-
-
Notifications
You must be signed in to change notification settings - Fork 9.7k
Description
Q | A |
---|---|
Bug report? | yes |
Feature request? | no |
BC Break report? | no |
RFC? | no |
Symfony version | all |
The API for accessing file-size of Http Foundation's UploadedFile is named and documented incorrectly:
This field is backed by PHP's $_FILES['fileupload']['size'] field, which is not provided by the client, it's computed on the server-side from the number of bytes written to disk for the temp file containing the uploaded content. See here: https://github.com/php/php-src/blob/c8aa6f3a9a3d2c114d0c5e0c9fdd0a465dbb54a5/main/rfc1867.c (I wish I could point you to a more specific line, but it's computed all over the place; track how total_bytes is computed and that it's later used for ['size']).
Symfony shouldn't tell people that the size field is unreliable, as that technically would make it useless for any size checks. Instead it's a trusted value, as far as the built-in $_FILES implementation is concerned.