Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:84095
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.53 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXbt9FAdRtW1GxDyT+G-4bWBACTso_DOizcSHmmgmSVtmA@mail.gmail.com>
References: <CAGa2bXbt9FAdRtW1GxDyT+G-4bWBACTso_DOizcSHmmgmSVtmA@mail.gmail.com>
Date: Sun, 1 Mar 2015 13:29:50 +0900
Message-ID: <CAGa2bXZqqh2qF=x5gAVdWKwHugoi4x9rd0+WHxqcgLnm-auWOw@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a114596a8c95c7c0510328f20
Subject: Re: [RFC][VOTE] Introduce script only include/require
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a114596a8c95c7c0510328f20
Content-Type: text/plain; charset=UTF-8

Hi all,

On Thu, Feb 26, 2015 at 7:06 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Vote for script only include/require RFC is started.
> This RFC closes one of the fatal security hole in PHP programs with
> simple patch.
>
> https://wiki.php.net/rfc/script_only_include
> https://github.com/php/php-src/pull/1111
> Vote ends 2015/3/12
>
> It seems there are misunderstandings about the issue and the protection.
> If you would like to vote "no", please read the RFC carefully.
> If you find fatal reason to reject this RFC, it is about arbitrarily code
> execution
> and file exposure, so please let us know the reason why.
>
> If you have question, please ask.
>

It seems I had better to address stream wrapper issues at the same time
even though it's big enough issue.

I'll merge https://wiki.php.net/rfc/allow_url_include into this RFC and make
this RFC "Under Discussion" state.

For those who have voted already, please vote again when RFC is ready to
vote again.

Thank you.

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a114596a8c95c7c0510328f20--