Re: [PHP-DEV] About CVE-2012-0831 (magic_quotes_gpc remote disable vulnerability?)

2012-02-15 Thread J David
On Tue, Feb 14, 2012 at 8:35 AM, Ferenc Kovacs wrote: > as far as I can see the referenced fix ( > http://svn.php.net/viewvc?view=revision&revision=323016) never made to the > 5.3.10 release ( > http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3_10/?pathrev=323032&view=log > ) Preface: I am n

Re: [PHP-DEV] About CVE-2012-0831 (magic_quotes_gpc remote disable vulnerability?)

2012-02-15 Thread J David
On Thu, Feb 16, 2012 at 2:33 AM, Rasmus Lerdorf wrote: > On 02/15/2012 11:24 PM, J David wrote: >> The specific circumstance was that magic_quotes_gpc was being set to >> off in Apache via php_flag, rather than in the .ini file.  phpinfo() >> reported magic_quotes_gpc as Off

[PHP-DEV] Interest in a "null" SAPI for embedding?

2013-08-16 Thread J David
Hello, We recently successfully embedded PHP into our application using an approach based on the embed SAPI. However, our application is large and complex, written entirely in C++, requires a bit more functionality than the embed SAPI offers. (As an example, however, it was invaluable.) So we ne

Re: [PHP-DEV] Interest in a "null" SAPI for embedding?

2013-08-17 Thread J David
On Fri, Aug 16, 2013 at 5:28 PM, Sara Golemon wrote: > Ah, I see. I wasn't taking "null" quite literally enough. :) > > That sounds pretty awesome to me. Assuming the implementation looks good > you'd get my vote. "Implementation" might be a little generous… it's a config.m4 file, a header file

Re: [PHP-DEV] Interest in a "null" SAPI for embedding?

2013-08-17 Thread J David
To try it out, here's a hacky little Makefile you can use to build the CLI SAPI against the null shlib: http://pastebin.com/3FxWhZn4 Resulting in: $ ls -l phpn -rwxrwxr-x 1 me staff 113669 Aug 17 00:13 phpn $ ldd phpn phpn: libphp5.so => /usr/local/php/5.6-dev/lib/libphp5.so (0x2808) libc

Re: [PHP-DEV] Interest in a "null" SAPI for embedding?

2013-08-17 Thread J David
On Fri, Aug 16, 2013 at 12:55 PM, Johannes Schlüter wrote: > I was successful by using embedded SAPI for that and ignoring all things > from php_embed.[ch]. Sure this gives few extra symbols and a few bytes > of unneeded code but works fine. Yes, exactly. This is a cleaner/more formal way of doi

Re: [PHP-DEV] Interest in a "null" SAPI for embedding?

2013-08-17 Thread J David
On Fri, Aug 16, 2013 at 12:40 PM, Sara Golemon wrote: > Apart from managing lifecycles, the SAPI is also resposible for things like > directing I/O between the host application, how does null-sapi handle this? It doesn't. It provides no SAPI functionality at all (hence "null"). Its only purpose

Re: [PHP-DEV] Interest in a "null" SAPI for embedding?

2013-08-19 Thread J David
On Fri, Aug 16, 2013 at 9:15 PM, Sara Golemon wrote: > Right, gotcha. I think ideally someone should put in the grunt work to do > what you suggested: Build libphp5.so all the time, then link up > php/mod_php5.so/etc... against that as a shared system library (which in > turn other programs or SA

Re: [PHP-DEV] Interest in a "null" SAPI for embedding?

2013-08-19 Thread J David
On Mon, Aug 19, 2013 at 3:59 PM, Michael Wallner wrote: > I think it all was about to be as standalone as possible, e.g. you > could have a CLI with builtin readline/pcntl/whatelse extensions, > while mod_php could be kept lean of that and include an > opcache/whatelse instead. To stick with your

Re: [PHP-DEV] Interest in a "null" SAPI for embedding?

2013-08-19 Thread J David
On Mon, Aug 19, 2013 at 7:49 PM, Johannes Schlüter wrote: > Ah, there's another thing to mind: Extensions can be marked as "cli > extensions", if statically compiled they become only part of the CLI > binary, not other SAPIs. Think readline & pcntl. The logical expectation then would be not to in