Re: [PHP-DEV] Buildproblems in latest CVS

2001-08-10 Thread Rasmus Lerdorf
> It sits in pear/Makefile(.in)?. > > An installation I did two days ago looks complete -- all > header files were copied to $prefix/include/php. Yeah, it is working now. Almost 5am. I must have done something weird. -Rasmus -- PHP Development Mailing List

Re: [PHP-DEV] Buildproblems in latest CVS

2001-08-10 Thread Rasmus Lerdorf
> > note the 1.4b. it requires autoconf 2.50. but I think this goes for 1.4 > > also, but doesn't screem > > Libtool 1.4 does not require autoconf 2.50 or higher. Note > that libtool-1.4b is an alpha release, so you have to expect > failures. Perhaps I am too tired, but where did the

Re: [PHP-DEV] Satellite (Was: Re: [PHP-DEV] PHP 4.0.7)

2001-08-09 Thread Rasmus Lerdorf
> > I get a no data from that URL. > > It's a redirect to a different port: > > http://satellite.2good.nu:1082 > > Or maybe it just doesn't work... It is working now. Check your error_log. I bet you have a few segvs listed. -Rasmus -- PHP Development Mailing List To

Re: [PHP-DEV] Satellite (Was: Re: [PHP-DEV] PHP 4.0.7)

2001-08-09 Thread Rasmus Lerdorf
> I just refreshed the Satellite extension a little, and set up a demo > server at http://satellite.2good.nu so you can see that it actually works! > :-) I get a no data from that URL. -Rasmus -- PHP Development Mailing List To unsubscribe, e-mail: [EMAIL PROTECTED] For

Re: [PHP-DEV] Bug #12575 Updated: Session register & destroyflaws/bugs(?)

2001-08-05 Thread Rasmus Lerdorf
> Closed? Or a Feature/Change request? Close it, I guess. It is working as it was designed and we can't really change this at this point because it would break a bunch of existing scripts. -Rasmus -- PHP Development Mailing List To unsubscribe, e-mail: [EMAIL PROTECTED]

[PHP-DEV] Chora now the default cvs.php.net system

2001-08-05 Thread Rasmus Lerdorf
I switched Chora over to be the default web cvs system behind cvs.php.net now. The old viewcvs site is still available at viewcvs.php.net (dns may not have updated yet) -Rasmus -- PHP Development Mailing List To unsubscribe, e-mail: [EMAIL PROTECTED] For additional comma

Re: [PHP-DEV] RFC: mt_* functions

2001-08-04 Thread Rasmus Lerdorf
> >Sure, although rand() tends to be the same everywhere as well. At least > >on all the systems I care about it is the same. Linux, FreeBSD, OpenBSD > >and Solaris all seem to use the same algorithm. > > Then why do some people have troubles with rand() on Solaris? :) > Or is it some specific v

Re: [PHP-DEV] RFC: mt_* functions

2001-08-04 Thread Rasmus Lerdorf
> On Sat, 4 Aug 2001, Rasmus Lerdorf wrote: > >based on their seeds. If I, as an application developer, distributes a > >regression test harness which tests my app with a specific seed expecting > >a specific sequence and the server my app runs on has switched rand()

Re: [PHP-DEV] RFC: mt_* functions

2001-08-04 Thread Rasmus Lerdorf
> Both function families are the same in syntax & returning, only the > algorithm is different. I.e.: the semantics is the same. The algorithm - if > correct - shouldn't bother, and shouldn't be the concern of the programmer, > but rather the system maintainer (specific cases excluded, but than yo

Re: [PHP-DEV] Programming question

2001-08-03 Thread Rasmus Lerdorf
> can it be assumed that > zval.str.val[zval.str.len] = '\0'? > > i.e., the byte after the string in a zval is the null-byte? > > That is assumed in various places in ext/standard/string.c, and AFAIK > that may not always be true. No code in PHP should assume this. PHP should always check the le

Re: [PHP-DEV] Re: [ZEND-ENGINE] cvs: Zend / zend.c zend_execute_API.czend_hash.czend_hash.h zend_list.c zend_list.h

2001-08-02 Thread Rasmus Lerdorf
> Zeev Suraski wrote: > > - For the register_globals default change, I believe a major > > version bump is a very good idea, as it's exactly the kind of > > heads-up message we want to send to all of the users. > > Why not combine the two for a 4.1 release? How much work would be > required

Re: [PHP-DEV] Re: [ZEND-ENGINE] cvs: Zend / zend.c zend_execute_API.czend_hash.czend_hash.h zend_list.c zend_list.h

