=== modified file 'includes/file.inc'
--- includes/file.inc	2010-10-05 06:23:18 +0000
+++ includes/file.inc	2010-10-11 03:22:14 +0000
@@ -7,6 +7,16 @@
  */
 
 /**
+ * Exception thrown on stream registration if the flags are unsupported.
+ *
+ * PHP 5.2.4 added the flags argument to stream_wrapper_register() and
+ * any module trying to use that on an earlier version needs to die
+ * because of the security risk.
+ */
+class NoStreamFlagsException extends Exception {
+}
+
+/**
  * Manually include stream wrapper code.
  *
  * Stream wrapper code is included here because there are cases where
@@ -122,7 +132,15 @@ function file_get_stream_wrappers($filte
         else {
           $wrappers[$scheme]['override'] = FALSE;
         }
-        stream_wrapper_register($scheme, $info['class']);
+        if ($info['type'] & STREAM_WRAPPERS_REMOTE == STREAM_WRAPPERS_REMOTE) {
+          if (version_compare(PHP_VERSION, '5.2.4') < 0) {
+            throw new NoStreamFlagsException(t('This PHP version does not support registering URL wrappers. It is not secure to continue. Terminating.'));
+          }
+          stream_wrapper_register($scheme, $info['class'], STREAM_IS_URL);
+        }
+        else {
+          stream_wrapper_register($scheme, $info['class']);
+        }
       }
       // Pre-populate the static cache with the filters most typically used.
       $wrappers_storage[STREAM_WRAPPERS_ALL][$scheme] = $wrappers[$scheme];

=== modified file 'includes/stream_wrappers.inc'
--- includes/stream_wrappers.inc	2010-08-17 22:05:22 +0000
+++ includes/stream_wrappers.inc	2010-10-11 03:23:48 +0000
@@ -36,6 +36,9 @@ define('STREAM_WRAPPERS_LOCAL', 0x0001);
 
 /**
  * Stream wrapper bit flag -- refers to a remote filesystem location.
+ *
+ * Any module using this flag should require at least PHP 5.2.4, trying to use
+ * a remote wrapper on earlier versions is insecure and throws an exception.
  */
 define('STREAM_WRAPPERS_REMOTE', 0x0002);