Gallery

> > Bad bad idea.  I assume you are doing this to stop people
> > from loading the
> > .inc files directly and having a look at the code.  So
> > instead you change
> > it so this code gets executed out of context.  That's far worse!
>
> I'll let Chris answer the above part.
>
> > The correct way to handle this is to add something like this to your
> > .htaccess file:
> >
> >   <Files ~ "\.inc$">
> >       Order allow,deny
> >       Deny from all
> >   </Files>
>
> It's not a given that our end user can use .htaccess files.  I
> don't have any hard statistics, but I regularly hear from users
> who don't have this capability, so all .htaccess use is optional
> in Gallery.

Then also have an option to place the .inc files outside of the
document_root.

-Rasmus

What bharat said about the htaccess is my reasoning for not taking that
approach. Lots of our users also do not have access outside of their
document_root...

You are correct that there is a possibility that some code might get
executed out of context with this naming convention. But this is true of any
of our scripts (like delete_photo.php) And we should watch that we maintain
the proper security checks in these include files (like we do in scripts
like delete_photo). I just think it's really bad form to see source code in
a browser. And I've noticed some other projects using this naming cenvention
lately (like phpgroupware). Anyway, we might have to just disagree on this
one.

See ya,
chris

> > > Bad bad idea.  I assume you are doing this to stop people
> > > from loading the
> > > .inc files directly and having a look at the code.  So
> > > instead you change
> > > it so this code gets executed out of context.  That's far worse!
> >
> > I'll let Chris answer the above part.
> >
> > > The correct way to handle this is to add something like this to your
> > > .htaccess file:
> > >
> > >   <Files ~ "\.inc$">
> > >       Order allow,deny
> > >       Deny from all
> > >   </Files>
> >
> > It's not a given that our end user can use .htaccess files.  I
> > don't have any hard statistics, but I regularly hear from users
> > who don't have this capability, so all .htaccess use is optional
> > in Gallery.
>
> Then also have an option to place the .inc files outside of the
> document_root.
>
> -Rasmus
>

> You are correct that there is a possibility that some code might get
> executed out of context with this naming convention. But this is true of any
> of our scripts (like delete_photo.php) And we should watch that we maintain
> the proper security checks in these include files (like we do in scripts
> like delete_photo). I just think it's really bad form to see source code in
> a browser. And I've noticed some other projects using this naming cenvention
> lately (like phpgroupware). Anyway, we might have to just disagree on this
> one.

Well, could you at least make it configurable?  I'd hate to have to fork
this stuff for my own use.

-Rasmus

> > You are correct that there is a possibility that some code might get
> > executed out of context with this naming convention. But this is true of
any
> > of our scripts (like delete_photo.php) And we should watch that we
maintain
> > the proper security checks in these include files (like we do in scripts
> > like delete_photo). I just think it's really bad form to see source code
in
> > a browser. And I've noticed some other projects using this naming
cenvention
> > lately (like phpgroupware). Anyway, we might have to just disagree on
this
> > one.
>
> Well, could you at least make it configurable?  I'd hate to have to fork
> this stuff for my own use.
>

Hey, be careful where you stick that fork! It's all fun and games until
someone loses an eye! :)

Actually I've been chatting with bharat, and he beat on me as well, so I'm
going to change it back. No biggie.

peace,
chris

> > > You are correct that there is a possibility that some code might get
> > > executed out of context with this naming convention. But this is true of
> any
> > > of our scripts (like delete_photo.php) And we should watch that we
> maintain
> > > the proper security checks in these include files (like we do in scripts
> > > like delete_photo). I just think it's really bad form to see source code
> in
> > > a browser. And I've noticed some other projects using this naming
> cenvention
> > > lately (like phpgroupware). Anyway, we might have to just disagree on
> this
> > > one.
> >
> > Well, could you at least make it configurable?  I'd hate to have to fork
> > this stuff for my own use.
> >
>
> Hey, be careful where you stick that fork! It's all fun and games until
> someone loses an eye! :)
>
> Actually I've been chatting with bharat, and he beat on me as well, so I'm
> going to change it back. No biggie.

I think it would be a good idea to have some sort of workaround for people
who have no .htaccess, httpd.conf access nor non-doc_root access.  But
that shouldn't be at the expense of people who do.

The setup script could loop through and mv *.inc to *.inc.php and you
could have a $inc variable you would append in the code.

-Rasmus