Skip to content

fix(HTTP): read request body when post_max_size is unlimited - #10646

Open
gr8man wants to merge 1 commit into
codeigniter4:developfrom
gr8man:fix/incomingrequest-post-max-size-unlimited
Open

gr8man wants to merge 1 commit into
codeigniter4:developfrom
gr8man:fix/incomingrequest-post-max-size-unlimited

Conversation

@gr8man

@gr8man gr8man commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Description

PHP treats post_max_size values of 0 or -1 as unlimited, but IncomingRequest compared Content-Length against the raw value, so the request body was never read. Non-positive values are now treated as PHP_INT_MAX.

Checklist:

  • Securely signed commits
  • Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
  • Unit testing, with >80% coverage
  • User guide updated
  • Conforms to style guide

@carson-codeigniter4 carson-codeigniter4 Bot added the bug Verified issues on the current code behavior or pull requests that will fix them label Oct 21, 2026
Comment thread user_guide_src/source/changelogs/v4.7.6.rst Outdated
@paulbalandan

Copy link
Copy Markdown
Member

Instead of a hand-rolled parser, we can use PHP's own ini_parse_quantity() function introduced in PHP 8.2. This function could also handle hex, octal, and binary numbers which post_max_size can accept. Also, it handles the lowercased suffix which this parser currently does not.

Comment thread system/HTTP/IncomingRequest.php Outdated
Comment thread tests/system/HTTP/IncomingRequestTest.php
@paulbalandan paulbalandan changed the title fix(HTTP): read request body when post_max_size is unlimited fix(HTTP): read request body when post_max_size is unlimited Oct 22, 2026
Comment thread system/HTTP/IncomingRequest.php Outdated
@carson-codeigniter4 carson-codeigniter4 Bot added the stale Pull requests with conflicts label Oct 23, 2026
@carson-codeigniter4

This comment has been minimized.

PHP treats post_max_size values of 0 or -1 as unlimited, but IncomingRequest compared Content-Length against the raw value, so the request body was never read. Use ini_parse_quantity() and treat non-positive values as PHP_INT_MAX.
@gr8man
gr8man force-pushed the fix/incomingrequest-post-max-size-unlimited branch from 130e931 to cfc5c72 Compare October 23, 2026 19:02
@carson-codeigniter4 carson-codeigniter4 Bot removed the stale Pull requests with conflicts label Oct 23, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Verified issues on the current code behavior or pull requests that will fix them

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants