Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118583
MIME-Version: 1.0
References: <CABiw4UhL6NTD+iPPY=9qwN5-bKABkLxgrPDA2awO171Txi1-eQ@mail.gmail.com>
In-Reply-To: <CABiw4UhL6NTD+iPPY=9qwN5-bKABkLxgrPDA2awO171Txi1-eQ@mail.gmail.com>
Date: Thu, 8 Sep 2022 12:28:51 +0100
Message-ID: <CAEKnhAH_NVZCHVNVNkCNWTCCT4HW+0QZy=mmUQs-oicbr89EYg@mail.gmail.com>
To: Misha <mishanon@gmail.com>
Cc: PHP internals list <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000080f2d105e828bc9f"
Subject: Re: [PHP-DEV] Increase maximum size of an uploaded file to 50Mbyte
From: bukka@php.net (Jakub Zelenka)

--00000000000080f2d105e828bc9f
Content-Type: text/plain; charset="UTF-8"

On Wed, Sep 7, 2022 at 2:58 PM Misha <mishanon@gmail.com> wrote:

> Hello everyone,
>
> We spend a lot of time to increase limits for uploads file in PHP. Can we
> increase it in php.ini?
>
> Current value is 2Mb. Its so small value, when photo image can take 8Mb on
> iPhone X.
> We should increase it to 50Mb, because DevOps engineers do useless work
> trying to change it.
>
>
I think the problem is that too high value can potentially result in DoS if
you have for example some API that might be sensitive to it. I think this
should be really handled on web server though and Apache httpd [1] as well
as nginx [2] have the default limit set to 1MB. The only problem is that
Apache introduced that limit default quite recently (2.4.53) so there are
likely still lots of users where this value matters more if they don't
tweak defaults. I guess it might be wise to do much smaller increase and
start maybe somewher closer to 8MB or maybe even wait a little bit longer
till most users have safe defaults on web server.

[1] https://httpd.apache.org/docs/2.4/mod/core.html#limitrequestbody
[2]
http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size

Regards

Jakub

--00000000000080f2d105e828bc9f--