Req #74882 [Com]: Cannot use ini_set in a flexible manner enough with FrontControllers
Edit report at https://bugs.php.net/bug.php?id=74882&edit=1
ID: 74882
Comment by: spam2 at rhsoft dot net
Reported by: bouvrette dot nicolas at gmail dot com
Summary: Cannot use ini_set in a flexible manner enough with
FrontControllers
Status: Wont fix
Type: Feature/Change Request
Package: *General Issues
Operating System: All
PHP Version: 5.6.31
Block user comment: N
Private report: N
New Comment:
any script code comes simply way too late for things like upload_max_filesize because the whole
upload is already processed
Previous Comments:
------------------------------------------------------------------------
[2017-07-08 15:00:44] requinix@php.net
Restrictions on when certain settings can be changed are almost always, if not actually always, due
to technical or security reasons.
For upload_max_filesize it is the former: file uploads happen before any PHP code is executed.
Changing the setting with ini_set is disallowed because it would not do anything. Thus PERDIR is the
loosest restriction possible.
Naturally this also applies to other settings related to uploads.
I suggest changing upload_max_filesize for your entire site instead of just the upload directory
anyways; consider that a malicious user can attempt an upload to any URL they want, regardless of
whether you made a form for them to use or not. Ditto for post_max_size and similar settings.
If you have other restricted settings in mind then I can explain why they are so, and if I
can't then they can certainly be revisited.
------------------------------------------------------------------------
[2017-07-08 14:32:54] bouvrette dot nicolas at gmail dot com
Description:
------------
When using a single FrontController for a site, it's impossible to leverage .htaccess and/or
Apache's vhost to overwrite certain ini_set values.
A good example would be upload_max_filesize but there are many others?
Having a FrontController give a lot of flexibility when it comes to dynamic routes and localisation
and is becoming more popular with large PHP framework like Symfony and Zend.
Test script:
---------------
See https://serverfault.com/questions/857961/php-value-overrides-with-apache-using-a-front-controller
for full details.
Expected result:
----------------
ini_set should be more flexible and allow more overwrites, especially to help with performance when
using FrontControllers.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=74882&edit=1
Thread (4 messages)