Hi Julien,
On Sat, Jan 18, 2014 at 7:10 AM, Yasuo Ohgaki <[email protected]> wrote:
> Why is that an issue ?
>> We just leave it as-is , or ?
>
>
> Some users are annoyed by sloppy multilingual implementations using
> this option. There is feature request from user who want to remove
> mbstring.func_overload INI option.
>
> https://bugs.php.net/bug.php?id=65785
>
> We may extend or drop this feature. I neutral for this.
>
Since we are better to concentrate on fixing the security issue, I've
made it open issue for future releases.
I'll just add mb new functions to mbstring.func_overload INI option.
If func_overload is supported, we still needs php_mblen() for command
line output since it's not good idea to detect locale and using
internal_encoding
opens new vulnerability.
Functions that are better to use locale are
- mb_escape_shell_arg()
- mb_escape_shell_cmd()
These function may override locale by encoding parameter.
Since fgetcsv() uses locale now, we may do the same for fgetcsv() also.
The RFC is updated.
Regards,
--
Yasuo Ohgaki
[email protected]