Invoice creation failure and corruption due to max_input_vars

[kevinoid]

After clicking "Invoice" from the "Tasks" tab of the "View Client" page with more than 78 tasks selected, then clicking "Save Draft" on the "New Invoice" page without making any changes, a new client is created with all fields blank, a new invoice is created for that client, and most but not all selected tasks are reassigned to the new blank client.

When pressing "Save Draft", the following message appears in the Apache error log:

[Wed Nov 14 17:48:32.094935 2018] [:error] [pid 9081] [client 192.168.0.5] PHP Warning:  Unknown: Input variables exceeded 1000. To increase the limit change max_input_vars in php.ini. in Unknown on line 0, referer: https://example.com/invoices/create/3

Based on some ad-hoc logging, it appears that the client.public_id and client.name request variables were dropped, which may be the source of the behavior described above. Increasing max_input_vars in php.ini increases the number of tasks which can be selected before the issue occurs.

You may want to consider restructuring the request to use fewer variables (the PHP default limit is 1000), setting max_input_vars, suhosin.post.max_vars, and suhosin.request.max_vars in .htaccess, detecting requests which likely surpassed the limit to reject/warn about it, and/or adding code to prevent client/invoice/task corruption from bad requests.

Thanks for considering,
Kevin