Re: php5 README.Debian.security

[Ondřej Surý <ondrej@sury.org>]

Hi Justin,

thanks a lot for a quick review.

2012/2/8 Justin B Rye <jbr@edlug.org.uk>:
> More importantly, I assume when it says "code written in the PHP
> language" it means non-packaged end-user code - this could clearer.
> Maybe s/code/user scripts/ ?

I think it means both, e.g. packages in PHP language and user scripts
written in PHP, but I let Thijs to clarify here.

>> - vulnerabilities involving any kind of open_basedir violation, as
>>   this is considered a security model neither by us nor PHP upstream.
>
> More idiomatically:
>    this is not considered a security model either by us or by PHP upstream.
> (but what exactly is the "this" referring back to here?)

 * Vulnerabilities involving any kind of open_basedir violation, as
   this feature is not considered a security model either by us or by
   PHP upstream.

or

 * Vulnerabilities involving any kind of open_basedir violation, as
   open_basedir feature is not considered a security model either by us or by
   PHP upstream.

O.
-- 
Ondřej Surý <ondrej@sury.org>