Electronics & Programming

develissimo

Open Source electronics development and programming

  • You are not logged in.
  • Root
  • » PHP
  • » [PHP-DEV] RE : Re: [PHP-DEV] [PATCH] Add option to disable POST data processing [RSS Feed]

#1 Dec. 8, 2010 00:46:41

Tjerk M.
Registered: 2009-11-02
Reputation: +  0  -
Profile   Send e-mail  

[PHP-DEV] RE : Re: [PHP-DEV] [PATCH] Add option to disable POST data processing


Hi,

Don't have much knowledge about the internal workings of the engine, but I'm
wondering if it's possible to apply "lazy loading" to the $_POST variable,
so that processing only happens if and when it's requested.

That way you wouldn't need the ini setting.
On Dec 8, 2010 7:54 AM, "Patrick ALLAERT" <patrick.alla***@*mail.com> wrote:
> It is not the goal to "block" but to prevent the usual processing of
$_POST
> when not required inside a valide POST request which will handle the input
> differently.
>
> Le 7 déc. 2010 23:36, "Tig" <tigger***@*mail.com> a écrit :
>
> If the objective is to 'block' POST data from getting to PHP, (in
> apache) you can use:
>http://httpd.apache.org/docs/2.0/mod/core.html#limit>
> No need to change / add anything to PHP.
>
> -Tig
>
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit:http://www.php.net/...

Offline

#2 Dec. 8, 2010 01:14:45

Gustavo L.
Registered: 2009-11-02
Reputation: +  0  -
Profile   Send e-mail  

[PHP-DEV] RE : Re: [PHP-DEV] [PATCH] Add option to disable POST data processing


On Wed, 08 Dec 2010 00:45:56 -0000, Tjerk Meesters<tjerk.meest***@*mail.com> wrote:Don't have much knowledge about the internal workings of the engine, butI'm wondering if it's possible to apply "lazy loading" to the $_POSTvariable, so that processing only happens if and when it's requested.That way you wouldn't need the ini setting.In most cases, processing (=parsing) of the POST data already only occurswhen $_POST is requested; however, previously the data was alreadyentirely copied to two or three memory locations.If you mean making it so that the data is only *read and processed* when$_POST is requested, I suppose that would be possible, but I think itwould require significant code/architectural changes to PHP and to thesapis. It would also raise other problems, including backwardscompatibility breaks, if we wanted the change to bring any benefit.For instance, current scripts can, in POST requests, read any number oftimes from php://input or $HTTP_RAW_POST_DATA (to simplify, let's say weeven let go $HTTP_RAW_POST_DATA). For this to be possible, you would haveto have the data in memory because you're reading from php://input thefirst time, you can't know if it will be read a second time, so you eitherbreak BC or keep everything in memory just in case there's a second read-- and then you're where you started.--
Gustavo Lopes

--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit:http://www.php.net/unsub.php

Offline

#3 Dec. 8, 2010 15:11:17

Clint B.
Registered: 2009-11-02
Reputation: +  0  -
Profile   Send e-mail  

[PHP-DEV] RE : Re: [PHP-DEV] [PATCH] Add option to disable POST data processing


On Wed, 2010-12-08 at 01:11 +0000, Gustavo Lopes wrote:
> On Wed, 08 Dec 2010 00:45:56 -0000, Tjerk Meesters
> <tjerk.meest***@*mail.com> wrote:
>
> > Don't have much knowledge about the internal workings of the engine, but
> > I'm wondering if it's possible to apply "lazy loading" to the $_POST
> > variable, so that processing only happens if and when it's requested.
> >
> > That way you wouldn't need the ini setting.
>
> In most cases, processing (=parsing) of the POST data already only occurs
> when $_POST is requested; however, previously the data was already
> entirely copied to two or three memory locations.
>
> If you mean making it so that the data is only *read and processed* when
> $_POST is requested, I suppose that would be possible, but I think it
> would require significant code/architectural changes to PHP and to the
> sapis. It would also raise other problems, including backwards
> compatibility breaks, if we wanted the change to bring any benefit.
>
> For instance, current scripts can, in POST requests, read any number of
> times from php://input or $HTTP_RAW_POST_DATA (to simplify, let's say we
> even let go $HTTP_RAW_POST_DATA). For this to be possible, you would have
> to have the data in memory because you're reading from php://input the
> first time, you can't know if it will be read a second time, so you either
> break BC or keep everything in memory just in case there's a second read
> -- and then you're where you started.
>

This example would be solved if during the lazy load you change the
php://input stream to point at the memory location that you read it
into.



