The length of input element name attributes being used since the commit which addressed issue #1402174: error messages are not displayed within the fieldset causes variables to be dropped (and sometimes user IPs to be banned) when using the default settings of the Suhosin PHP extension.
By default, Suhosin limits POST variable names to 64 characters (http://www.hardened-php.net/suhosin/configuration.html#suhosin.post.max_...). Variable names created by your module are often significantly longer than this (e.g, name="commerce_fieldgroup_pane__group_registrant|commerce_order|commerce_order|form[field_affiliation][und][0][value]").
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | 1421252.2-commerce_fieldgroup-panes-long-var-names.patch | 2.47 KB | mrfelton |
| #1 | 1421252-commerce_fieldgroup-panes-long-var-names.patch | 769 bytes | mrfelton |
Comments
Comment #1
mrfelton commentedSpent the past 12 hours trying to track this. Huge great big POST variables names like this were being stripped out, and never getting back from the browser to the server:
['commerce_fieldgroup_pane__group_cw_fundraising_comments|commerce_order|commerce_order|form']['field_cw_fundraising_comments']['und'][0]['field_cw_fundraising_name']['und'][0][value]
I don't see any need for great big variable names like this. Attached patch switches from using $group->identifier to $group->group_name, turning the above into:
commerce_fieldgroup_pane__group_cw_fundraising_comments[field_cw_fundraising_comments][und][0][field_cw_fundraising_name][und][0][value]
Still pretty long, but it gets things going again at least. All we are loosing from the id is "|commerce_order|commerce_order|form" which I dont think really helps. The name is unique enough, no?
Comment #2
mrfelton commentedUpdated patch, removes now unused variables (actually, they were never used).
Comment #3
simon georges commentedThis is badly needed (maybe because something like https://bugs.php.net/bug.php?id=33786 too?).
On some platforms, the variables are dropped during submission (they are not in $_POST, although they have been posted by the browser).
Anyway, the patch works for me, thanks (a lot)!
Comment #4
pcambraCommitted an slightly changed version, thanks a lot!