Hi Lester,
On Wed, Feb 12, 2014 at 2:39 PM, Lester Caine <[email protected]> wrote:
> LFI is the one that will allow corrupted files containing .php tags to run
> if you have not taken care of them while they are being uploaded. ONLY
> permanently disabling embedding will guarantee that these files do not get
> accidentally loaded. i.e. 'changes the spirit of PHP too much' ...
>
> ----
> function render_template($template, $template_vars) {
> ini_set('template_mode', 'on'); // Older PHP ignores
> include($template, $template_vars); // Or use any other method to
> render.
>
> ini_set('template_mode', 'off'); // Older PHP ignores
> }
> ----
>
> Simply pushes the problem around a little and still requires that
> '$template' does not point at a file that contains embedded nasties?
> include($template.'.php', $template_vars); does the job a lot easier?
>
Since current PHP has null byte attack protection,
this is good enough protection. I agree.
The objectives of this RFC is to make PHP as secure as other languages.
Other language
developers do the same silly mistakes, yet almost all of them were not
considered as
"critical security issues" unlike PHP. This is what I would like to change.
Regards,
--
Yasuo Ohgaki
[email protected]