Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:58941
Return-Path: <rasmus@lerdorf.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 8857 invoked from network); 14 Mar 2012 22:06:19 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 14 Mar 2012 22:06:19 -0000
Authentication-Results: pb1.pair.com header.from=rasmus@lerdorf.com; sender-id=unknown
Authentication-Results: pb1.pair.com smtp.mail=rasmus@lerdorf.com; spf=permerror; sender-id=unknown
Received-SPF: error (pb1.pair.com: domain lerdorf.com from 209.85.213.170 cause and error)
X-PHP-List-Original-Sender: rasmus@lerdorf.com
X-Host-Fingerprint: 209.85.213.170 mail-yx0-f170.google.com  
Received: from [209.85.213.170] ([209.85.213.170:53269] helo=mail-yx0-f170.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id AD/B1-32926-A56116F4 for <internals@lists.php.net>; Wed, 14 Mar 2012 17:06:19 -0500
Received: by yenl5 with SMTP id l5so2763200yen.29
        for <internals@lists.php.net>; Wed, 14 Mar 2012 15:06:15 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=google.com; s=20120113;
        h=message-id:date:from:user-agent:mime-version:to:cc:subject
         :references:in-reply-to:x-enigmail-version:content-type
         :content-transfer-encoding:x-gm-message-state;
        bh=irQd08LBEeHhW71DeWf2hlfqbeit9b3eomzh+SV5zvQ=;
        b=pXQaz53BBqEg7wHXhHvVgNOIFPSX0GZlyIOyxrAWaprLFBzlTyyOjklU4SQZgFXYla
         YttsVd66lqbGio3YtdX2Q3KycZntT8HEjh2D+hulqgLnaBgY5ahxQpAid37eWbm5nxs8
         TZpE3FJRlPliuDKLHOmr4KrGAaHejqxzLBs5mNwvDy8KGof9yem+FFsCGkGy6Jz1wVHs
         vgiVbyBqHFjuQhVJJcolIBwXPDoQsk5hqdqEmHs6UckAB75KqpctdGYWXJh3SiD9vAg4
         Lnrnr+WfmMmNJyvdyOX668ZAtAdh4TFDbGR/VubFTX3Yh0fb4ov2BTZpYeZ4lzmTOXSg
         RXEA==
Received: by 10.229.136.200 with SMTP id s8mr1540682qct.9.1331762775540;
        Wed, 14 Mar 2012 15:06:15 -0700 (PDT)
Received: from [192.168.200.5] (c-50-131-44-225.hsd1.ca.comcast.net. [50.131.44.225])
        by mx.google.com with ESMTPS id h11sm661523qae.3.2012.03.14.15.06.14
        (version=SSLv3 cipher=OTHER);
        Wed, 14 Mar 2012 15:06:14 -0700 (PDT)
Message-ID: <4F611655.2000505@lerdorf.com>
Date: Wed, 14 Mar 2012 15:06:13 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0.2) Gecko/20120216 Thunderbird/10.0.2
MIME-Version: 1.0
To: Anthony Ferrara <ircmaxell@gmail.com>
CC: PHP internals <internals@lists.php.net>
References: <4F60F4B1.5010407@lerdorf.com> <CAEZPtU6TBV_WrZ_OBY_3EiGO+G5gYQWYDDuKOOfxF3-gO2X-JQ@mail.gmail.com> <4F610FB9.1060309@lerdorf.com> <CAAyV7nH-mTDBWSLF=ykGEYWEDTy2hrmLWjG1jEsYUx95sPXTcQ@mail.gmail.com>
In-Reply-To: <CAAyV7nH-mTDBWSLF=ykGEYWEDTy2hrmLWjG1jEsYUx95sPXTcQ@mail.gmail.com>
X-Enigmail-Version: 1.3.5
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Gm-Message-State: ALoCoQmRuZuSVJ+y4byawR/CZFmr7ukcFgSW35Wwxjopi5GfwfSDg4ln7ELtkJzDay3Uw7IYcIDt
Subject: Re: [PHP-DEV] Let parse_str() parse more than max_input_vars args
From: rasmus@lerdorf.com (Rasmus Lerdorf)

On 03/14/2012 02:46 PM, Anthony Ferrara wrote:
>> But Pierre, you understand that by the time you ini_set() it in the code
>> it can only ever affect parse_str() calls.
> 
> Well, wouldn't INI_ALL would allow .htaccess files to override that
> statement, and hence open the vulnerability?

No because it is already PERDIR.

-Rasmus