Re: [PHP-DEV] Add FILTER_VALIDATE_INCLUDE validation filter for variable includes

2018-09-28 Thread Andrey Andreev
Hi, On Mon, Sep 24, 2018 at 2:21 PM, Arnold Daniels wrote: > > > Please have a look at > * https://wiki.php.net/rfc/script_only_include - PHP RFC: Introduce script > only include/require > * https://wiki.php.net/rfc/allow_url_include - PHP RFC: Precise URL include > control > > Both describe the

Re: [PHP-DEV] Add FILTER_VALIDATE_INCLUDE validation filter for variable includes

2018-09-24 Thread Arnold Daniels
On Fri, Sep 21, 2018 at 1:36 PM Andrey Andreev wrote: > Hi, > > On Thu, Sep 20, 2018 at 11:30 PM, Arnold Daniels wrote: > > > > > > On Thu, Sep 20, 2018 at 8:50 PM Andrey Andreev wrote: > >> > >> Hi again, > >> > >> > >> On Thu, Sep 20, 2018 at 5:29 PM, Arnold Daniels > wrote: > >> > > >> >

Re: [PHP-DEV] Add FILTER_VALIDATE_INCLUDE validation filter for variable includes

2018-09-24 Thread Arnold Daniels
Sorry about that. I'll be more careful when replying. - Arnold On Fri, Sep 21, 2018 at 2:07 PM Andrey Andreev wrote: > Hi, > > On Fri, Sep 21, 2018 at 3:03 PM, Rowan Collins > wrote: > > Hi Arnold, > > > > Please remember to click "Reply All" / "Reply List" rather than just > > "Reply", to

Re: [PHP-DEV] Add FILTER_VALIDATE_INCLUDE validation filter for variable includes

2018-09-22 Thread Rowan Collins
On 22 September 2018 10:54:53 BST, Andrey Andreev wrote: >Hi, >There's been a few occasions where gmail has marked newcommers' >messages to the list as spam for me, but I don't remember if I had to >click Not Spam on this one ... can you guys check your Spam dirs? That wouldn't explain it not

Re: [PHP-DEV] Add FILTER_VALIDATE_INCLUDE validation filter for variable includes

2018-09-22 Thread Andrey Andreev
Hi, On Sat, Sep 22, 2018 at 12:35 PM, Markus Fischer wrote: > > On 21.09.18 14:07, Andrey Andreev wrote: >> >> On Fri, Sep 21, 2018 at 3:03 PM, Rowan Collins >> wrote: >>> >>> Hi Arnold, >>> >>> Please remember to click "Reply All" / "Reply List" rather than just >>> "Reply", to make sure the

Re: [PHP-DEV] Add FILTER_VALIDATE_INCLUDE validation filter for variable includes

2018-09-22 Thread Markus Fischer
On 21.09.18 14:07, Andrey Andreev wrote: On Fri, Sep 21, 2018 at 3:03 PM, Rowan Collins wrote: Hi Arnold, Please remember to click "Reply All" / "Reply List" rather than just "Reply", to make sure the list is included in your replies. Right now, most of us are only seeing half the

Re: [PHP-DEV] Add FILTER_VALIDATE_INCLUDE validation filter for variable includes

2018-09-21 Thread Andrey Andreev
Hi, On Fri, Sep 21, 2018 at 3:03 PM, Rowan Collins wrote: > Hi Arnold, > > Please remember to click "Reply All" / "Reply List" rather than just > "Reply", to make sure the list is included in your replies. Right now, most > of us are only seeing half the conversation: >

Re: [PHP-DEV] Add FILTER_VALIDATE_INCLUDE validation filter for variable includes

2018-09-21 Thread Rowan Collins
Hi Arnold, Please remember to click "Reply All" / "Reply List" rather than just "Reply", to make sure the list is included in your replies. Right now, most of us are only seeing half the conversation: https://externals.io/message/103196 Cheers, -- Rowan Collins [IMSoP]

Re: [PHP-DEV] Add FILTER_VALIDATE_INCLUDE validation filter for variable includes

2018-09-21 Thread Andrey Andreev
Hi, On Thu, Sep 20, 2018 at 11:30 PM, Arnold Daniels wrote: > > > On Thu, Sep 20, 2018 at 8:50 PM Andrey Andreev wrote: >> >> Hi again, >> >> >> On Thu, Sep 20, 2018 at 5:29 PM, Arnold Daniels wrote: >> > >> > Variable includes have proper purposes, like for a (PSR-4) autoloader. >> > This >>

Re: [PHP-DEV] Add FILTER_VALIDATE_INCLUDE validation filter for variable includes

2018-09-20 Thread Andrey Andreev
Hi again, On Thu, Sep 20, 2018 at 5:29 PM, Arnold Daniels wrote: > > Variable includes have proper purposes, like for a (PSR-4) autoloader. This > can't be simply replaced with an 'if' statement. Other reasons are module > inclusion and generated code. > Of course, there are a few valid

Re: [PHP-DEV] Add FILTER_VALIDATE_INCLUDE validation filter for variable includes

2018-09-20 Thread Andrey Andreev
Hi, On Thu, Sep 20, 2018 at 1:37 PM, Arnold Daniels wrote: > There are many security issues that arise from not sanitizing a variable > before using it in an include (eg `include $script;`). > > The filter extension is intended to prevent this kind of security issues. A > validation filter would

[PHP-DEV] Add FILTER_VALIDATE_INCLUDE validation filter for variable includes

2018-09-20 Thread Arnold Daniels
There are many security issues that arise from not sanitizing a variable before using it in an include (eg `include $script;`). The filter extension is intended to prevent this kind of security issues. A validation filter would make it easier and could be the defacto standard when using variable