Hi all, This is RFC for removing "allow_url_include" INI option. [1]
During "Script only include" RFC[2] discussion, stream wrapper issue is raised. I was thinking this issue as a separate issue, but it seems others are not. "Script only include" RFC does not cover stream wrapper hole. This RFC addresses the hole created by stream wrappers. Those who may be concerned this hole in "Script only include" RFC may reconsider your votes by this. Without this RFC, "Script only include" RFC may have infinite number of holes. This RFC closes them and make "Script only include" RFC more effective. I don't use phar on regular basis, feedback from phar users are appreciated. If you find yet another hole in [2], please let me know. [1] https://wiki.php.net/rfc/allow_url_include [2] https://wiki.php.net/rfc/script_only_include Regards, -- Yasuo Ohgaki yohg...@ohgaki.net
