Hi Rasmus,
On Fri, Feb 14, 2014 at 9:00 AM, Rasmus Lerdorf <[email protected]> wrote:
> Striving to make PHP more secure for neophyte developers is always a
> worthy goal, but it needs to be done in a way that doesn't make things
> worse. I think this particular approach would make things worse by
> needlessly complicating things.
>
I agree that needless complexity should be avoided.
Switching template mode on and off is tricky, although existing codes can be
secured without many lines of change. There are options for LFI mitigation.
There might be convincing solution. I cannot think of one now, though.
Regards,
--
Yasuo Ohgaki
[email protected]