php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #50692 Don't count 0-bytes files towards the max_file_uploads limit
Submitted: 2010-01-08 07:42 UTC Modified: 2010-10-04 03:28 UTC
Votes:3
Avg. Score:4.3 ± 0.5
Reproduced:3 of 3 (100.0%)
Same Version:1 (33.3%)
Same OS:0 (0.0%)
From: john dot peterson10 at gmail dot com Assigned: cataphract (profile)
Status: Closed Package: *General Issues
PHP Version: 5.2.12 OS: Windows
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: john dot peterson10 at gmail dot com
New email:
PHP Version: OS:

 

 [2010-01-08 07:42 UTC] john dot peterson10 at gmail dot com
Description:
------------
Suggestion: Don't count 0-bytes files (that comes from <input type="file"> elements that don't have any file specified) towards the max_file_uploads limit. (And don't create a blank temporary file for them to avoid the problems with file-system overload mentioned in CVE-2009-4017.)

Reason for suggestion: That way a small limit for max_file_uploads will cause less website restrictions. For example: I have seen some designs with lists of 40 or 50 rows where every row has a <input type="file"> for the sake of the design of the page. But where typically only one or two files are submitted in a POST because the majority of the <input type="file"> elements has no file specified. Currently all these designs will be limited (to for example 20 rows with the default settings) because even 0-byte files count towards the max_file_uploads limit.

Issues with suggestion: The site will need javascript to control the rare exception where more than for example 20 <input type="file"> has a value before submit. But that should not be a big problem.

Reproduce code:
---------------
HTML POST request with <input type="file"> elements where the value is blank (no file specified) so that $_FILES[#]['size'] is 0 (and $_FILES[#]['tmp_name'] is blank).

Expected result:
----------------
<input type="file"> elements where no file is specified doesn't count towards the max_file_uploads limit

Actual result:
--------------
<input type="file"> elements where no file is specified counts towards the max_file_uploads limit

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2010-03-12 14:40 UTC] mariusads at helpedia dot com
Those people with websites showing 40 input boxes could just as easy increase the value of the limit in the php.ini or pass it on a case by case basic through .htaccess (if possible, i don't know)

Don't see the point of this...
 [2010-08-03 20:19 UTC] phazei at gmail dot com
This is an issue for me as well.


It can't be adjusted with ini_set or in .htaccess :
http://bugs.php.net/bug.php?id=50684
 [2010-10-04 03:27 UTC] cataphract@php.net
Automatic comment from SVN on behalf of cataphract
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=303970
Log: - Implemented FR #50692, not uploaded files don't count towards
  max_file_uploads limit.
- As a side improvement, temporary files are not opened for
  empty uploads and, in debug mode, 0-length uploads.
 [2010-10-04 03:28 UTC] cataphract@php.net
-Status: Open +Status: Closed -Package: Feature/Change Request +Package: *General Issues -Assigned To: +Assigned To: cataphract
 [2010-10-04 03:28 UTC] cataphract@php.net
Implemented for trunk and PHP 5.3.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue Dec 03 17:01:29 2024 UTC