# allow_url_fopen ini directive not enough

- Thread: https://externals.io/message/14033
- Original archive: https://news-web.php.net/php.internals/14033
- Started by kelvinj@gmail.com on 2004-12-09T10:03:20+00:00
- Messages: 2
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #14033 — kelvinj@gmail.com — 2004-12-09T10:03:20+00:00

URL: https://externals.io/message/14033#14033

Hi,

I would like to see a new directive to go alongside "allow_url_fopen" to
allow people to turn on or off the ability to include/require a remote file.

The ability to include and execute a file as php from a remote host
leaves many applications open to cross-site-scripting attacks.
This would be easily avoidable if we had a directive
(allow_url_include?) that by default removed this capability.

Any thoughts?

KJ

---

## #14146 — Daniel Lorch — 2004-12-21T14:04:26+00:00

URL: https://externals.io/message/14033#14146 · In reply to: #14033

Hi

> I would like to see a new directive to go alongside "allow_url_fopen" to
> allow people to turn on or off the ability to include/require a remote 
> file.

This feature is provided by hardened php:

   http://www.hardened-php.net/

But I absolutely +1 on this suggestion.

Daniel