[doc-en] master: `session.upload_progress.enabled`: Add a warning about potential exploits (#5872)

Author: Daniel Scherzer (DanielEScherzer) Committer: GitHub (web-flow) Pusher: DanielEScherzer Date: 2026-09-25T15:36:32-07:00 Commit: https://github.com/php/doc-en/commit/a9acd542301e9720e5d5d87aa730cc3990f93960 Raw diff: https://github.com/php/doc-en/commit/a9acd542301e9720e5d5d87aa730cc3990f93960.diff session.upload_progress.enabled: Add a warning about potential exploits (#5872) Document that if upload progress bars are not going to be used, the feature should be disabled, since it makes exploiting any local file inclusion vulnerability very easy. Changed paths: M entities/entities.url.ent M reference/session/ini.xml Diff: diff --git a/entities/entities.url.ent b/entities/entities.url.ent index 083ec8c80516..76b8e6cb3d90 100644 --- a/entities/entities.url.ent +++ b/entities/entities.url.ent @@ -491,6 +491,7 @@ URLs, other addresses and external references. <entity name="url.sed">http://www.gnu.org/software/sed/sed.html</entity> <entity name="url.session-fixation">https://acrossecurity.com/papers/session_fixation.pdf</entity> <entity name="url.session-save-handler">https://github.com/php/php-src/blob/master/ext/session/tests/save_handler.inc</entity> +<entity name="url.session.lfi">https://en.wikipedia.org/wiki/File_inclusion_vulnerability</entity> <entity name="url.setlocale.country.win32">http://msdn.microsoft.com/en-us/library/cdax410z.aspx</entity> <entity name="url.setlocale.lang.win32">http://msdn.microsoft.com/en-us/library/39cwe7zf.aspx</entity> <entity name="url.sleepycat">http://www.sleepycat.com/</entity> diff --git a/reference/session/ini.xml b/reference/session/ini.xml index 44bd163724a5..bfbc3f691029 100644 --- a/reference/session/ini.xml +++ b/reference/session/ini.xml @@ -969,6 +969,17 @@ Enables upload progress tracking, populating the <varname>$_SESSION</varname> variable. Defaults to 1, enabled. </simpara> + <warning> + <simpara> + Upload progress writes the client-supplied file name and field name to the + session store while the upload in progress, to allow polling the process + from a separate request. In applications that do not use upload progress + bars, consider disabling this option; file names and field names are not + validated and may contain PHP code, making any + <link xlink:href="&url.session.lfi;">local file inclusion vulnerability</link> + trivial to exploit. + </simpara> + </warning> </listitem> </varlistentry>