Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading

2013-01-17 Thread Pierrick Charron
Great :) Thanks for the update On 17 January 2013 15:35, Stas Malyshev wrote: > Hi! > >> What's the status of this fix ? > > The pull is in the RFC, so I planned to do the vote on Monday and then > get it merged if nobody objects. > -- > Stanislav Malyshev, Software Architect > SugarCRM: http://w

Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading

2013-01-17 Thread Stas Malyshev
Hi! > What's the status of this fix ? The pull is in the RFC, so I planned to do the vote on Monday and then get it merged if nobody objects. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227 -- PHP Internals - PHP Runtime Development Mailing L

Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading

2013-01-17 Thread Pierrick Charron
Hi Stas, What's the status of this fix ? Thanks Pierrick On 8 January 2013 04:23, Stas Malyshev wrote: > Hi! > >> Looks good to me, just it could be great to add a new cURL option at >> the same time to disable the '@' usage so that someone working with >> the new ext/curl version can disable i

Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading

2013-01-08 Thread Stas Malyshev
Hi! > Looks good to me, just it could be great to add a new cURL option at > the same time to disable the '@' usage so that someone working with > the new ext/curl version can disable it and therefore send values > starting by @ That is a good suggestion, I'll add CURL_SAFE_POSTFIELDS which would

Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading

2013-01-07 Thread Pierrick Charron
Looks good to me, just it could be great to add a new cURL option at the same time to disable the '@' usage so that someone working with the new ext/curl version can disable it and therefore send values starting by @ Pierrick On 7 January 2013 01:40, Stas Malyshev wrote: > Hi! > > I've added the

Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading

2013-01-06 Thread Stas Malyshev
Hi! > Couldn’t CurlFile extend SplFileInfo? Otherwise it looks good. I don't see much reason for that. They are very different classes - CurlFile is not meant to provide information about the file, just keep the name, MIME type, etc. So most of the SplFileInfo API will be useless there. -- Stani

Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading

2013-01-06 Thread Stas Malyshev
Hi! I've added the pull request for the CURLFile here: https://github.com/php/php-src/pull/255 No procedural API yet, I'm not really sure if we need it, it's not that hard writing "new CurlFile()". But if needed I can add it there. Everybody please take a look and see if you notice any problems o

Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading

2013-01-06 Thread Stas Malyshev
Hi! > cURL allow you to upload file from string buffer with CURLFORM_BUFFER > and we should be able to do all the streams stuff with CURLFORM_STREAM > and by modifying our CURLOPT_READFUNCTION. CURLFORM_STREAM has one issue - you can only have one read function, but you could have many uploaded f

Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading

2013-01-06 Thread Pierrick Charron
Hi Stas, Everything looks good to me :) Great job. About your optional section : I like the procedural function that you proposed so that you don't have to use an object if you don't want to. cURL allow you to upload file from string buffer with CURLFORM_BUFFER and we should be able to do all t

Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading

2013-01-06 Thread Levi Morrison
My objection is that we are introducing a class into an otherwise completely procedural API. -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading

2013-01-06 Thread Lars Strojny
Hi Stas, Am 06.01.2013 um 06:38 schrieb Stas Malyshev : [...] > Following the recent discussion on the list, I've drafted an RFC > describing the CurlFile solution for it here: > > https://wiki.php.net/rfc/curl-file-upload > > Please review and comment. If there's a general positive feedback, I'

Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading

2013-01-06 Thread Martin Jansen
On 06.01.13 06:38, Stas Malyshev wrote: > https://wiki.php.net/rfc/curl-file-upload > > Please review and comment. If there's a general positive feedback, I'll > try to implement a patch for it pretty soon. Looks solid to me. One thing though: The manual spells the extension "cURL" and so does h

Re: [PHP-DEV] [RFC] Fixing insecure cURL file uploading

2013-01-06 Thread Alexey Zakhlestin
On 06.01.2013, at 6:38, Stas Malyshev wrote: > Following the recent discussion on the list, I've drafted an RFC > describing the CurlFile solution for it here: > > https://wiki.php.net/rfc/curl-file-upload > > Please review and comment. If there's a general positive feedback, I'll > try to imp