Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118598
MIME-Version: 1.0
References: <CABiw4UhL6NTD+iPPY=9qwN5-bKABkLxgrPDA2awO171Txi1-eQ@mail.gmail.com>
 <CAGa2bXZa-3sEQf1LSEfOWMd85R-FZo5HbLb1vw8a-2v+s1Wu=A@mail.gmail.com>
In-Reply-To: <CAGa2bXZa-3sEQf1LSEfOWMd85R-FZo5HbLb1vw8a-2v+s1Wu=A@mail.gmail.com>
Date: Sat, 10 Sep 2022 14:40:37 +0200
Message-ID: <CAAfnsFWVzkFQ2+d1mZk-Fds84taceQsbBa0XxE0V1ktGcVEG5g@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Misha <mishanon@gmail.com>, internals@lists.php.net
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Increase maximum size of an uploaded file to 50Mbyte
From: petk@php.net (Peter Kokot)

On Sat, 10 Sept 2022 at 11:32, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
> 2022=E5=B9=B49=E6=9C=887=E6=97=A5(=E6=B0=B4) 22:58 Misha <mishanon@gmail.=
com>:
>
> > Hello everyone,
> >
> > We spend a lot of time to increase limits for uploads file in PHP. Can =
we
> > increase it in php.ini?
> >
> > Current value is 2Mb. Its so small value, when photo image can take 8Mb=
 on
> > iPhone X.
> > We should increase it to 50Mb, because DevOps engineers do useless work
> > trying to change it.
> >
> > I have prepared PR for it https://github.com/php/php-src/pull/9315
> >
> > Take a look and approve it please.
> >
> > Thanks!
> >
> > --
> > Best regards, Michail
> >
>
>
> I can understand the motivation, but I am against the change.
>
> To increase uploaded file max size, POST max size must be increased too.
> For 99.99% entry points do not need 50MB POST max size.
> and larger POST max size increases DoS risks.
>
> Default upload file max size and POST max size should be small enough val=
ue
> for better security.
> IMHO, PHP script that handles large POST data should increase these
> settings.
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net

If I'm not mistaken, even the memory_limit needs to be increased when
the post_max_size directive is larger. The memory_limit needs to be
larger than post_max_size. And the post_max_size must be slightly
larger than upload_max_size.

memory_limit > post_max_size > upload_max_size