Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:110106
MIME-Version: 1.0
References: <2157564.YClJE7JIHU@mcmic-probook> <CAHE1EduK5idMXWLhBopX4boHfDAAryGA=MGCkDA236GxfVrpwQ@mail.gmail.com>
In-Reply-To: <CAHE1EduK5idMXWLhBopX4boHfDAAryGA=MGCkDA236GxfVrpwQ@mail.gmail.com>
Date: Sun, 10 May 2020 10:02:33 -0300
Message-ID: <CAEsg9X3ORtBDZ4me=6aGD64Utt2A9sYfD2d9SR-FiuJsJS1B8A@mail.gmail.com>
To: Craig Duncan <php@duncanc.co.uk>
Cc: =?UTF-8?Q?C=C3=B4me_Chilliet?= <come.chilliet@fusiondirectory.org>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000009c8b1805a54ad824"
Subject: Re: [PHP-DEV] max_input_vars trigger detection
From: david.proweb@gmail.com (David Rodrigues)

--0000000000009c8b1805a54ad824
Content-Type: text/plain; charset="UTF-8"

Maybe throw an exception by default when it happen. Considering
max_input_vars+1, when hit, throw.

Em dom, 10 de mai de 2020 09:34, Craig Duncan <php@duncanc.co.uk> escreveu:

> >
> > Although not particularly elegant, and it does require you to reject
> requests that hit but don't exceed the limit, I've used this approach
> before:
>
>
> $max = ini_get("max_input_vars") - 1;
> $check = count($_REQUEST);
> if ($check > $max) {
>      throw new RequestException("Request is too large, only {$max} input
> variables are permitted");
> }
>

--0000000000009c8b1805a54ad824--