2001-08-02 Thread Rasmus Lerdorf
Yes, this wouldn't be a new branch, just the next version. On Thu, 2 Aug 2001, Jon Parise wrote: > On Thu, Aug 02, 2001 at 10:50:07AM -0700, Rasmus Lerdorf wrote: > > > I would pretty much insist on the _GET() stuff, import_globals() and > > register_globals changes b

Re: [PHP-DEV] Security Issues - a bit of my experience

2001-07-29 Thread Rasmus Lerdorf
> I was trying to step back a bit and identify some of the patterns in > the attacks identified in the paper. One extremely popular pattern was > spoofing variables by overwriting them: GET variables overwriting > POST, usually, and I suggested that some SAPI stunt be pulled to catch > that. Tha

Re: [PHP-DEV] Security techniques

2001-07-29 Thread Rasmus Lerdorf
> > Huh? I use this all the time in my apps. There is absolutely nothing > > wrong with having both GET and POST method variables at the same time. > > Disallowing this would break almost every app I have ever written. > > Well, it works fine with Apache, and probably some other servers, but it

Re: [PHP-DEV] Security techniques

2001-07-29 Thread Rasmus Lerdorf
> Have PHP reject (fail to process, die, whatever) a hit that is > anomalous. Definitions of anomalous: > > 1. GET variables set while METHOD != GET > > i.e. > > ... > Huh? I use this all the time in my apps. There is absolutely nothing wrong with having both GET and POST

Re: [PHP-DEV] Proposal

2001-07-29 Thread Rasmus Lerdorf
> I'm against a global function like this, but in favour of the 2nd flavour, > where you have to explicitly pass a list of variable names to import. Actually, I mostly had something like: import_globals("ES") in mind for the import all variety. Importing all server and environment variables when

[PHP-DEV] Proposal

2001-07-28 Thread Rasmus Lerdorf
The best thing about PHP is that it has such a shallow learning curve that non-programmers can write web apps. The worst thing about PHP is that it has such a shallow learning curve that non-programmers write web apps. That is of course oversimplifying things quite a bit, but it is the root of t

Re: [PHP-DEV] Security Issues

2001-07-27 Thread Rasmus Lerdorf
> This is an important step, that as I said, I wanted to make for years. I > just argue that as protective as you are over register_globals=on, the real > flaw is there, and this is the place it should be fixed. Fixing the fact > that E_NOTICE is on may also be viable, but in practice: > - A hug

Re: [PHP-DEV] Security Issues

2001-07-27 Thread Rasmus Lerdorf
> That's also not true. Is using $foo all that better than $_GET["foo"]? For a neophyte user - most definitely. > But it isn't. It's by fixing an inherent design flaw in PHP. The proposed > target situation is *NOT* any more difficult to the users than the > situation is today. Of course it

Re: [PHP-DEV] Security Issues

2001-07-27 Thread Rasmus Lerdorf
> Peter Petermann wrote: > > i dont think it is easier to write more secure applications > > with turning a feature of. > > In this particular case, it would. There are several reported cases of > security-holes caused by this feature. Without it, there would be fewer > insecure PHP-applications o

Re: [PHP-DEV] Security Issues

2001-07-27 Thread Rasmus Lerdorf
> Peter Petermann wrote: > > > I fully agree here with Rasmus and I also think this will > > > be the workaround for most people -- if one _does_ care > > > about security, he even knows what and how to do nowadays. > > > I don't think turning register_globals to off will evangelize > > > people t

Re: [PHP-DEV] Security Issues

2001-07-27 Thread Rasmus Lerdorf
> At 01:35 27/07/2001, Rasmus Lerdorf wrote: > >I think you missed my point. People use empty() and isset() on a variable > >to check to see if that variable was set by the user. As such that > >variable is unclean and whether it came in via register_globals or not is >

Re: [PHP-DEV] Security Issues

2001-07-27 Thread Rasmus Lerdorf
> At 08:48 26/07/2001, Rasmus Lerdorf wrote: > > > Just replace your if ($ok) with if (!empty($ok)), and you have a perfect > > > exploitable code that produces no warnings. > > > >But in this case someone has gone to the trouble to figure out what > >empt

Re: [PHP-DEV] RE: Bug #12412 Updated: Installation on Apache Server

2001-07-26 Thread Rasmus Lerdorf
> Hmmm. I think I screwed up - I am using Apache 2.0.16, > and I guess I thought they'd work the same - in 2.0.16, > it's "enable-module" - I used it, and it worked. Once the first real Apache2 beta is released we will have real docs for installation. A lot can still change. > BTW, where do I a

Re: [PHP-DEV] Chora installed

2001-07-26 Thread Rasmus Lerdorf
> > Chuck installed his PHP-based cvs browsing app. It is > > available at http://chora.php.net. Go have a look. > > > > I think it looks really good and we should probably make > > it the default for http://cvs.php.net. Anybody see any reason > > not to do that? > > Cool!! A few things I noti

