Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:86243 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 95632 invoked from network); 16 May 2015 13:32:28 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 16 May 2015 13:32:28 -0000 Authentication-Results: pb1.pair.com header.from=php@bof.de; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=php@bof.de; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain bof.de designates 80.242.145.70 as permitted sender) X-PHP-List-Original-Sender: php@bof.de X-Host-Fingerprint: 80.242.145.70 mars.intermailgate.com Received: from [80.242.145.70] ([80.242.145.70:36960] helo=mars.intermailgate.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id D7/80-14891-AE647555 for ; Sat, 16 May 2015 09:32:27 -0400 Received: (qmail 16883 invoked by uid 1009); 16 May 2015 15:32:23 +0200 Received: from 209.85.192.48 by mars (envelope-from , uid 89) with qmail-scanner-1.25-st-qms (clamdscan: 0.96.2/20469. spamassassin: 3.3.1. perlscan: 1.25-st-qms. Clear:RC:1(209.85.192.48):. Processed in 0.204284 secs); 16 May 2015 13:32:23 -0000 X-Antivirus-MYDOMAIN-Mail-From: php@bof.de via mars X-Antivirus-MYDOMAIN: 1.25-st-qms (Clear:RC:1(209.85.192.48):. Processed in 0.204284 secs Process 16868) Received: from mail-qg0-f48.google.com (gmail@bof.de@209.85.192.48) by mars.intermailgate.com with RC4-SHA encrypted SMTP; 16 May 2015 15:32:23 +0200 Received: by qgde91 with SMTP id e91so3737516qgd.0 for ; Sat, 16 May 2015 06:32:21 -0700 (PDT) MIME-Version: 1.0 X-Received: by 10.140.145.85 with SMTP id 82mr19522529qhr.32.1431783141722; Sat, 16 May 2015 06:32:21 -0700 (PDT) Received: by 10.140.49.75 with HTTP; Sat, 16 May 2015 06:32:21 -0700 (PDT) Received: by 10.140.49.75 with HTTP; Sat, 16 May 2015 06:32:21 -0700 (PDT) In-Reply-To: <001101d08fd8$cf5beb40$6e13c1c0$@php.net> References: <001101d08fd8$cf5beb40$6e13c1c0$@php.net> Date: Sat, 16 May 2015 15:32:21 +0200 Message-ID: To: francois@php.net Cc: Yasuo Ohgaki , internals Content-Type: multipart/alternative; boundary=001a113551b48eec25051632fd5f Subject: RE: [PHP-DEV] Preload scripts and preloaded scripts only options From: php@bof.de (Patrick Schaaf) --001a113551b48eec25051632fd5f Content-Type: text/plain; charset=UTF-8 None of this whitelisting-by-filename would be practical for our setup. Have a look at what Smarty does with compiled templates and cached pages: PHP includes generated on the fly, with filenames that are not known in advance. For such usage a whitelisting per realpath prefix, would be the only reasonable approach. best regards Patrick --001a113551b48eec25051632fd5f--