We need to make sure that remote wrappers register as URL wrappers or they might lead to insecure situations where a remote file can be loaded where the restriction would only allow a local one. I really love the solid language design of PHP.

CommentFileSizeAuthor
grrrrrr.patch1.92 KBchx

Comments

sun.core’s picture

sun.core commented
Status: Needs review » Needs work 
+++ includes/file.inc	2010-10-11 03:22:14 +0000
@@ -7,6 +7,16 @@
+class NoStreamFlagsException extends Exception {

Should be [File]StreamWrapperNoFlagsException or similar - in any case, in File API's or PHP's stream_wrapper namespace.

Powered by Dreditor.

chx’s picture

chx commented
Status: Needs work » Fixed

Current HEAD

        if (($info['type'] & STREAM_WRAPPERS_LOCAL) == STREAM_WRAPPERS_LOCAL) {
          stream_wrapper_register($scheme, $info['class']);
        } 
        else {
          stream_wrapper_register($scheme, $info['class'], STREAM_IS_URL);
        }

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.