Re: [PHP-DEV] Security implications of parsing env variables in .ini

2023-07-14 Thread BohwaZ
This is a valid concern, as we are side-loading plugins in our software, where plugin information is defined in a .ini file. But somehow I thought that INI_SCANNER_TYPED was a bit like INI_SCANNER_RAW but also able to handle null/true/false values. Unfortunately it's not the case: php > var_expo

Re: [PHP-DEV] Security implications of parsing env variables in .ini

2023-07-14 Thread Dusk
On Jul 14, 2023, at 09:03, David Gebler wrote: > On Fri, Jul 14, 2023 at 3:08 AM Dusk wrote: >> 2) These expansions should probably be disabled by INI_SCANNER_RAW; that >> flag already disables certain other types of value interpolation. (Oddly, >> it doesn't disable expansion of constants either

Re: [PHP-DEV] Security implications of parsing env variables in .ini

2023-07-14 Thread David Gebler
On Fri, Jul 14, 2023 at 3:08 AM Dusk wrote: > 2) These expansions should probably be disabled by INI_SCANNER_RAW; that > flag already disables certain other types of value interpolation. (Oddly, > it doesn't disable expansion of constants either; that might be worth > revisiting as well.) Envir

[PHP-DEV] Re: Default values for php.ini environment variables

2023-07-14 Thread Gabriel Fontes
Hi everyone, PR author here. Thanks a lot for pushing this forward, Derick. Do let me know if you folks have any feedback or concerns about the PR, I'll be happy to address them. Cheers, Gabriel signature.asc Description: PGP signature

[PHP-DEV] Re: Default values for php.ini environment variables

2023-07-14 Thread Gabriel Fontes
Hi everyone, PR author here. Thanks a lot for pushing this forward, Derick! Do let me know if you folks have any feedback or concerns about the PR, I'll be happy to address them. PS: Sorry for the double post, wasn't subscribed before. Cheers, Gabriel signature.asc Description: PGP signatu

[PHP-DEV] freopen() function

2023-07-14 Thread Mikhail Galanin via internals
Hi there, I was checking our codebase and realised that we still use the function proposed by Antony a long time ago [1]. I run through the comments and feel like I can address the issues discussed back then. My question is what would be the best way to move forward? Shall I reopen the PR, create