665qcp.18.1425020391616; Thu, 26 Feb 2015 22:59:51 -0800 (PST) MIME-Version: 1.0 Sender: yohgaki@gmail.com Received: by 10.229.198.8 with HTTP; Thu, 26 Feb 2015 22:59:11 -0800 (PST) In-Reply-To: References: Date: Fri, 27 Feb 2015 15:59:11 +0900 X-Google-Sender-Auth: __Ayu9kGnKUMQE3AymzYdz2IJEA Message-ID: To: Xinchen Hui Cc: "internals@lists.php.net" Content-Type: multipart/alternative; boundary=001a11334ada3d74ed05100c6a23 Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI From: yohgaki@ohgaki.net (Yasuo Ohgaki) --001a11334ada3d74ed05100c6a23 Content-Type: text/plain; charset=UTF-8 Hi Xinchen, On Fri, Feb 27, 2015 at 3:55 PM, Xinchen Hui wrote: > hmm, does that means, if this RFC won't pass, then script only include > RFC should also be rejected? > > if yes, then maybe you should put them together? > Sorry I just sent previous mail before your mail. We need to fix this regardless of https://wiki.php.net/rfc/script_only_include If we have both, we close the door for "arbitrarily script execution". (I mean almost the same as other language level) Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net --001a11334ada3d74ed05100c6a23--