Date: Thu, 28 Jun 2012 14:58:20 -0700 From: Rasmus Lerdorf <rasmus@...dorf.com> To: Kurt Seifried <kseifried@...hat.com> CC: oss-security@...ts.openwall.com, Stuart Henderson <stu@...cehopper.org>, "security@....net" <security@....net> Subject: Re: Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 06/28/2012 11:29 AM, Kurt Seifried wrote: > Yeah my bad, I just skimmed the list (it was late). Just for > future reference as well the other magic values are: > > ext/standard/info.h:#define PHP_LOGO_GUID > "PHPE9568F34-D428-11d2-A769-00AA001ACF42" > > ext/standard/info.h:#define PHP_EGG_LOGO_GUID > "PHPE9568F36-D428-11d2-A769-00AA001ACF42" > > ext/standard/info.h:#define ZEND_LOGO_GUID > "PHPE9568F35-D428-11d2-A769-00AA001ACF42" > > ext/standard/info.h:#define PHP_CREDITS_GUID > "PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000" > > I guess I'm just not a huge fan of surprises in my software =). > The expose_php variable appears to control them all no problem. Just for some history on this somewhat odd feature. It was added in order to be able to put the PHP logo on the phpinfo() page. We had originally just used an img link to php.net, but got a lot of phone-home privacy complaints about that. So we needed a way to display an image locally and didn't want to have to try to figure out where to copy that image during installation, plus it would be hard to manage access to it and the overall idea of copying anything to someone's docroot just sucks. So, we could either have given up on it, or, bake it into PHP this way along with an ini switch to disable it. The motivation wasn't to add an easter egg. The April 1 PHP_EGG_LOGO_GUID came later. - -Rasmus -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk/s03cACgkQlxayKTuqOuAVIACfRZUNmyZ0j60jvbMTw5iFy0cD mU0An0GLB/uKkLQ2Dhf7QffM+EiEkcmJ =mdWv -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.