Re: [PHP-DEV] Chora installed

2001-07-26 Thread Rasmus Lerdorf
> > Chuck installed his PHP-based cvs browsing app. It is available at > > http://chora.php.net. Go have a look. > > > > I think it looks really good and we should probably make it the default > > for http://cvs.php.net. Anybody see any reason not to do that? > > Go ahead. I recently set up a

[PHP-DEV] Chora installed

2001-07-26 Thread Rasmus Lerdorf
Chuck installed his PHP-based cvs browsing app. It is available at http://chora.php.net. Go have a look. I think it looks really good and we should probably make it the default for http://cvs.php.net. Anybody see any reason not to do that? -Rasmus -- PHP Development Mailing List

Re: [PHP-DEV] Security Issues

2001-07-26 Thread Rasmus Lerdorf
> Just replace your if ($ok) with if (!empty($ok)), and you have a perfect > exploitable code that produces no warnings. But in this case someone has gone to the trouble to figure out what empty() does. And generally they use empty() on things that come from the user anyway. I don't think I hav

Re: [PHP-DEV] Security Issues

2001-07-25 Thread Rasmus Lerdorf
> I tend to agree with the advisory, in the sense that register_globals=on > encourages insecure code, and it would in fact help to disable it by > default. It's true that some (many) people don't understand that they > shouldn't 'trust' any data coming from POST or cookies anymore than they > sh

Re: [PHP-DEV] Re: [PEAR-DEV] PHP and WebDAV

2001-07-25 Thread Rasmus Lerdorf
> The immediately most useful stuff for PHP would be server functionality > in cooperation with mod_dav. The client part seems to be much easier to > implement. Both Rasmus and I fell off this project as you can see, so > if someone want to pick it up, that'd be awesome. I may just be motivated

[PHP-DEV] PHP Developers at OSCON in San Diego

2001-07-25 Thread Rasmus Lerdorf
If you are at OSCON, drop by and hang out in our hacker room today (Wednesday). We are in the east tower next to the Perl Gurus room. I think it is officially named Marina Room 2 or something similar to that. There is a sign out front identifying the room. -Rasmus -- PHP Development Mailing

Re: [PHP-DEV] Security Issues

2001-07-25 Thread Rasmus Lerdorf
Because not everyone agrees that this is actually "highly recommended". Most third-party PHP code you may want to run will not work very well with register_globals off. And turning register_globals off isn't actually as helpful from a security perspective as many people seem to think. The basic

Re: [PHP-DEV] Fw: PHP XMF

2001-07-21 Thread Rasmus Lerdorf
> XPC is a proprietary product that I was hoping to open into the PHP > developers community. Open in what sense? Your site seems pretty clear on this: http://www.4arrow.com/accounts/xpc/home.xpc says: "To purchase an XPC license, receive customized installation, or to become invloved with XPC

Re: [PHP-DEV] Fw: PHP XMF

2001-07-21 Thread Rasmus Lerdorf
> If you have a specific and honest question for me feel free to ask me > instead of assuming and denigrating me. It was not an attempt to do that. Ok, questions. Where do I download XPC? Where do I download the documentation for XPC? Is XPC a proprietary product from 4arrow.com? These were

Re: [PHP-DEV] Fw: PHP XMF

2001-07-21 Thread Rasmus Lerdorf
> I don't want to convince anyone :) I have no personal interest in this. I > just thought it was odd that I wake up and whilst reading my EMails the > issue was settled already w/o anyone responding. It seemed like an obvious one. The demo URL he gave didn't work. When I dug up a browser it wo

Re: [PHP-DEV] Fw: PHP XMF

2001-07-21 Thread Rasmus Lerdorf
> I don't think we need to say "no" before the PEAR guys take a look at it > and maybe discuss it in more detail with the author. I just didn't > understand the rush of you saying "no" without waiting for others to > respond and discussing it in more details. We might come to the conclusion > that

Re: [PHP-DEV] Fw: PHP XMF

2001-07-21 Thread Rasmus Lerdorf
> I actually think he has a point that we should strive to create one good > framework for PHP. This is very much like PEAR trying to give people good > framework/class solutions. If you had read my message you would have seen that I suggested it may fit within PEAR. He was asking for cmf.php.ne

Re: [PHP-DEV] Fw: PHP XMF

2001-07-21 Thread Rasmus Lerdorf
> I wan to thank you for making your quick decision. Well, there is no point wasting your time. If we were going to push a single content management framework as the standard PHP framework which in itself it quite unlikely, then we would pick one of the established ones written by people with a

Re: [PHP-DEV] Fw: PHP XMF

2001-07-21 Thread Rasmus Lerdorf
> Development is usually a forward approach, called innovation. To innovate is > to extend beyond. > > If I was to look behind I wouldn't move forward as quickly. The rate of > innovation is only as quick as those who make it happen. > > Anyhow, I don't code backwards only forward. Non complaint b

Re: [PHP-DEV] Fw: PHP XMF

2001-07-21 Thread Rasmus Lerdorf
> Having large numbers of disjointed CMF projects does not impress me. If > anything it frustrates me as a developer interested in building PHP > applications. That is exactly why I built XPC. Well, your system isn't exactly impresive either as it doesn't work with Netscape (didn't you test it?)

