Hi all,
Let me rephrase. Does anyone argue that the fact
Local script inclusion is *much grater security threat* than local script
expose.
"Local script expose" is the only drawback of this RFC.
Currently, insecure include()/require() allows script execution.
With this RFC, insecure include()/require() may allow script expose.
Latter is obvious error as it shows wrong behavior while script execution
is
not obvious at all. If user care to script expose, they can simply add
"<?php"
at the top of script as it is now.
We can make secure program with register_globals=On as well as embed
everything by default. The same argument applies here. IMHO.
--
Yasuo Ohgaki
[email protected]
On Mon, Feb 10, 2014 at 4:35 PM, Yasuo Ohgaki <[email protected]> wrote:
> Hi all,
>
> "Optional PHP tags by php.ini and CLI options" RFC has been discussed very
> long time.
>
> https://wiki.php.net/rfc/nophptags
>
> I would like to know is there anyone who would like not to have
> this. I think it's good counter measure for LFI, but you might have
> different perspective.
>
> If it is possible, I would like to address as much as opinions possible
> before voting.
>
> Are there anyone who think we should have this?
> What is the reason?
>
> Thank you
>
> --
> Yasuo Ohgaki
> [email protected]
>
>