[PHP-DEV] OWASP Spring of Code 2007 - tentative call for PHP security proposals

2007-01-24 Thread Andrew van der Stock
Hi there, OWASP has just concluded the Autumn of Code 2006, which was very successful in getting some great security projects matured or completed, including the Testing Guide, which is a great resource for penetration testers. http://www.owasp.org/index.php/Owasp_Autumn_Of_Code_2006 It was so s

Re: [PHP-DEV] technical question

2007-01-24 Thread Stanislav Malyshev
As far as I understood, php loads requires modules at startup. Which impact If they are loaded through extension= directive and not compiled in. does that have on which function a developer can call from within an extension. I mean, is it possible to call functions from other extensions besid

Re: [PHP-DEV] Runtime-JIT, the whole enchilada

2007-01-24 Thread Ilia Alshanetsky
What are the numbers before the patch? On 24-Jan-07, at 2:58 PM, Sara Golemon wrote: Dmitry- You asked for it, you get it :) Hopefully it'll be self- explanatory, the one part I hope you don't notice is that I put the auto_global check back into fetch_simple_variable_ex in order to for

[PHP-DEV] Runtime-JIT, the whole enchilada

2007-01-24 Thread Sara Golemon
Dmitry- You asked for it, you get it :) Hopefully it'll be self-explanatory, the one part I hope you don't notice is that I put the auto_global check back into fetch_simple_variable_ex in order to force direct access to autoglobals ($foo = $_GET;foreach($_POST as ...) etc...) as non-a

Re: [PHP-DEV] Re: [Patch] mysql_set_charset for mysql ext

2007-01-24 Thread Ilia Alshanetsky
The patch will need to wait for 5.2.2, it is too late for it to be accepted into 5.2.1 tree. Ilia -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DEV] Re: [Patch] mysql_set_charset for mysql ext

2007-01-24 Thread Scott MacVicar
I'm surprised I didn't find this last October when I posted the first round. Unfortunately most system administrators realise mysql isn't enabled by default with PHP 5 and then just enable mysql alone ignoreing mysqli. Since this could be considered a security fix I'm hoping Derick will make

Re: [PHP-DEV] Re: [Patch] mysql_set_charset for mysql ext

2007-01-24 Thread Luca Longinotti
> On 1/24/07, Scott MacVicar <[EMAIL PROTECTED]> wrote: >> This is a gentle nudge, there was no interest since this was posted 2 >> months ago, we had a client who get exploited recently because of this >> issue. We use mysqli where appropriate but sometimes its not available >> because hosts don't

Re: [PHP-DEV] Re: [Patch] mysql_set_charset for mysql ext

2007-01-24 Thread Olivier Hill
Hello Scott, I did something similar a while ago. You can see [1] why this will not be included in PHP4, as it is considered a new feature. Regards, Olivier [1] http://marc.theaimsgroup.com/?t=11522002784&r=1&w=2 On 1/24/07, Scott MacVicar <[EMAIL PROTECTED]> wrote: This is a gentle nudge,

[PHP-DEV] Re: [Patch] mysql_set_charset for mysql ext

2007-01-24 Thread Scott MacVicar
This is a gentle nudge, there was no interest since this was posted 2 months ago, we had a client who get exploited recently because of this issue. We use mysqli where appropriate but sometimes its not available because hosts don't know any better. Since there are no plans to deprecate the mys

[PHP-DEV] technical question

2007-01-24 Thread Oliver Block
Hello, As far as I understood, php loads requires modules at startup. Which impact does that have on which function a developer can call from within an extension. I mean, is it possible to call functions from other extensions besides ext/standard? And how? Regards, Oliver -- PHP Internals -

[PHP-DEV] RE: Autoglobal CVs without silence -- Summary

2007-01-24 Thread Dmitry Stogov
Hi Sara, Thank you for detailed description, now I see goal that was hidden from me. I am litle bit afraid about FETCH_DIM/FETCH_OBJ patch, because it probably will slowdown each array operation, and I still don't understand what is wrong with silence. Can you show the whole patch (with FETCH_DI

Re: [PHP-DEV] Autoglobal CVs without silence -- Summary

2007-01-24 Thread Hartmut Holzgraefe
Sara wrote: > I've produced a couple of major lightbulb moments in people with this explanation, but it all stems from introducing the concept of an object's handle rather than saying objects are reference by default. i usually got these "aha!" events when using inodes and hard links as metaphe

[PHP-DEV] [PATCH] multicast support (ext/sockets)

2007-01-24 Thread Daniel Rozsnyo
Hello, Last year I've made a patch for full multicast support and I think it might be useful for others. Can somebody check if the implementation is correct (especially handling of params/args) and then include it to official source code? Patch attached (written for 5.1.4), more information c

RE: [PHP-DEV] Autoglobal CVs without silence -- Summary

2007-01-24 Thread Ford, Mike
> -Original Message- > From: Sara Golemon [mailto:[EMAIL PROTECTED] > Sent: 23 January 2007 19:02 > * - Sidenote: I refuse to call object behavior "reference by > default", > I've had too many people notice that it's not actually true Hear, hear. My favourite terminology here (and I'