Re: [PHP-DEV] Fw: PHP XMF

2001-07-21 Thread Rasmus Lerdorf
Could you please format your message to something that is readable and explain what exactly cmf.php.net would provide? -Rasmus On Sat, 21 Jul 2001, Michael Glazer wrote: > > - Original Message - > From: "Jim Winstead" <[EMAIL PROTECTED]> > To: "Michael Glazer" <[EMAIL PROTECTED]> > Sent

Re: [PHP-DEV] a FIXME in head.c

2001-07-21 Thread Rasmus Lerdorf
> In the implementation of setcookie(), there's a FIXME line reading: > /* FIXME: XXX: this is not binary data safe */ > > I don't see how this can be binary safe, as we're creating a header line, > which cannot contain NULLs anyway. I think this comment should be removed, > but I want to see if

Re: [PHP-DEV] bug database report/search

2001-07-20 Thread Rasmus Lerdorf
Done. http://bugs.php.net now has an OS field which does a case-insensitive substr search. I also added an 'All' option to the entries/page dropdown so it is now possible to generate a single report with all bugs (assuming your browser can handle the potentially huge table) -Rasmus On Fri, 20

Re: [PHP-DEV] Latest CVS CGI (on linux) segfaults when using '-q'or '-f' on nonexistent file

2001-07-20 Thread Rasmus Lerdorf
Hrm.. This one is weird. We are going along nicely in cgi_main.c/main() 684 file_handle.handle.fp = stdin; (gdb) 685 file_handle.opened_path = NULL; (gdb) p file_handle.handle.fp $2 = (FILE *) 0x405948e0 Default file_handle.handle.fp to stdin and we have a valid FILE *

Re: [PHP-DEV] persistent mysql connection on a LAMP-System

2001-07-19 Thread Rasmus Lerdorf
> "A pconnect has a running time of 8 hours. There is no such time limit. > A close function will be ignored. True > Apache has a threading concept, which doesn't cancel the thread. You can > configure it but the thread will live till the last connection is closed. > ( 8 hours after a pconnect

[PHP-DEV] [PHP] mail() help (fwd)

2001-07-17 Thread Rasmus Lerdorf
I am not a fan of that config change that happened in 4.0.6 that checked to see if a sendmail binary is on the path and if it isn't it disables the mail() function at compile time. I really think this should be a simple warning so people can configure php to point to whatever they want, or simply

Re: [PHP-DEV] Is the list dead again?

2001-07-15 Thread Rasmus Lerdorf
> Last message I got was on July 13 @ 11am MST. Working fine -- PHP Development Mailing List To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]

Re: [PHP-DEV] Bug #12065 Updated: "libgd was not built with TrueTypefont support" problem

2001-07-13 Thread Rasmus Lerdorf
Use GD2 compiled like this: gd2 Makefile: CFLAGS=-g -DHAVE_LIBPNG -DHAVE_LIBJPEG -DHAVE_LIBFREETYPE LIBS=libgd.a -lpng -lz -ljpeg -lfreetype -lm make Then for PHP: --with-gd=/home/user_id/gd-2.0.1 --enable-gd-native-ttf --with-freetype-dir=/usr --enable-gd-imgstrttf --with-jpeg-dir=/usr --with-

Re: [PHP-DEV] include() fall back to scripts' cwd

2001-07-13 Thread Rasmus Lerdorf
> Rather than having this be a seperate case at the end of > php_fopen_with_path(), how about it just get appended to > the (local) search path? > > I am adding a 'safe_mode_include_dir', which will let you > include files you don't own if they are in the > safe_mode_include_dir. By appending the

Re: [PHP-DEV] Re: Bug #12128 Updated: library name inconsistencies

2001-07-12 Thread Rasmus Lerdorf
> /usr/lib is already listed there, and that's where they got installed. I > did run ldconfig. Then your report makes very little sense. Those symlinks you mentioned should have been in place already. We can't do anything in PHP to go around looking for oddly named libraries. -Rasmus -- PHP

Re: [PHP-DEV] Re: Bug #12081 Updated: A successfull snmpset() alwaysreturns "false"

2001-07-12 Thread Rasmus Lerdorf
Ok, yes, I do agree that it is a bug. I just wanted to verify that this is what you were seeing. I'll work up a fix for it. -Rasmus On Fri, 13 Jul 2001, Vesselin Atanasov wrote: > Hello. > Sorry for replying to this mail, but I forgot to set a password when > opening the bug report. > > Yes.

