RE: Security Proposal

This message was sent from: Development
http://forums.oscommerce.com/viewtopic.php?p=184260#184260
----------------------------------------------------------------

Liv--

Thanks for the info, guess I'll give them a try then and see what happens.

PLM--
I do believe the register_globals issue is going to be around a while.  I think it's been on the workboard for quite some time already as something that is going to done, but no one assigned to it.

I looked into trying this myself and gave up rather quickly :)  Technically, register_globals shouldn't be a problem if you have plenty of variable validation.  I started working on that too and it seemed like an even larger task ;)

Global calls are in tons of the functions, so it would take a while just to weed them all out and I don't know if I would trust a cross-file search & replace prog to get the job done...assuming there was some blanket place to move them too.  I guess they (globally called variables) can either be moved to the actual $GLOBALS superarray (is this still around with register_globals off?) or $_SESSION or maybe even $_COOKIE if they ever become "mandatory"?  I have no idea what harald and the team have in mind...

If you happen to figure out a "short route" to making it compliant, I am sure many would be interested in it...