Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57195
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <4F04AA8E.6020701@sugarcrm.com>
References: <CABBJUpc7T2QZm8QiitQ0wZ5RsY=3Jwy_UERSvLT9unNYtJ1mZA@mail.gmail.com>
	<CABBJUpcVkYwU4zN0dG2b+jYkppnY9HR8wm7FV0tnmGt6ky5wQg@mail.gmail.com>
	<CABBJUpeN4iJ6mVUKEEz8qxY25zxTmwg8EigpsmxnZGz5xshMhw@mail.gmail.com>
	<4F048A03.4070408@sugarcrm.com>
	<CAH-PCH69gV88qnQ7OHhGHSt70oD7f9Z_HCFD7dfW6SmBR6z2tQ@mail.gmail.com>
	<4F04A172.7080509@sugarcrm.com>
	<CAH-PCH5BUsrXKLtk6JWCOA8d5+2DxSke3UAnbBraJyGP-YnQnA@mail.gmail.com>
	<4F04AA8E.6020701@sugarcrm.com>
Date: Wed, 4 Jan 2012 20:46:07 +0100
Message-ID: <CAH-PCH6YH3ZxH5XzEm6+gsikaHjyL-pdHyAs=OnFhWqHk0CctQ@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: Laruence <laruence@php.net>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=20cf30334c9321a45904b5b91140
Subject: Re: [PHP-DEV] Re: another fix for max_input_vars.
From: tyra3l@gmail.com (Ferenc Kovacs)

--20cf30334c9321a45904b5b91140
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Jan 4, 2012 at 8:37 PM, Stas Malyshev <smalyshev@sugarcrm.com>wrote=
:

> Hi!
>
>
>     Could you please elaborate on that part - where is the disclosure
>>    and what exactly is being disclosed?
>>
>>
>> I would guess that the value of that said limit. (it is the only
>> variable in the error message).
>>
>
> This is an error message, it's not visible to anybody. Even if it were, I
> don't see a problem with it. Usually people mean different thing by
> information disclosure, but without proper report of course it is
> meaningless to talk about it.


/* do not output the error message to the screen,
this helps us to to avoid "information disclosure" */

I don't think that it is a high importance, but with display_errors
enabled, it does leak otherwise unobtainable (if you don't have publicly
available phpinfo files, which most person with enabled display_errors
does) info.

So while I don't feel strongly about it, I wanted to mention it.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--20cf30334c9321a45904b5b91140--