Re: [PHP-DEV] Bug #12121 Updated: chdir and safe_mode

2001-07-12 Thread Rasmus Lerdorf
> I think that php_checkuid() should be called with > CHECKUID_ALLOW_ONLY_FILE (whcih does not exist yet) instead of > CHECKUID_ALLOW_ONLY_DIR. Meaning -- if the passed "filename" does not > meet UID/GID test, it should *not* try stripping the last element and > trying agian. Sounds right. -Rasm

Re: [PHP-DEV] Re: Bug #12115 Updated: Broken configure:--with-mysql=/opt/mysql

2001-07-12 Thread Rasmus Lerdorf
Yes it is. --with-mysql=/opt/mysql should work fine. Make sure you remove config.cache before running ./configure On Thu, 12 Jul 2001, dusty wrote: > it is in /opt/mysql/lib/mysql > > just for kicks i tried placing --with-mysql=/opt/mysql/lib/mysql in the > configuration parameters instead of

[PHP-DEV] pgsql pg_close() bug?

2001-07-12 Thread Rasmus Lerdorf
Thies, weren't you playing around with something related to pg_close()? Apparently something is broken in pg-7.1 now. See: http://www.php.net/bugs.php?id=12084&edit=1 -Rasmus -- PHP Development Mailing List To unsubscribe, e-mail: [EMAIL PROTECTED] For additional command

Re: [PHP-DEV] CVS Account Request

2001-07-10 Thread Rasmus Lerdorf
> > Full name: Raphael Vallazza > > Email: [EMAIL PROTECTED] > > ID:raphael > > Purpose: libxslt backend for xslt module under (/php4/ext/xslt) > > > > sterling hughes asked me to request a cvs account > > Can someone please add him? Done -- PHP Development Mailing List

Re: [PHP-DEV] safe_mode.c: php_checkuid() mode

2001-07-09 Thread Rasmus Lerdorf
> Nix those mumblings about file existence ... but what about > bits vs not-bits for the mode? bits vs. non-bits? I'm afraid you have lost me. To get a CVS account, please fill out the little form here: http://php.net/cvs-php.php -Rasmus -- PHP Development Mailing List

Re: [PHP-DEV] [UPDATE] NGScan

2001-07-09 Thread Rasmus Lerdorf
> Could be that I did in the distant past (I saw this was coming - I know you > think that way). The difference is that I learned from experience and from > feedback I got from people, and implemented it. Sascha, on the other hand, > behaves exactly the way he did in day one, except he has more

Re: [PHP-DEV] [UPDATE] NGScan

2001-07-09 Thread Rasmus Lerdorf
> On Mon, Jul 09, 2001 at 09:37:35PM +0300, Zeev Suraski wrote: > > > > > So please stop with the personal attacks and > > >concentrate on the real technical issues. > > > > I'd appreciate it if you stayed out of this one. I'm fed up with Sascha's >

Re: [PHP-DEV] [UPDATE] NGScan

2001-07-09 Thread Rasmus Lerdorf
> At 21:24 9/7/2001, Rasmus Lerdorf wrote: > > > I'm talking about real-world cases of developers who stopped > > > contributing or were afraid to contribute because of your sucky, > > > condescending attitude. > > > >Uh? I don't recall a sin

Re: [PHP-DEV] NGScan - technical explanation

2001-07-09 Thread Rasmus Lerdorf
> I've been discussing the Zend Engine license with the 'leaders' of the > German PHP community on Thursday, and with members of the community and the > PHP Group on Friday. As mentioned there, the Zend Engine license is being > reviewed, and may change in the next few months. Especially in the

Re: [PHP-DEV] [UPDATE] NGScan

2001-07-09 Thread Rasmus Lerdorf
> I'm talking about real-world cases of developers who stopped > contributing or were afraid to contribute because of your sucky, > condescending attitude. Uh? I don't recall a single instance of Sascha scaring someone off. I frankly didn't see a personal attack from Sascha on you here. He doe

Re: [PHP-DEV] [patch] safe mode gid check

2001-07-09 Thread Rasmus Lerdorf
> Here is the patch against current CVS. Ok, I checked through your patch, tested it and committed it. Good work on the patch. It was quite thorough. If you anticipate doing further PHP work, please let us know and we can set you up with a CVS account. -Rasmus -- PHP Development Mailing Li

