Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118605
MIME-Version: 1.0
In-Reply-To: <CAGa2bXbxk75N8hEW7HuSuTEp9OcE77-QxraPX57suXkKRa2JYg@mail.gmail.com>
References: <CABiw4UhL6NTD+iPPY=9qwN5-bKABkLxgrPDA2awO171Txi1-eQ@mail.gmail.com>
 <CAGa2bXZa-3sEQf1LSEfOWMd85R-FZo5HbLb1vw8a-2v+s1Wu=A@mail.gmail.com>
 <CAAfnsFWVzkFQ2+d1mZk-Fds84taceQsbBa0XxE0V1ktGcVEG5g@mail.gmail.com>
 <CANMwmbPhD6A0tejoq1=akNadM0pANs1xzCFyikSXuTcwv+qKBg@mail.gmail.com>
 <CA+p1FabG2fpmrT8ZcwnbHjtJVkwsg--yQyetQcF+rZDcMs-9DQ@mail.gmail.com> <CAGa2bXbxk75N8hEW7HuSuTEp9OcE77-QxraPX57suXkKRa2JYg@mail.gmail.com>
Date: Sun, 11 Sep 2022 09:35:19 +0500
Message-ID: <CAC_PL4wJgxbqbm=NgMoUqeLOuZeJFxNEQv9c6rJQifRHhH4KuA@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: David Gebler <davidgebler@gmail.com>, juan carlos morales <dev.juan.morales@gmail.com>, 
	Peter Kokot <petk@php.net>, Misha <mishanon@gmail.com>, internals@lists.php.net
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Increase maximum size of an uploaded file to 50Mbyte
From: office.hamzaahmad@gmail.com (Hamza Ahmad)

> We spend a lot of time to increase limits for uploads file in PHP.
For a lot of time, I assume you are using a web host that does not
allow modification to INI file directly or using INI functions, and
you have to contact your host provider for that change. Otherwise, it
is not that difficult to apply that change. Plus, this question would
have been answered in a php forum, like phpearth.
> I'm not against increasing the sizes, but 50MB might be too much.
It is possible on userland as well as configuration level. I don't
feel like it is worth doing. It will  break some websites. Most of the
projects go with default options of upload; thus, doing so will make
issues for such projects.
> By the Way... This needs an RFC right?
This change should be made with an rfc. Because it will impact a
majority of projects, and usually devs doant have to have that huge
limit. Plus, there are razed further concerns that

On 9/10/22, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> 2022=E5=B9=B49=E6=9C=8810=E6=97=A5(=E5=9C=9F) 23:23 David Gebler <davidge=
bler@gmail.com>:
>
>> On Sat, Sep 10, 2022 at 3:05 PM juan carlos morales <
>> dev.juan.morales@gmail.com> wrote:
>>
>>> I also agree that increasing the size to something bigger than 8M
>>> might not be a good idea; I can imagine that a value bigger than 8M
>>> (like 50M) will cause an impact in hosting platforms specially, which
>>> will be forced to always change the php's default values to a lower
>>> one, because of potential DoS Attacks.
>>>
>>> Default settings should have a reasonable level of security in mind.
>>>
>>
>> Do these settings actually have any impact in respect of DoS attacks? As
>> far as I'm aware, neither post_max_size nor upload_max_filesize do
>> anything
>> to prevent or terminate processes where the client sends data exceeding
>> these limits, that's something you should handle in your webserver.
>>
>
> For example, password hash DoS attack was made possible  because PHP allo=
ws
> 8MB post data.
>
> https://www.acunetix.com/vulnerabilities/web/long-password-denial-of-serv=
ice/
>
> IIRC, Drupal has a security release for this.
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>