allow_url_include is deprecated but no reason or consequences are given

[email protected] (Felix Mues)
Newsgroups php.general
Message-ID <[email protected]>
Hi all,

The "Migrating from PHP 7.3.x to 7.4.x" 
(https://www.php.net/manual/en/migration74.deprecated.php) mentions the 
deprecation of the php.ini entry 'allow_url_include*'*, but does not 
give any explanation on the consequences.
Google only pointed me to several stackoverflow links that stated to 
simply remove it or to sett it to 'off', but nobody explained if this 
has any side effects/consequences.

So I come here to ask if you can help me:

Is it now on/off by default?
Did PHP remove the functionality completely?
Is there an alternative configuration flag?
I am aware that there are security issues with allow_url_include as 
mentioned in RFC https://wiki.php.net/rfc/allow_url_include, but this 
RFC was closed without removing it.

Is there anything that developers need to do/know when simply removing 
the flag from PHP.ini?

Why do I ask here and not simply try?
The reason why I am asking is because will get an issue in one module of 
the DVWA project (https://github.com/digininja/DVWA/pulse) and I am not 
familiar enough with this part to distinguish an hidden error from the 
intended way this module should work. On the first blink it seems to be 
okay, but I would like to be sure.

And also this is a documentation issue. A deprecation announcement 
should have at least two sentences about the consequences and on what to 
do if you are affected.

Kind regards

Felix Mues
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.