Download PHP stream / files and max_input_vars

Question

When I download a stream from Java to PHP, I sometimes get a PHP error indicating that the input exceeds the max_input_vars limit.

At first I did not understand why. Let me explain first:

Files are uploaded with a similar approach:

 // get file data from input stream $putdata = fopen("php://input", "r"); $tmp = tmpfile(); filesize = stream_copy_to_stream ($putdata, $tmp); fclose ($putdata); // copy temp stream into destination stream $target = fopen('myfile.dwg', "w"); fseek($tmp, 0, SEEK_SET); stream_copy_to_stream($tmp, $target); fclose($target); fclose ($tmp); 

To get a picture of why PHP would give me such a warning, I took a dump of the data sent:

 file_put_contents ('input_vars.log', print_r ($_REQUEST, true)); file_put_contents ('php_input.log', file_get_contents ('php://input')); 

Here's the fun part: The download file is 1.8 megabytes. Resulting Logs:

• input_vars.log => 5 megabytes, 90,000 lines
• php_input.log => 20 megabytes, 283,000 lines

Now the error message suddenly seems legit. php_input.log just contains bytecode, but input_vars.log formatted as such:

 Array ( [filename] => 0018-101-001_67.dwg [versionId] => 11253 [filetype] => dwg ['á‹Úê-8øFj–sÙ/ghÔ÷JJÐWhvPV] => ... .... ) 

The first three keys are sent via GET, and all the rest will be files. If I search and look for matches => , I get 25 954 matches. Then I assume that REQUEST contains 26,000 keys.

Now, to my question: I assigned the value max_input_vars several times, and now it has a value of 30000 . Should I just ignore this security setting and set it as high as possible? My concern is that PHP removes parts from the REQUEST array if it is more than 30000 , which leads to file corruption.

Are there any security issues when setting this value too high? Perhaps the best way to upload files to PHP?

Answer 1

Perhaps try setting the enable_post_data_reading directive to "false" (or "Disable") to prevent parsing of the PHP file in the file body?

By the way, if you are using PHP 5.3.9, you should fix max_input_vars vulnerability .

Answer 2

What you want to do is PUT upload , you should not treat it as POST; or - at least - set the Content-Type HTTP header to application/octet-stream

Answer 3

By themselves, "php.net" ( PHP.NET - max_input_vars ), they report that there is no problem that you increase the value of this parameter, however, is a form of "using this directive to mitigate the possibility of denial of service attacks that use hash collisions. "

To eliminate this deadlock, you can try to set the variable value at runtime using the following function:

 ini_set("max_input_vars", 30000); 

I recently encountered this problem and how the call was deleted rather than set to configure the runtime, so unfortunately we had to increase the value.

So far, we have not had problems, but the idea is the future, change the code to send data in parts, and thus save the code within the standard language configuration.

Answer 4

You did not show how you upload the file in Java. PHP handles regular POST requests as if they came from a form and tries to parse fields from them - a bad idea if the data is binary. You would be better off emulating what forms to upload HTML files to do and send a "multipart post" (example). Then use PHP standard file upload to upload , as if getting from a form.

Answer 5

The accepted answer is valid, but you should know that turning enable_post_data_reading off also means disabling the auto-complete arrays $_POST , $_GET and $_REQUEST . Since I use these arrays extensively, I decided to limit enable_post_data_reading specific file intended for uploading files:

 <Files "UploadFile.php"> php_value enable_post_data_reading Off </Files> 

Since I load using an ajax request, I can set user-defined headers as follows:

 oXhr.setRequestHeader("X-File-Name", I_sFileName); oXhr.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); 

This way you get around the need to use $_REQUEST or $_POST , because you get the information in php:

$fileName = $_SERVER['HTTP_X_FILE_NAME'];

Answer 6

Try increasing the size of post_max_size, upload_max_filesize and max_file_uploads in php.ini