Re: [PHP-DEV] Security techniques

2001-07-30 Thread Ramsi Sras
UNSUBSCRIBE ME PLEASE!!vUNSUBSCRIBE ME PLEASE!! Stephen van Egmond schrieb: Zeev Suraski ([EMAIL PROTECTED]) wrote: > At 12:04 29/07/2001, Stephen van Egmond wrote: > >2. when a uploaded file fails is_uploaded_file(). > > My English parser bailed out on this one :) How's y

Re: [PHP-DEV] Security techniques

2001-07-30 Thread Ramsi Sras
UNSUBSCRIBE ME PLEASE!! Chuck Hagenbuch schrieb: Quoting Rasmus Lerdorf <[EMAIL PROTECTED]>: > As long as it works with all browsers, which as far as I can tell it does, > then it doesn't really concern me that some servers don't support it. > Apache will definitely always support thi

Re: [PHP-DEV] Security techniques

2001-07-30 Thread Ramsi Sras
UNSUBSCRIBE ME PLEASE!! Rasmus Lerdorf schrieb: > > Huh?  I use this all the time in my apps.  There is absolutely nothing > > wrong with having both GET and POST method variables at the same time. > > Disallowing this would break almost every app I have ever written. > > Well, it wor

Re: [PHP-DEV] Security techniques

2001-07-30 Thread Ramsi Sras
UNSUBSCRIBE ME PLEASE!! Rasmus Lerdorf schrieb: > Have PHP reject (fail to process, die, whatever) a hit that is > anomalous. Definitions of anomalous: > > 1. GET variables set while METHOD != GET > >   i.e. >   >   ... >   Huh?  I use this all the time in my apps.  Ther

Re: [PHP-DEV] Security techniques

2001-07-30 Thread Ramsi Sras
UNSUBSCRIBE ME PLEASE!! Chuck Hagenbuch schrieb: Quoting Rasmus Lerdorf <[EMAIL PROTECTED]>: > Huh?  I use this all the time in my apps.  There is absolutely nothing > wrong with having both GET and POST method variables at the same time. > Disallowing this would break almost every ap

Re: [PHP-DEV] Security techniques

2001-07-30 Thread Ramsi Sras
UNSUBSCRIBE ME PLEASE!! Stephen van Egmond schrieb: I was going to reply to Phil Driscoll's post (from Friday) about E_SECURITY warning level, but thought it might belong better in a different thread. This thread is for collecting some ideas for security enhancements that can happen i

Re: [PHP-DEV] Security techniques

2001-07-29 Thread Zeev Suraski
At 21:23 29/07/2001, Stephen van Egmond wrote: >Zeev Suraski ([EMAIL PROTECTED]) wrote: > > > At 12:04 29/07/2001, Stephen van Egmond wrote: > > >2. when a uploaded file fails is_uploaded_file(). > > > > My English parser bailed out on this one :) > >How's your PHP parser doing? :) > >foreach $f (

Re: [PHP-DEV] Security techniques

2001-07-29 Thread Stephen van Egmond
Zeev Suraski ([EMAIL PROTECTED]) wrote: > At 12:04 29/07/2001, Stephen van Egmond wrote: > >2. when a uploaded file fails is_uploaded_file(). > > My English parser bailed out on this one :) How's your PHP parser doing? :) foreach $f ($HTTP_POST_FILES) { if (!is_uploaded_file($f)) {

Re: [PHP-DEV] Security techniques

2001-07-29 Thread Zeev Suraski
At 12:04 29/07/2001, Stephen van Egmond wrote: >2. when a uploaded file fails is_uploaded_file(). My English parser bailed out on this one :) >I felt bad when I saw is_uploaded_file() introduced - it is such a >cheezy function call; people shouldn't even have to call it themselves, >and I ca

Re: [PHP-DEV] Security techniques

2001-07-29 Thread Chuck Hagenbuch
Quoting Rasmus Lerdorf <[EMAIL PROTECTED]>: > As long as it works with all browsers, which as far as I can tell it does, > then it doesn't really concern me that some servers don't support it. > Apache will definitely always support this. Yup - I haven't found a browser that has problems with it

Re: [PHP-DEV] Security techniques

2001-07-29 Thread Rasmus Lerdorf
> > Huh? I use this all the time in my apps. There is absolutely nothing > > wrong with having both GET and POST method variables at the same time. > > Disallowing this would break almost every app I have ever written. > > Well, it works fine with Apache, and probably some other servers, but it

Re: [PHP-DEV] Security techniques

2001-07-29 Thread Chuck Hagenbuch
Quoting Rasmus Lerdorf <[EMAIL PROTECTED]>: > Huh? I use this all the time in my apps. There is absolutely nothing > wrong with having both GET and POST method variables at the same time. > Disallowing this would break almost every app I have ever written. Well, it works fine with Apache, and

Re: [PHP-DEV] Security techniques

2001-07-29 Thread Rasmus Lerdorf
> Have PHP reject (fail to process, die, whatever) a hit that is > anomalous. Definitions of anomalous: > > 1. GET variables set while METHOD != GET > > i.e. > > ... > Huh? I use this all the time in my apps. There is absolutely nothing wrong with having both GET and POST