Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:58949
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lerdorf.com from 209.85.213.170 cause and error)
Message-ID: <4F616AA8.9020503@lerdorf.com>
Date: Wed, 14 Mar 2012 21:06:00 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0.2) Gecko/20120216 Thunderbird/10.0.2
MIME-Version: 1.0
To: Tjerk Anne Meesters <datibbaw@php.net>
CC: PHP internals <internals@lists.php.net>
References: <4F60F4B1.5010407@lerdorf.com> <CAJy+15xdm9SxZBaPqnRb4ushqEuF35Xn-k21jj=FE_i1Ej6w9Q@mail.gmail.com> <4F612BF6.3070301@lerdorf.com> <CAHMUw2FHyMLHCKgtNLrJfRzSBUEiFQbTER-G-_q_4vph8Xy7Xg@mail.gmail.com>
In-Reply-To: <CAHMUw2FHyMLHCKgtNLrJfRzSBUEiFQbTER-G-_q_4vph8Xy7Xg@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Let parse_str() parse more than max_input_vars args
From: rasmus@lerdorf.com (Rasmus Lerdorf)

On 03/14/2012 07:34 PM, Tjerk Anne Meesters wrote:
> On Thu, Mar 15, 2012 at 7:38 AM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:
>>
>> Yes, it would need a zend_alter_ini_entry_ex() call there. The patch
>> wasn't complete, just a quick hack. But it would still have an
>> out-of-context error message when you exceed it. At least with a
>> userspace ini_set() the error would make sense.
>>
> 
> As mentioned on IRC, a function signature of "array
> parse_urlencoded(string $s)" would be useful too; the separated logic
> would allow for avoiding max_input_vars altogether and not having to
> worry about parameter name mangling (variable name rules). The nasty
> part is that much of the treat_data code would have to be duplicated
> (I think).
> 
> Besides that, applying the hash randomisation patch to only userland
> arrays would make the max_input_vars less critical and at the same
> time avoid breaking opcode caches and other low-level dependencies.

Sure, but this is a longer-term fix. Right now I am more concerned about
the fact that we broke code that worked fine in PHP 5.3.8 without any
way to make it work safely.

-Rasmus