From: Dmitry Stogov <dmitry@php.net>
Date: Thu, 15 Dec 2011 10:31:02 +0000 (+0000)
Subject: Added max_input_vars directive to prevent attacks based on hash collisions
X-Git-Tag: php-5.3.9RC4~5
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b8a08bf263d03c26da5f475f96a1d66eb566d874;p=php

Added max_input_vars directive to prevent attacks based on hash collisions
---

diff --git a/UPGRADING b/UPGRADING
index 1b6c3cc33b..fce04afa49 100755
--- a/UPGRADING
+++ b/UPGRADING
@@ -163,6 +163,11 @@ UPGRADE NOTES - PHP 5.3
   xsl.security_prefs. This option will be marked as deprecated in 5.4 again. 
   Use the method XsltProcess::setSecurityPrefs($options) there.
 
+- the following new directives were added
+
+  - max_input_vars - specifies how many GET/POST/COOKIE input variables may be
+    accepted. default value 1000. 
+
 =============
 5. Deprecated
 =============
diff --git a/php.ini-development b/php.ini-development
index b8aef6a374..48cc89fa05 100644
--- a/php.ini-development
+++ b/php.ini-development
@@ -457,6 +457,9 @@ max_input_time = 60
 ; http://php.net/max-input-nesting-level
 ;max_input_nesting_level = 64
 
+; How many GET/POST/COOKIE input variables may be accepted
+; max_input_vars = 1000
+
 ; Maximum amount of memory a script may consume (128MB)
 ; http://php.net/memory-limit
 memory_limit = 128M
diff --git a/php.ini-production b/php.ini-production
index be3b9708f1..97dbb48580 100644
--- a/php.ini-production
+++ b/php.ini-production
@@ -457,6 +457,9 @@ max_input_time = 60
 ; http://php.net/max-input-nesting-level
 ;max_input_nesting_level = 64
 
+; How many GET/POST/COOKIE input variables may be accepted
+; max_input_vars = 1000
+
 ; Maximum amount of memory a script may consume (128MB)
 ; http://php.net/memory-limit
 memory_limit = 128M