Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118601
MIME-Version: 1.0
References: <CABiw4UhL6NTD+iPPY=9qwN5-bKABkLxgrPDA2awO171Txi1-eQ@mail.gmail.com>
 <CAGa2bXZa-3sEQf1LSEfOWMd85R-FZo5HbLb1vw8a-2v+s1Wu=A@mail.gmail.com>
 <CAAfnsFWVzkFQ2+d1mZk-Fds84taceQsbBa0XxE0V1ktGcVEG5g@mail.gmail.com>
 <CANMwmbPhD6A0tejoq1=akNadM0pANs1xzCFyikSXuTcwv+qKBg@mail.gmail.com> <CA+p1FabG2fpmrT8ZcwnbHjtJVkwsg--yQyetQcF+rZDcMs-9DQ@mail.gmail.com>
In-Reply-To: <CA+p1FabG2fpmrT8ZcwnbHjtJVkwsg--yQyetQcF+rZDcMs-9DQ@mail.gmail.com>
Date: Sat, 10 Sep 2022 23:29:51 +0900
Message-ID: <CAGa2bXbxk75N8hEW7HuSuTEp9OcE77-QxraPX57suXkKRa2JYg@mail.gmail.com>
To: David Gebler <davidgebler@gmail.com>
Cc: juan carlos morales <dev.juan.morales@gmail.com>, Peter Kokot <petk@php.net>, Misha <mishanon@gmail.com>, 
	internals@lists.php.net
Content-Type: multipart/alternative; boundary="00000000000008778205e853813f"
Subject: Re: [PHP-DEV] Increase maximum size of an uploaded file to 50Mbyte
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--00000000000008778205e853813f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

2022=E5=B9=B49=E6=9C=8810=E6=97=A5(=E5=9C=9F) 23:23 David Gebler <davidgebl=
er@gmail.com>:

> On Sat, Sep 10, 2022 at 3:05 PM juan carlos morales <
> dev.juan.morales@gmail.com> wrote:
>
>> I also agree that increasing the size to something bigger than 8M
>> might not be a good idea; I can imagine that a value bigger than 8M
>> (like 50M) will cause an impact in hosting platforms specially, which
>> will be forced to always change the php's default values to a lower
>> one, because of potential DoS Attacks.
>>
>> Default settings should have a reasonable level of security in mind.
>>
>
> Do these settings actually have any impact in respect of DoS attacks? As
> far as I'm aware, neither post_max_size nor upload_max_filesize do anythi=
ng
> to prevent or terminate processes where the client sends data exceeding
> these limits, that's something you should handle in your webserver.
>

For example, password hash DoS attack was made possible  because PHP allows
8MB post data.

https://www.acunetix.com/vulnerabilities/web/long-password-denial-of-servic=
e/

IIRC, Drupal has a security release for this.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--00000000000008778205e853813f--