Bug #666: Possibly denial of service attack using file upload facility

From: zavadsky@im.bas-net.by Operating system: ALL PHP version: 3.0.2a PHP Bug Type: Feature/Change Request Bug description: Using file upload facility, it is very easy to perform denial of service attack on any php script. 1. One should create an html form and set action to attacked php script. 2. In this form, indicate enctype="multipart/form-data" and set MAX_FILE_SIZE to a large enough value. 3. Select a large enough file and submit the form. 4. Repeat several times. All files still resides at /tmp directory because the knows nothing about them. Possible solution: 1. Deletion of the file by php engine at the end of script. 2. Explicit activation of upload processing of a file by a new function. -- PHP Development Mailing List http://www.php.net/ To unsubscribe send an empty message to php-dev-unsubscribe@lists.php.net For help: php-dev-help@lists.php.net