Re: [Phpwiki-talk] XMLRPC vulnerability security advise

[Reini U. <ru...@x-...>]

> Ah, NIH syndrome sometimes pays out *g*. I've been using a homegrown
> xmlrpc library in my pet projects, mainly because I was unhappy with the
> strange API of Edd Dumbills library.
>
> http://upgradephp.berlios.de/

Looks fine to me. I'll give it a try.
I don't know if we need method fingerprints and restricted parameter
types, guess not.

> It's slightly bloated, because it engages a wannabe XML parser
> if there is not native support in PHP. Additionally it also takes
> advantage of the native XML-RPC extension (PECL) if it's present
> (like the current PhpWiki xmlrpc interface does). And it definitely
> contains no stupid code involving eval(), but it doesn't care about
> method fingerprints or restricts parameter types like most other
> implementations do.
> But maybe you want to give it a try anyhow (easier to use, more
> HTTP compliant).
-- 
Reini Urban
http://phpwiki.org/   http://xarch.tu-graz.ac.at/home/rurban/