Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83968
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain zend.com designates 209.85.217.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXaudhgyTDP0fg3Dc_B5J8NwmS_gKdyRZWQdwN1d-YXejA@mail.gmail.com>
References: <CAGa2bXYf7Bi1QPya96t0Z3cQkTWBCOG2p2gCLZSUTY=_gNp_kw@mail.gmail.com>
 <CABBJUpeVhLu31cpUncJo-uvf2C=gYQ5C1DA+bGJeUg7ta0sxtA@mail.gmail.com> <CAGa2bXaudhgyTDP0fg3Dc_B5J8NwmS_gKdyRZWQdwN1d-YXejA@mail.gmail.com>
Date: Fri, 27 Feb 2015 15:45:48 +0800
Message-ID: <CABBJUpc7yQyZZqqVVHOp3GFVqa_TWcWXAxZstTnKaapi2dtO9w@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI
From: laruence@php.net (Xinchen Hui)

Hey:

On Fri, Feb 27, 2015 at 2:59 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi Xinchen,
>
> On Fri, Feb 27, 2015 at 3:55 PM, Xinchen Hui <laruence@php.net> wrote:
>>
>> hmm, does that means, if this RFC won't pass, then script only include
>> RFC should also be rejected?
>>
>> if yes, then maybe you should put them together?
>
>
> Sorry I just sent previous mail before your mail.
>
> We need to fix this regardless of
> https://wiki.php.net/rfc/script_only_include
> If we have both, we close the door for "arbitrarily script execution".
> (I mean almost the same as other language level)
>

Sorry, but I am confused by the point, do you want to disable include
a remote php file or not?

if yes, how about with allow_url_fopen?

eval(file_get_contents(http://xxxxxx/));

thanks
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net



-- 
Xinchen Hui
@Laruence
http://www.laruence.com/