Re: [PHP-DEV] [UPDATE] NGScan

2001-07-09 Thread Rasmus Lerdorf
> Abstracting PHP to work with multiple scanners, or putting a scanner > outside the scripting engine, both make no sense. I don't want to see > something which is purely wrong from a technical standpoint, done because > of some licensing issue. I don't see why abstracting PHP to work with multi

Re: [PHP-DEV] [UPDATE] NGScan

2001-07-09 Thread Rasmus Lerdorf
> Especially due to the last point which requires fixing up > patches manually every time, I'd like to commit the PHP part > of things. Would anyone object to that? I wouldn't object. -Rasmus -- PHP Development Mailing List To unsubscribe, e-mail: [EMAIL PRO

Re: [PHP-DEV] [patch] safe mode gid check

2001-07-09 Thread Rasmus Lerdorf
Could you recreate this patch against current CVS? I think it is a good idea, but your patch doesn't work at all against the current code. Instructions about getting the code from CVS can be found here: http://php.net/anoncvs.php -Rasmus On Mon, 9 Jul 2001, James E. Flemer wrote: > This is

Re: [PHP-DEV] Reentrant C scanners for PHP

2001-07-06 Thread Rasmus Lerdorf
> > Looks very nice. Do you think you could LGPL it instead of GPL? Would be > > tricky to use in conjunction with the QPL if it was GPL'ed. > > As it's my intention that the code is linked against PHP/the > Zend Engine, the GPL should be fine here (similar to the > situation of the

Re: [PHP-DEV] Reentrant C scanners for PHP

2001-07-06 Thread Rasmus Lerdorf
> Because software already exists to eliminate the scan/parse > process, speed was not a main concern. The new language > scanner is faster than the old one in all tested scenarios > though. ;) This is so "Sascha"! Looks very nice. Do you think you could LGPL it instead of GPL

Re: [PHP-DEV] Security?

2001-07-04 Thread Rasmus Lerdorf
> I think the main point I agree with is that since many beginning users > use PHP to implement there websites, PHP should be more secure than > other languages, and have less places where the user can mess up. I > think the security section to the documentation is a superb start, > however, I al

Re: [PHP-DEV] Security?

2001-07-03 Thread Rasmus Lerdorf
On 4 Jul 2001, sterling hughes wrote: > Ah well, I'm guessing most people have already seen this, still, I > couldn't help passing it along... There are some good points (nothing > we haven't discussed before) and some pretty bad points as well. A lot of these are rather silly and are actually p

Re: [PHP-DEV] CVS probs

2001-06-30 Thread Rasmus Lerdorf
> [derick@aarde cpdf]$ cvs commit > cvs commit: Examining . > Checking in cpdf.c; > /repository/php4/ext/cpdf/cpdf.c,v <-- cpdf.c > new revision: 1.27; previous revision: 1.26 > done > Can't exec "/usr/local/bin/cvs": No such file or directory at > /repository/CVSROOT/loginfo.pl line 122. > Mail

Re: [PHP-DEV] Bug #10589 Updated: buildconf not compatible with GnuLibtool 1.4

2001-06-29 Thread Rasmus Lerdorf
> No, the libtool 1.4 is seriously bugged.. Jani, I still have yet to see anybody other than you report problems with this recently. -Rasmus -- PHP Development Mailing List To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To co

Re: [PHP-DEV] Karma request

2001-06-29 Thread Rasmus Lerdorf
> Can I get karma in ext/sybase and ext/sybase_ct again? You do -- PHP Development Mailing List To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]

Re: [PHP-DEV] Sablotron leaks

2001-06-24 Thread Rasmus Lerdorf
> $xsl = join("", file("x.xsl")); Blah... I see this a lot. We should probably just relent and make a function that reads an entire file into a string. -Rasmus -- PHP Development Mailing List To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [E

[PHP-DEV] Re: [PHP-DOC] Re: [PHP-DEV] List messages are being delayed?

2001-06-21 Thread Rasmus Lerdorf
> I was talking with some of the people in the local LUG > (www.kernel-panic.org), and the SDPHP, and most where > enhtusiastic about trying to get some host for the > CVS, lists, etc. > > Someone commented last week in #php that you were > using your home connection because there was no > hosting

Re: [PHP-DEV] 4.0.6 Packaged!

2001-06-21 Thread Rasmus Lerdorf
> http://www.php.net/~andi/php-4.0.6.tar.gz > > Tomorrow I'll commit it to the phpweb CVS and we'll announce it on Friday. > Please in the meanwhile make sure that no show stoppers have crept in. > Show stoppers == something is completely broken in the core or a terrible > security hole which need

Re: [PHP-DEV] Re: proposed change in the build-system.

