Sec Bug->Doc #60728 [Opn]: max_input_vars doesn't limiting multi-dimensional arrays

Edit report at https://bugs.php.net/bug.php?id=60728&edit=1 ID: 60728 Updated by: rasmus@php.net Reported by: sv3tli0 at bgspot dot eu Summary: max_input_vars doesn't limiting multi-dimensional arrays Status: Open -Type: Security +Type: Documentation Problem Package: Variables related Operating System: Any PHP Version: 5.3.9 Block user comment: N Private report: Y New Comment: The limit is per-nesting level actually because it is protecting against a hash- collision DoS attack and only elements at the same nesting level can collide. So the code is fine, the documentation needs to be clearer. Previous Comments: ------------------------------------------------------------------------ [2012-01-12 14:16:48] sv3tli0 at bgspot dot eu I have one miss at the test code! var_dump(count($_POST)); must be : var_dump(count($_POST[a])); ------------------------------------------------------------------------ [2012-01-12 14:14:47] sv3tli0 at bgspot dot eu Description: ------------ The max_input_vars doesn't limiting multi-dimensional arrays! If user post var[] the uploaded array wont be limitted. Test script: --------------- <form action="" method="post"> <?php $max_input_vars = ini_get('max_input_vars'); for ($i=0; $i < $max_input_vars + 5; $i++) { echo "<input type='hidden' name='a[]' value='$i'>\n"; } var_dump($max_input_vars); var_dump(count($_POST)); ?> <input type="submit"> </form> Expected result: ---------------- string(4) "1000" int(1000) Actual result: -------------- string(4) "1000" int(1005) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=60728&edit=1