Re: [PHP-DEV] [RFC] Under Discussion: Default User-Agent for cURL

2021-06-26 Thread Michael Maroszek
Hi Aleksander, That's what I also thought when making the PR and therefore I initially went with PHP_INI_ALL. But Tyson made a good point that the curl.cainfo is PHP_INI_SYSTEM and we might want to be consistent about modes inside an extension. I'd love to hear some more opinions on which direct

Re: [PHP-DEV] [RFC] Add Random Extension (before: Add Random class)

2021-06-26 Thread Larry Garfield
On Fri, Jun 25, 2021, at 7:39 PM, Go Kudo wrote: > Hello Internals. > > RFC has been reorganized for finalization. > > https://wiki.php.net/rfc/rng_extension > > The changes from the previous version are as follows: > > - Changed again to a class-based approach. The argument can be omitted, in

Re: [PHP-DEV] [RFC] Deprecate boolean to string coercion

2021-06-26 Thread Kamil Tekiela
Hi George, As someone who has fallen victim to this silent bug in the past, I think I would be on board with this change. Why only implicit casting? If we compare this to the array-to-string casting then the warning happens for both. It would be more consistent to deprecate both implicit and expli

Re: [PHP-DEV] is_literal() is back

2021-06-26 Thread Mike Schinkel
> On Jun 26, 2021, at 10:03 AM, Craig Francis wrote: > > Just a quick reply at the moment, but what happens if a db library had a > method to set what was in the LIMIT part of a query, you did the MySQL thing > of “30, 10” to get paginated results, and then one day the library changed to > req

Re: [PHP-DEV] [RFC] Name issue - is_literal/is_trusted

2021-06-26 Thread Rowan Tommins
On 26/06/2021 14:47, Dan Ackroyd wrote: There is a line of code that has a bad assumption of whether $color is a literal string or not, and it's that line of code that needs to be changed, to use something that understands HTML escaping, in particular how to escape user input for html attribute c

Re: [PHP-DEV] is_literal() is back

2021-06-26 Thread Craig Francis
Just a quick reply at the moment, but what happens if a db library had a method to set what was in the LIMIT part of a query, you did the MySQL thing of “30, 10” to get paginated results, and then one day the library changed to require the argument to be an integer? On Sat, 26 Jun 2021 at 2:51

Re: [PHP-DEV] is_literal() is back

2021-06-26 Thread Mike Schinkel
The idea behind is_literal() is of good intention, but as they say the road to hell is paved with good intentions. The RFC proposes to add an internal "literal" flag to a string, the is_literal() function, and nothing else. Further the RFC states a vision to get "libraries to start using is_l

Re: [PHP-DEV] [RFC] Name issue - is_literal/is_trusted

2021-06-26 Thread Dan Ackroyd
On Sat, 26 Jun 2021 at 13:47, Rowan Tommins wrote: > the actual bug will almost certainly have happened somewhere else in the > program, and you'll need to trace the data flow of $foo and $bar to find out > where. > That depends on what you mean by bug. In particular I don't agree that "The act

Re: [PHP-DEV] [RFC] Name issue - is_literal/is_trusted

2021-06-26 Thread Rowan Tommins
On 26 June 2021 13:24:55 BST, Dan Ackroyd wrote: >It allows silly mistakes to slip through and make it to production. As > per https://news-web.php.net/php.internals/114858: Perhaps you missed my reply earlier where I pointed out that the traceability problem you've identified is valid, but not

Re: [PHP-DEV] [RFC] Name issue - is_literal/is_trusted

2021-06-26 Thread Joe Watkins
Please, stop spamming us with the same comments. Cheers Joe On Sat, 26 Jun 2021 at 14:25, Dan Ackroyd wrote: > On Fri, 25 Jun 2021 at 00:57, Craig Francis > wrote: > > > Dan Ackroyd wrote: > > > Please can you go into some detail about what you think people are > > > meant to do when they det

Re: [PHP-DEV] is_literal() is back

2021-06-26 Thread Dan Ackroyd
On Fri, 25 Jun 2021 at 23:21, Craig Francis wrote: > > We're going back to the original is_literal() proposal. Please stop adding my name as a contributor to this RFC. I explicitly removed my name from the document yesterday when I first realised it was there. I don't support the RFC as it is.

Re: [PHP-DEV] is_literal() is back

2021-06-26 Thread Dan Ackroyd
Craig, On Fri, 25 Jun 2021 at 23:21, Craig Francis wrote: > > We're going back to the original is_literal() proposal. > > https://wiki.php.net/rfc/is_literal The RFC still contains carrying the string literal flag through string concatenation, which is still not a good idea. And it still doesn'

Re: [PHP-DEV] [RFC] Name issue - is_literal/is_trusted

2021-06-26 Thread Dan Ackroyd
On Fri, 25 Jun 2021 at 00:57, Craig Francis wrote: > > Dan Ackroyd wrote: > > Please can you go into some detail about what you think people are > > meant to do when they detect a non-literal used where a literal is > > expected? > > By using a simple function, it allows the library to handle > t

Re: [PHP-DEV] [RFC] Add Random Extension (before: Add Random class)

2021-06-26 Thread Mel Dafert
On 26 June 2021 02:39:52 CEST, Go Kudo wrote: >Hello Internals. > >RFC has been reorganized for finalization. > >https://wiki.php.net/rfc/rng_extension > >The changes from the previous version are as follows: > >- Changed again to a class-based approach. The argument can be omitted, in >which case

Re: [PHP-DEV] [RFC] Add Random Extension (before: Add Random class)

2021-06-26 Thread Kamil Tekiela
Hi Go Kudo, I find this iteration acceptable, but I have one last complaint. Why the double namespace? Can it not be simply Random/RandomNumberGenerator? Can you also clarify what happens when serialization or cloning fails? Regards, Kamil

Re: [PHP-DEV] [RFC] Under Discussion: Default User-Agent for cURL

2021-06-26 Thread Aleksander Machniak
On 25.06.2021 16:33, Michael Maroszek wrote: > > Please have a look at the full RFC: https://wiki.php.net/rfc/curl_user_agent > > There is one open issue which Tyson raised to find the correct mode for the > ini option. Either PHP_INI_ALL or PHP_INI_SYSTEM is currently being > discussed. See here