php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Sec Bug #63447 max_input_vars doesn't filter variables when mbstring.encoding_translation = On
Submitted: 2012-11-06 09:00 UTC Modified: 2015-10-11 11:52 UTC
From: na24am at gmail dot com Assigned: laruence (profile)
Status: Closed Package: Variables related
PHP Version: 5.4.8 OS: MacOS X Lion
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: na24am at gmail dot com
New email:
PHP Version: OS:

 

 [2012-11-06 09:00 UTC] na24am at gmail dot com 
Description:
------------
max_input_vars doesn't filter variables when mbstring.encoding_translation = On

--

mbstring.encoding_translation = On
max_input_vars = 2

Test script:
---------------
<html>
<body>
<form action="" method="post">
<input type="hidden" name="value01" value="test01">
<input type="hidden" name="value02" value="test02">
<input type="hidden" name="value03" value="test03">
<input type="hidden" name="value04" value="test04">
<input type="submit" value="submit">
</form>
<?php
var_dump($_POST);
?>
</body>
</html>

Expected result:
----------------
Warning: Unknown: Input variables exceeded 2. To increase the limit change 
max_input_vars in php.ini. in Unknown on line 0

array(2) { ["value01"]=> string(6) "test01" ["value02"]=> string(6) "test02" }

Actual result:
--------------
array(4) { ["value01"]=> string(6) "test01" ["value02"]=> string(6) "test02" 
["value03"]=> string(6) "test03" ["value04"]=> string(6) "test04" }

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-11-06 10:50 UTC] laruence@php.net
-Type: Bug +Type: Security -Private report: No +Private report: Yes
 [2012-11-07 09:13 UTC] laruence@php.net 
The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.

fixed in : 
https://github.com/php/php-src/commit/7fcbe4d5467300a0acee78330a0cdc9d1cbf05ad
 [2012-11-07 09:13 UTC] laruence@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: laruence
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 15:01:30 2024 UTC