Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-03-01 Thread Lester Caine
On 01/03/15 00:37, Yasuo Ohgaki wrote: Yes, the global vs local setting issue is distinct from the question of is phar://blah a URL? I think your question is about remote/local resource. Is phar:// local resource? It's yes. Is phar:// URL/URI? I think it depends how people understand

Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-28 Thread Yasuo Ohgaki
Hi Stas, On Sat, Feb 28, 2015 at 1:53 PM, Stanislav Malyshev smalys...@gmail.com wrote: I have no intention to change current include/require syntax, except adding 2nd parameter. This is a bit misleading since include is not a function, so there's no 1st parameter. Instead, it's a syntax

Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-28 Thread Yasuo Ohgaki
Hi Rowan, On Sun, Mar 1, 2015 at 3:46 AM, Rowan Collins rowan.coll...@gmail.com wrote: On 28/02/2015 02:37, Yasuo Ohgaki wrote: Hi Rowan, On Fri, Feb 27, 2015 at 8:25 PM, Rowan Collins rowan.coll...@gmail.com wrote: Yasuo Ohgaki wrote on 27/02/2015 03:44: Hi all, This is RFC for

Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-28 Thread Rowan Collins
On 28/02/2015 02:37, Yasuo Ohgaki wrote: Hi Rowan, On Fri, Feb 27, 2015 at 8:25 PM, Rowan Collins rowan.coll...@gmail.com mailto:rowan.coll...@gmail.com wrote: Yasuo Ohgaki wrote on 27/02/2015 03:44: Hi all, This is RFC for removing allow_url_include INI option. [1]

Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-28 Thread Stanislav Malyshev
Hi! The root cause of the issue here is preciseness of the setting. I think you agree that current allow_url_include=Off with INI_SYSTEM is not precise at all. It is precise - it's doing exactly what it meant to do, separate local wrappers from remote ones. We need to consider local and

Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-27 Thread Yasuo Ohgaki
Hi all, On Sat, Feb 28, 2015 at 11:37 AM, Yasuo Ohgaki yohg...@ohgaki.net wrote: On Fri, Feb 27, 2015 at 8:25 PM, Rowan Collins rowan.coll...@gmail.com wrote: Yasuo Ohgaki wrote on 27/02/2015 03:44: Hi all, This is RFC for removing allow_url_include INI option. [1] During Script only

Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-27 Thread Yasuo Ohgaki
Hi Rowan, On Fri, Feb 27, 2015 at 8:25 PM, Rowan Collins rowan.coll...@gmail.com wrote: Yasuo Ohgaki wrote on 27/02/2015 03:44: Hi all, This is RFC for removing allow_url_include INI option. [1] During Script only include RFC[2] discussion, stream wrapper issue is raised. I was thinking

Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-27 Thread Stanislav Malyshev
Hi! I have no intention to change current include/require syntax, except adding 2nd parameter. This is a bit misleading since include is not a function, so there's no 1st parameter. Instead, it's a syntax construct. Of course, syntax construct's grammar can be changed, though I'm not sure if

Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-27 Thread Yasuo Ohgaki
Hi Xinchen, On Fri, Feb 27, 2015 at 4:45 PM, Xinchen Hui larue...@php.net wrote: Sorry, but I am confused by the point, do you want to disable include a remote php file or not? if yes, how about with allow_url_fopen? eval(file_get_contents(http://xx/)); thanks My objective is to

Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-27 Thread Yasuo Ohgaki
Hi Xinchen, On Fri, Feb 27, 2015 at 4:45 PM, Xinchen Hui larue...@php.net wrote: Sorry, but I am confused by the point, do you want to disable include a remote php file or not? I think the RFC title was misleading. I've changed to Precise URL include control Thank you for your feedback.

Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-27 Thread Rowan Collins
Yasuo Ohgaki wrote on 27/02/2015 03:44: Hi all, This is RFC for removing allow_url_include INI option. [1] During Script only include RFC[2] discussion, stream wrapper issue is raised. I was thinking this issue as a separate issue, but it seems others are not. I'm not convinced by the

Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-26 Thread Xinchen Hui
Hey: On Fri, Feb 27, 2015 at 11:44 AM, Yasuo Ohgaki yohg...@ohgaki.net wrote: Hi all, This is RFC for removing allow_url_include INI option. [1] During Script only include RFC[2] discussion, stream wrapper issue is raised. I was thinking this issue as a separate issue, but it seems others

Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-26 Thread Yasuo Ohgaki
Hi Xinchen, On Fri, Feb 27, 2015 at 3:55 PM, Xinchen Hui larue...@php.net wrote: hmm, does that means, if this RFC won't pass, then script only include RFC should also be rejected? if yes, then maybe you should put them together? Sorry I just sent previous mail before your mail. We need

Re: [PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-26 Thread Xinchen Hui
Hey: On Fri, Feb 27, 2015 at 2:59 PM, Yasuo Ohgaki yohg...@ohgaki.net wrote: Hi Xinchen, On Fri, Feb 27, 2015 at 3:55 PM, Xinchen Hui larue...@php.net wrote: hmm, does that means, if this RFC won't pass, then script only include RFC should also be rejected? if yes, then maybe you should

[PHP-DEV] [RFC][DISCUSSION] Remove allow_url_include INI

2015-02-26 Thread Yasuo Ohgaki
Hi all, This is RFC for removing allow_url_include INI option. [1] During Script only include RFC[2] discussion, stream wrapper issue is raised. I was thinking this issue as a separate issue, but it seems others are not. Script only include RFC does not cover stream wrapper hole. This RFC