[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] Re: PHP information disclosure via easter egg ?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08
From:       Rasmus Lerdorf <rasmus () lerdorf ! com>
Date:       2012-06-28 21:58:20
Message-ID: 4FECD37C.900 () lerdorf ! com
[Download RAW message or body]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/28/2012 11:29 AM, Kurt Seifried wrote:
> Yeah my bad, I just skimmed the list (it was late). Just for
> future reference as well the other magic values are:
> 
> ext/standard/info.h:#define PHP_LOGO_GUID 
> "PHPE9568F34-D428-11d2-A769-00AA001ACF42"
> 
> ext/standard/info.h:#define PHP_EGG_LOGO_GUID 
> "PHPE9568F36-D428-11d2-A769-00AA001ACF42"
> 
> ext/standard/info.h:#define ZEND_LOGO_GUID 
> "PHPE9568F35-D428-11d2-A769-00AA001ACF42"
> 
> ext/standard/info.h:#define PHP_CREDITS_GUID 
> "PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000"
> 
> I guess I'm just not a huge fan of surprises in my software =).
> The expose_php variable appears to control them all no problem.

Just for some history on this somewhat odd feature. It was added in
order to be able to put the PHP logo on the phpinfo() page. We had
originally just used an img link to php.net, but got a lot of
phone-home privacy complaints about that. So we needed a way to
display an image locally and didn't want to have to try to figure out
where to copy that image during installation, plus it would be hard to
manage access to it and the overall idea of copying anything to
someone's docroot just sucks. So, we could either have given up on it,
or, bake it into PHP this way along with an ini switch to disable it.
The motivation wasn't to add an easter egg. The April 1
PHP_EGG_LOGO_GUID came later.

- -Rasmus
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk/s03cACgkQlxayKTuqOuAVIACfRZUNmyZ0j60jvbMTw5iFy0cD
mU0An0GLB/uKkLQ2Dhf7QffM+EiEkcmJ
=mdWv
-----END PGP SIGNATURE-----
[prev in list] [next in list] [prev in thread] [next in thread]