Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Forbid a few other dangerous functions #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
OndraM merged 1 commit into main from feature/add-forbidden-calls
Nov 25, 2020
Merged

Conversation

@OndraM
Copy link
Contributor

@OndraM OndraM commented Nov 24, 2020

spaze reacted with heart emoji
@OndraM OndraM changed the title (削除) Forbid more dangerous functions (削除ここまで) (追記) Forbid a few other dangerous functions (追記ここまで) Nov 25, 2020
posix_mkfifo: null # do not create named pipes in the script
posix_mknod: null # do not create special files in the script
proc_nice: null # changes the priority of the current process
putenv: null # might overwrite existing variables
Copy link

@florianjiri florianjiri Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tady stimhle bych byl opatrny, dost se to pouziva

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Envy bys v aplikaci nemel vytvaret, jen prijimat.

OndraM and petrofcikmatus reacted with thumbs up emoji
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Máš nějaký příklad?

V pár specifických případech se to asi používá oprávněně (třeba v command-line tools), tam bych si to pak dal do výjimek.

Copy link

@florianjiri florianjiri Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Jop vetsinou se jedna o command-line, nebo o testy.

treba priklad

$input = new ArgvInput();
if (null !== $_ENV['APP_ENV'] = $input->getParameterOption(['--env', '-e'], null, true)) {
 putenv('APP_ENV='.$_ENV['APP_ENV']);
 // force loading .env files when --env is defined
 $_SERVER['APP_ENV'] = null;
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tohle ale bude v nějakém bootstrap.php nebo index.php, kde už je beztak i require_once (načítá se composer autoloader), takže to stejně bude ve výjimkách, ne?

Copy link

@hokypierce hokypierce Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nejenom tam, vyuziva to napr. SF komponenta Dotenv

Copy link

@florianjiri florianjiri Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@hokypierce To jo, ale ty sám to ze svého kódu mimo nějaký index.php nevoláš, nebo jo? Kdyžtak mi hoď do Slacku link do bitbucket jestli to někde máte, kouknu.

Copy link

@hokypierce hokypierce Nov 25, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@OndraM mas pravdu ze to je jen z bootstrapu pri init app

OndraM reacted with thumbs up emoji
@OndraM OndraM merged commit 68284bf into main Nov 25, 2020
@OndraM OndraM deleted the feature/add-forbidden-calls branch November 27, 2020 00:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jirinovak jirinovak Awaiting requested review from jirinovak

@dudla dudla Awaiting requested review from dudla

@kdosiodjinud kdosiodjinud Awaiting requested review from kdosiodjinud

@MarketaSebkova MarketaSebkova Awaiting requested review from MarketaSebkova

@janicekt janicekt Awaiting requested review from janicekt

6 more reviewers

@legendik legendik legendik approved these changes

@florianjiri florianjiri florianjiri left review comments

@sustmi sustmi sustmi approved these changes

@jpreuss jpreuss jpreuss approved these changes

@hokypierce hokypierce hokypierce approved these changes

@obelixicek obelixicek obelixicek approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

enhancement New feature or request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

AltStyle によって変換されたページ (->オリジナル) /