Re: HTTP_RAW_POST_DATA
| From: | raditha dissanayake | Date: | Fri, 14 May 2004 04:11:37 +0000 |
| Subject: | Re: HTTP_RAW_POST_DATA | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-186202@lists.php.net to get a copy of this message | ||
Chris Shiflett wrote:
--- Marek Kilimajer <kilimajer@webglobe.sk> wrote:You have demonstrated how easy it's to carry out a DOS with POST. -- Raditha Dissanayake. --------------------------------------------- http://raditha/megaupload/upload.php Sneak past the PHP file upload limits.PHP must read the whole post stream to create $_POST and $HTTP_POST_VARS arrays, and to save file uploads into a temporary files. This happens before the script is executed.Well, there are other scenarios: POST /path/to/script.php HTTP/1.1 Host: example.org Content-Type: shiflett Content-Length: 384975438975438753495734957 will be caught by the LimitRequestBody. That can only have a maximum of 2GB.