Skip to content

fix(HTTP): read request body when post_max_size is unlimited - #10646

Open
gr8man wants to merge 5 commits into
codeigniter4:developfrom
gr8man:fix/incomingrequest-post-max-size-unlimited
Open

gr8man wants to merge 5 commits into
codeigniter4:developfrom
gr8man:fix/incomingrequest-post-max-size-unlimited

Conversation

@gr8man

@gr8man gr8man commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Description

PHP treats post_max_size values of 0 or -1 as unlimited, but IncomingRequest compared Content-Length against the raw value, so the request body was never read. Non-positive values are now treated as PHP_INT_MAX.

Checklist:

  • Securely signed commits
  • Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
  • Unit testing, with >80% coverage
  • User guide updated
  • Conforms to style guide

post_max_size values of 0 or -1 mean unlimited. The previous code returned the raw value, so the Content-Length check failed and the request body was never read. Treat non-positive values as PHP_INT_MAX.
@carson-codeigniter4 carson-codeigniter4 Bot added the bug Verified issues on the current code behavior or pull requests that will fix them label Oct 21, 2026
Comment on lines +41 to +42
- **HTTP:** Fixed a bug where ``IncomingRequest`` did not read the request body
when PHP's ``post_max_size`` was set to ``0`` or ``-1`` (unlimited).

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please make it a one-liner.

@paulbalandan

Copy link
Copy Markdown
Member

Instead of a hand-rolled parser, we can use PHP's own ini_parse_quantity() function introduced in PHP 8.2. This function could also handle hex, octal, and binary numbers which post_max_size can accept. Also, it handles the lowercased suffix which this parser currently does not.

Comment thread system/HTTP/IncomingRequest.php Outdated
Comment thread tests/system/HTTP/IncomingRequestTest.php
@paulbalandan paulbalandan changed the title fix(HTTP): read request body when post_max_size is unlimited fix(HTTP): read request body when post_max_size is unlimited Oct 22, 2026
*
* A value of 0 or less means unlimited.
*/
private function getPostMaxSize(?string $postMaxSize = null): int

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do you need the default here?

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Verified issues on the current code behavior or pull requests that will fix them

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants