#3 issues with php-inc-protect and URI-like protocols (streams)

[Daniel Lorch]

Looking at php_is_valid_include()'s "3. must not be a
URL" condition the code seems a bit crude, no? This
will effectively disable PHP's streams feature as these
are all represented in URI-like fashion
(compress.zlib://, compress.bz2://, php:// for
stdin/stdout/stderr AND the perfectly legal file://).
Considering that there exists a 'allow_url_fopen'
option, there must be already code somewhere, deeply
hidden in PHP's source code, which distinquishes
between remote and local protocols. One just needs to
find it (I couldn't).

[Stefan Esser]

Logged In: YES
user_id=141518

This is not a bug, but a documented feature. Switching off
allow_url_fopen will disable all URLs, too.

Any change to this is a request for changed functionality...