2001-06-21 Thread Rasmus Lerdorf
> > maybe have another 'Using CFLAGS="-I.."' line in the output -or- > > just say 'Adding to CFLAGS="blabla"' when it happens. > > > > haven't really thought about that;-) - we could even have one > > 'Using CFLAGS=""' whenever we enter a directory? > > Well, that might make it

[PHP-DEV] Re: Libtool 1.4 probs..

2001-06-20 Thread Rasmus Lerdorf
> >You should fix your libtool > > Ok. How? :) > For some odd reason, the libtool 1.4 wants to put -L/usr/lib > into the link line..causing a few unexpected results due to > reason I happen to have couple of older versions of some libs there. > configure/compile is ok, but resulting lib isn't. I

Re: [PHP-DEV] Bug #11432 Updated: crash when restoring referencesto objects

2001-06-20 Thread Rasmus Lerdorf
> >> Are you going to MFH it ?? I think this should go into 4.0.6. > >> It has been broken so long now. > > > >no too sure as it really changes a few internals and needs > >_good_ testing! > > > >comments? > > Nope. I can't test it. The HEAD branch doesn't work for me at all > Not sinc

Re: [PHP-DEV] List messages are being delayed?

2001-06-20 Thread Rasmus Lerdorf
> Rasmus (or anyone): > Can you quantify what lists.php.net consumes for bandwidth on > average? As long as it's not some completely outrageous figure, I can > meet all of these criteria... Once you add the cvs server and the snapshots it would eat up the better part of a T1 consistently.

Re: [PHP-DEV] List messages are being delayed?

2001-06-20 Thread Rasmus Lerdorf
> The hard part is finding someone who is willing to do it and does not want a > lot of advertising in return. > > Good Luck. > > BTW, what kind of machine does it take to turn the list out? I know you > were on a dual CPU box with Gig of ram at VA. That'sĀ about what it needs. Not for the maili

Re: [PHP-DEV] List messages are being delayed?

2001-06-20 Thread Rasmus Lerdorf
> From what I can tell, you are hosting this on your own connection at > home/work? Is there no one in the community that is willing to host the > server for you guys? It is on my home DSL connection. And yes, there are people willing, but we are somewhat picky about the terms of such hosting.

Re: [PHP-DEV] List messages are being delayed?

2001-06-20 Thread Rasmus Lerdorf
> For some reason, it seems that messages sent to the lists aren't being > delivered for over 5 hours or more. I only just got a message that I sent > today at 11:30AM. Although, they do show up on the news server pretty > quickly. > > Is anyone else experiencing this? Sure, the lists will be s

Re: [PHP-DEV] bug/dev

2001-06-20 Thread Rasmus Lerdorf
> I know the lists are just back online, so I shouldn't be making feature > requests ... but it would be nice if the bug reports had their own mailing > list instead of being sent to the dev list. > > I can see why you might not want this (dev people work on bugs), but I'm > sure some people would

Re: [PHP-DEV] Unable to unsubscribe from the php-dev@ list..

2001-06-19 Thread Rasmus Lerdorf
> Guess the topic says it all. > Tried both web and the [EMAIL PROTECTED] > > Dont get any confirmation nor 'unsuccessful' replies. I don't see [EMAIL PROTECTED] subscribed to php-dev. Only to php-db and php-announce, so it must have worked. -Rasmus -- PHP Development Mailing List

Re: [PHP-DEV] Modifications for Postgres driver

2001-06-19 Thread Rasmus Lerdorf
This has bugged me as well in the past. Once the cvs server comes back alive, we'll get you set up with a cvs account and you can apply these patches. Stay tuned for a message from Sascha saying it is back. -Rasmus On Tue, 19 Jun 2001, Georg von Zezschwitz wrote: > Hi, > > As I wanted to migr

Re: [PHP-DEV] Lame support for win32 mail() function -rant

2001-05-22 Thread Rasmus Lerdorf
> Open source obviously will take a LONGER time because only programmers that want > to work for free will do it. > Hobbyists and wanna be half ass lamerZ take up the rest of the slack. > > Either you're on a religious OS mission or else forget it! > I'm going back to ASP!! Thank you. -Rasmus

[PHP-DEV] Using $HTTP_SESSION_VARS with register_globals On

2001-05-21 Thread Rasmus Lerdorf
Hey, is there some reason that using something like this isn't working? [ses1.php] [ses2.php] ie. ses1.php starts a session and registers $test to be a session var and then I define it in in the $HTTP_SESSION_VARS array. ses2.php simply prints the value. With register_globals turned off thi

Re: [PHP-DEV] mmap in php_passthru_fd in file.c ?

