Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118617
MIME-Version: 1.0
References: <8479bc9a-6ed6-0cf1-c727-123e2b87a8d6@dafert.at>
In-Reply-To: <8479bc9a-6ed6-0cf1-c727-123e2b87a8d6@dafert.at>
Date: Tue, 13 Sep 2022 15:33:00 -0300
Message-ID: <CANMwmbPWUipG=upLw-3rdO9UovEPDVKSKM+OXfoS4swZCsht=g@mail.gmail.com>
To: Mel Dafert <mel@dafert.at>
Cc: PHP Internals List <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000094497e05e8933e8e"
Subject: Re: [PHP-DEV] Error behaviour for max_input_vars
From: dev.juan.morales@gmail.com (juan carlos morales)

--00000000000094497e05e8933e8e
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

El mar., 13 de septiembre de 2022 14:58, Mel Dafert <mel@dafert.at>
escribi=C3=B3:

>
> In summary, I believe this can only be solved inside of PHP itself, by
> allowing to configure a way for `max_input_vars` to abort the request
> instead of truncating the input.
> The options I see feasible are:
> - A new ini setting `max_input_vars_abort` (default to 0), which, if set
> to 1, will abort the request if there are more input variables than
> allowed.
> - A method to reliably detect whether the input vars were truncated (eg.
> `function has_post_been_truncated(): bool`), so the application can
> decide whether to abort or not.
> - Deciding that `max_input_vars` is not relevant anymore and should be
> handled by the likes of Apache and NGINX, thus changing the default to
> `0` and removing the setting
>      over a deprecation period.
>
> I am leaning towards the first option, but would be open to either outcom=
e.
>


We should not delete the ini setting "max_input_vars"... Is a breaking
change very hard.

I Am in favour of adding More flexibility about how to handle this
situation... And I also think that options 1 and 2 can coexist smoothly.

I suggest you write and RFC for this and continue the discussion on this
e-mail list but with the RFC already created.

>

--00000000000094497e05e8933e8e--