I don't think it is a good idea to drop all form data from an
enctype=multipart/form-data POST when file uploads are turned off.  I
think it makes more sense only to drop the uploaded file.

A simple test script:

 <form action="form.php" enctype="multipart/form-data" method="POST">
 <input type="text" name="text">
 <input type="hidden" name="max_file_size" value="10000">
 <input name="f_file" type="file" size="60">
 </form>
 <?echo $_REQUEST['text']?>

With file_uploads set to Off in php.ini $_REQUEST['text'] is empty.

By the way, this didn't work at all in 4.1.2.  Any
enctype=multipart/form-data form without an actual file uploaded at the
same time would drop all the extra data fields.  Probably serious enough
to get 4.1.3 out the door with a fix unless we can get 4.2 out really
quickly now.  Many big PHP packages like Phorum and Mantis are affected by
this as they have forms where people may optionally include an uploaded
file.

-Rasmus


-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to