2001-05-18 Thread Rasmus Lerdorf
> There seem to be some misconceptions about what we are really > doing. We map a shared(*1), read-only copy of the file into > our address space, we don't allocate any memory, we don't > operate on the mmap'ed area, and this does not change when > you "add headers or do somet

Re: [PHP-DEV] Latest commit -- depreciation of call_user_method()

2001-05-18 Thread Rasmus Lerdorf
> >> And btw. Why not have a function in PHP core that can be used to get the > >> desired extensions remotely from pear.php.net? If we have a > >> PHP_#ext#_API_NO, running a 'update_php_extensions()' would > >> go and grab the updated (if the extension HAS been updated) one..etc.. > >> (I'm just

Re: [PHP-DEV] Latest commit -- depreciation of call_user_method()

2001-05-18 Thread Rasmus Lerdorf
> Jani Taskinen wrote: > > Anyway, now I see that there really is good reason having that > > version (PHP_#ext#_API_NO ?) after all. And having that..we should > > propable start moving those extensions one by one into PEAR? > > do we have the infrastructure in PEAR for C code yet ? Not yet, so

Re: [PHP-DEV] Latest commit -- depreciation of call_user_method()

2001-05-18 Thread Rasmus Lerdorf
> Ah. I must have been dreaming then.. :) > I remember that someone submitted some bug report about this very issue. > > Anyway, now I see that there really is good reason having that > version (PHP_#ext#_API_NO ?) after all. And having that..we should > propable start moving those extensions one

Re: [PHP-DEV] Latest commit -- depreciation of call_user_method()

2001-05-18 Thread Rasmus Lerdorf
> >That still doesn't change the fact that it is imprecise to tie the PHP > >version number to extensions when there is no 1:1 relationship here and > >the possibility exists that an older version of the extension can be used > >with a newer version of PHP. > >And more and more, the average PHP us

Re: [PHP-DEV] Latest commit -- depreciation of call_user_method()

2001-05-18 Thread Rasmus Lerdorf
On Fri, 18 May 2001, Jani Taskinen wrote: > On Fri, 18 May 2001, Rasmus Lerdorf wrote: > > >> As long as these extensions are in there, I think changing any of their > >> API's is a justification for 4.x release. > > > >I disagree. Since optional exten

Re: [PHP-DEV] Latest commit -- depreciation of call_user_method()

2001-05-18 Thread Rasmus Lerdorf
> On Thu, 17 May 2001, Rasmus Lerdorf wrote: > > >> I don't agree. Have you noticed the thread about domxml currently running > >> in php-dev@? Wouldn't that justify a 4.1? What would? > > > >No, I don't think a single extension should affect

Re: [PHP-DEV] mmap in php_passthru_fd in file.c ?

2001-05-17 Thread Rasmus Lerdorf
> >>Perhaps automatic detection could be option? if (filesize > X) > >>blockread else mmap? It seems like the most intuitive way to implement > >>it... > >> > > > > Sounds a bit magical. Why not just a block_readfile() function? > > > Mainly the bloat factor, we already have a large core, imho,

Re: [PHP-DEV] mmap in php_passthru_fd in file.c ?

2001-05-17 Thread Rasmus Lerdorf
> > True. But I guess my main issue is still that the behaviour changes > > radically based on a hidden configure check (ie. whether mmap is there > > or not) and that ensuring a block-by-block read in user space is > > inefficient for huge files. > > > > > good point... hrrmmm > > it seems

Re: [PHP-DEV] mmap in php_passthru_fd in file.c ?

2001-05-17 Thread Rasmus Lerdorf
> >>>If a system has mmap() a readfile() will mmap the entire file to memory > >>>and then dump that while without mmap it will read it one block at a time. > >>>That's a siginificant memory difference and one that may not be expected. > >>> > >>>Obviously the mmap will be faster, but if as in bug

RE: [PHP-DEV] Bug #10701 Updated: readfile usage on large files

2001-05-17 Thread Rasmus Lerdorf
> Well, the reason I stayed away from trying to use fgets for a single block > at a time were because of some of the comments from > http://php.net/manual/en/function.fgets.php > > Anyways, an offtopic question if I may, I've tried making .htaccess > parseable by PHP using AddType and also attempt

Re: [PHP-DEV] Zdnet Article

2001-05-17 Thread Rasmus Lerdorf
> Responding to this article only prolongs its life. > > Treat PC Magazine/ZDNET's reviews as you would a 3rd grader's book report. > These are not technical publications; they are the Popular Mechanics of the PC > world. When considering languages/environments to use when building an > applicatio

Re: [PHP-DEV] mmap in php_passthru_fd in file.c ?

2001-05-17 Thread Rasmus Lerdorf
> > If a system has mmap() a readfile() will mmap the entire file to memory > > and then dump that while without mmap it will read it one block at a time. > > That's a siginificant memory difference and one that may not be expected. > > > > Obviously the mmap will be faster, but if as in bug #1070

<    2   3   4   5   6   7   8   9   >