[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 28 Jun 2012 14:58:20 -0700
From: Rasmus Lerdorf <rasmus@...dorf.com>
To: Kurt Seifried <kseifried@...hat.com>
CC: oss-security@...ts.openwall.com,
Stuart Henderson <stu@...cehopper.org>,
"security@....net" <security@....net>
Subject: Re: Re: PHP information disclosure via easter egg
?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 06/28/2012 11:29 AM, Kurt Seifried wrote:
> Yeah my bad, I just skimmed the list (it was late). Just for
> future reference as well the other magic values are:
>
> ext/standard/info.h:#define PHP_LOGO_GUID
> "PHPE9568F34-D428-11d2-A769-00AA001ACF42"
>
> ext/standard/info.h:#define PHP_EGG_LOGO_GUID
> "PHPE9568F36-D428-11d2-A769-00AA001ACF42"
>
> ext/standard/info.h:#define ZEND_LOGO_GUID
> "PHPE9568F35-D428-11d2-A769-00AA001ACF42"
>
> ext/standard/info.h:#define PHP_CREDITS_GUID
> "PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000"
>
> I guess I'm just not a huge fan of surprises in my software =).
> The expose_php variable appears to control them all no problem.
Just for some history on this somewhat odd feature. It was added in
order to be able to put the PHP logo on the phpinfo() page. We had
originally just used an img link to php.net, but got a lot of
phone-home privacy complaints about that. So we needed a way to
display an image locally and didn't want to have to try to figure out
where to copy that image during installation, plus it would be hard to
manage access to it and the overall idea of copying anything to
someone's docroot just sucks. So, we could either have given up on it,
or, bake it into PHP this way along with an ini switch to disable it.
The motivation wasn't to add an easter egg. The April 1
PHP_EGG_LOGO_GUID came later.
- -Rasmus
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk/s03cACgkQlxayKTuqOuAVIACfRZUNmyZ0j60jvbMTw5iFy0cD
mU0An0GLB/uKkLQ2Dhf7QffM+EiEkcmJ
=mdWv
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