--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit:http://www.php.net/unsub.php

Offline

#4 Dec. 8, 2010 18:50:19

Gustavo L.
Registered: 2009-11-02
Reputation: +  0  -
Profile   Send e-mail  

[PHP-DEV] RE : Re: [PHP-DEV] [PATCH] Add option to disable POST data processing


On Wed, 08 Dec 2010 15:10:30 -0000, Clint Byrum <cl***@*buntu.com> wrote:On Wed, 2010-12-08 at 01:11 +0000, Gustavo Lopes wrote:For instance, current scripts can, in POST requests, read any number of
times from php://input or $HTTP_RAW_POST_DATA (to simplify, let's say weeven let go $HTTP_RAW_POST_DATA). For this to be possible, you wouldhave to have the data in memory because you're reading from php://inputthefirst time, you can't know if it will be read a second time, so youeither break BC or keep everything in memory just in case there's asecond read-- and then you're where you started.This example would be solved if during the lazy load you change the
php://input stream to point at the memory location that you read it
into.I'm sorry, this doesn't make any sense. "The memory location you readinto"? Who says you read the post data *into* something, much less amemory location?--
Gustavo Lopes

--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit:http://www.php.net/unsub.php

Offline

#5 Dec. 8, 2010 19:13:39

Clint B.
Registered: 2009-11-02
Reputation: +  0  -
Profile   Send e-mail  

[PHP-DEV] RE : Re: [PHP-DEV] [PATCH] Add option to disable POST data processing


On Wed, 2010-12-08 at 18:49 +0000, Gustavo Lopes wrote:
> On Wed, 08 Dec 2010 15:10:30 -0000, Clint Byrum <cl***@*buntu.com> wrote:
>
> > On Wed, 2010-12-08 at 01:11 +0000, Gustavo Lopes wrote:
> >>
> >> For instance, current scripts can, in POST requests, read any number of
> >> times from php://input or $HTTP_RAW_POST_DATA (to simplify, let's say we
> >> even let go $HTTP_RAW_POST_DATA). For this to be possible, you would
> >> have to have the data in memory because you're reading from php://input
> >> the
> >> first time, you can't know if it will be read a second time, so you
> >> either break BC or keep everything in memory just in case there's a
> >> second read
> >> -- and then you're where you started.
> >>
> >
> > This example would be solved if during the lazy load you change the
> > php://input stream to point at the memory location that you read it
> > into.
> >
>
> I'm sorry, this doesn't make any sense. "The memory location you read
> into"? Who says you read the post data *into* something, much less a
> memory location?
>
>

Sorry, to be more clear:

A lazy load on access to $_POST or $HTTP_RAW_POST_DATA would have to
read the POST data from the SAPI. At that point, the SAPI can keep the
buffer it allocates to read that data as a memory stream, and change its
notion of php://input to refer to that stream.



--
PHP Internals - PHP Runtime Development Mailing List
To unsubscribe, visit:http://www.php.net/unsub.php

Offline

  • Root
  • » PHP
  • » [PHP-DEV] RE : Re: [PHP-DEV] [PATCH] Add option to disable POST data processing [RSS Feed]

Board footer

Moderator control

Enjoy the 17th of August
PoweredBy

The Forums are managed by develissimo stuff members, if you find any issues or misplaced content please help us to fix it. Thank you! Tell us via Contact Options
Leave a Message
Welcome to Develissimo Live Support