php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #50692 Don't count 0-bytes files towards the max_file_uploads limit
Submitted: 2010-01-08 07:42 UTC Modified: 2010-10-04 03:28 UTC
Votes:3
Avg. Score:4.3 ± 0.5
Reproduced:3 of 3 (100.0%)
Same Version:1 (33.3%)
Same OS:0 (0.0%)
From: john dot peterson10 at gmail dot com Assigned: cataphract (profile)
Status: Closed Package: *General Issues
PHP Version: 5.2.12 OS: Windows
Private report: No CVE-ID: None
 [2010-01-08 07:42 UTC] john dot peterson10 at gmail dot com
Description:
------------
Suggestion: Don't count 0-bytes files (that comes from <input type="file"> elements that don't have any file specified) towards the max_file_uploads limit. (And don't create a blank temporary file for them to avoid the problems with file-system overload mentioned in CVE-2009-4017.)

Reason for suggestion: That way a small limit for max_file_uploads will cause less website restrictions. For example: I have seen some designs with lists of 40 or 50 rows where every row has a <input type="file"> for the sake of the design of the page. But where typically only one or two files are submitted in a POST because the majority of the <input type="file"> elements has no file specified. Currently all these designs will be limited (to for example 20 rows with the default settings) because even 0-byte files count towards the max_file_uploads limit.

Issues with suggestion: The site will need javascript to control the rare exception where more than for example 20 <input type="file"> has a value before submit. But that should not be a big problem.

Reproduce code:
---------------
HTML POST request with <input type="file"> elements where the value is blank (no file specified) so that $_FILES[#]['size'] is 0 (and $_FILES[#]['tmp_name'] is blank).

Expected result:
----------------
<input type="file"> elements where no file is specified doesn't count towards the max_file_uploads limit

Actual result:
--------------
<input type="file"> elements where no file is specified counts towards the max_file_uploads limit

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2010-03-12 14:40 UTC] mariusads at helpedia dot com
Those people with websites showing 40 input boxes could just as easy increase the value of the limit in the php.ini or pass it on a case by case basic through .htaccess (if possible, i don't know)

Don't see the point of this...
 [2010-08-03 20:19 UTC] phazei at gmail dot com
This is an issue for me as well.


It can't be adjusted with ini_set or in .htaccess :
http://bugs.php.net/bug.php?id=50684
 [2010-10-04 03:27 UTC] cataphract@php.net
Automatic comment from SVN on behalf of cataphract
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=303970
Log: - Implemented FR #50692, not uploaded files don't count towards
  max_file_uploads limit.
- As a side improvement, temporary files are not opened for
  empty uploads and, in debug mode, 0-length uploads.
 [2010-10-04 03:28 UTC] cataphract@php.net
-Status: Open +Status: Closed -Package: Feature/Change Request +Package: *General Issues -Assigned To: +Assigned To: cataphract
 [2010-10-04 03:28 UTC] cataphract@php.net
Implemented for trunk and PHP 5.3.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Dec 12 23:01:36 2024 UTC