Well, the point of that change was to prevent a hostile user from DoSing your server with malicious GET/POST requests.

I imagine it would actually be fairly difficult to accidentally recreate this issue, or let it slip through testing. No amount of patches in the world will protect you from idiots with access to your codebase

Maybe they're referring to the $_POST array? You can't fix that in your app code.

I think the most obvious exploit path is using thousands of query parameters, which are inserted into an "array" in PHP.

An ini setting seems like a terrible and incomplete fix to the problem.

> An ini setting seems like a terrible and incomplete fix to the problem.

Why? It solves the problem entirely.

It only solves the exploit path, not the vulnerability.

The true issue is that their hashing algorithm sucks. Any patch that doesn't fix the hashing algorithm is a band-aid and not a true fix.

It is somewhat risky to fundamentally change the hashing algorithm late in the release cycle (RC4). It is bound to cause problems. The ini-Option prevents the obvious threat without doing deep changes to the core.