Alex Dupre <[email protected]> wrote: > > On 01/06/2026 13:54, Michael Grimm wrote:
>> Here are my questions: >> #) What is better w.r.t. security >> () allow_url_fopen? >> () curl? >> () "custom HTTP handler"? (whatever that might be) >> #) Am I the only one using roundcube with cURL while disabling >> 'allow_url_fopen'? >> #) If not, should I open a PR for adding curl to USE_PHP like for [1]? > If you are concerned about enabling "allow_url_fopen" then I think installing > curl is better w.r.t security, since the latter is explicit. Thanks and good to know. > I cannot answer on the second question, but if you have a non-default setup I > don't think there is anything wrong in directly installing additional > dependencies. If you are using ports you can enable them in the > php-extensions port options. Wow. That is a solution I have never thought about, and of course, it's working as suggested. Thanks and regards, Michael
