Actions
Todo #15893
closed
Limit PHP request order processing to only GET and POST
Start date:
Due date:
% Done:
100%
Estimated time:
Plus Target Version:
25.07
Release Notes:
Default
Description
Currently pfSense software does not define a value for request_order in php.ini, so it defaults to variables_order which is set to "GPCS". This sets $_REQUEST values first from GET parameters, then POST parameters, then cookie values, then session data.
There do not appear to be any areas in pfSense software base code or packages which utilize $_REQUEST for anything other than GET or POST, so it should be safer to limit the request order to only GET and POST.
This should also address issues users have seen with cookie data interfering in the past, such as #11268, which should be re-tested after this change.
Related issues
Updated by
Actions