able to upload 28 meg file, yet php.ini limits posts to 10 megs.What is up with that?

[Lawrence Krubner]

To guard against our users possibly uploading huge files, I've got this
in my php.ini file:

; Maximum size of POST data that PHP will accept.
post_max_size = 10M
On a server running Ubuntu Linux. The PHP version:

root@ldc310:/etc/php5/cli# php -v
PHP 5.1.6 (cli) (built: Nov 28 2007 22:52:49)

I just uploaded a 28 meg file to the server. I have a PHP script that
automatically resizes the images to less than a meg. However, I was
assuming that the upload should have failed, before the PHP script ever
had the chance to resize the file. How do I limit how much our users can
upload? I really don't want the users to have the power to upload 30 or
40 or 50 meg files.

The server does have Plesk installed, which I know, in times past, has
found ways to undermine the settings in php.ini. For instance, for
open_basedir, the value that gets written in the httpd.conf file, in
each vhost directory, takes precedence over whatever I put in php.ini.
But I've never seen Plesk undermine the importance of the post_max_size
setting, nor can I imagine where Plesk might store such a conf setting
if it did.

Any thoughts on what might be wrong? Are there other places some
configuration data might be taking precedent?

[NC]

On May 30, 7:01 pm, Lawrence Krubner <lawre...@krubn er.comwrote:

>
To guard against our users possibly uploading huge files, I've
got this in my php.ini file:

; Maximum size of POST data that PHP will accept.
post_max_size = 10M

What about upload_max_file size? And what, if anything, is
LimitRequestBod y directive in Apache set to? Are there any .htaccess
files that could possibly change any of this?

And while we're checking for possibilities, are you editing the same
php.ini PHP is using?

Also, are you running PHP as an Apache module or CGI/FastCGI?

Cheers,
NC

[Lawrence Krubner]

NC wrote:

On May 30, 7:01 pm, Lawrence Krubner <lawre...@krubn er.comwrote:

>To guard against our users possibly uploading huge files, I've
got this in my php.ini file:

; Maximum size of POST data that PHP will accept.
post_max_siz e = 10M

What about upload_max_file size?

From my php.ini file:

; Maximum allowed size for uploaded files.
upload_max_file size = 10M

And what, if anything, is
LimitRequestBod y directive in Apache set to?

This returns nothing:

root@ldc310:~# cd /etc/apache2/
root@ldc310:/etc/apache2# grep -R LimitRequestBod y *

So I assume it is not set.

Are there any .htaccess
files that could possibly change any of this?

No, not at the top level of the site, where the upload script is.

And while we're checking for possibilities, are you editing the same
php.ini PHP is using?

I assume, but how could I be sure? This tells me the version:

root@ldc310:/var/www/vhosts/thesecondroad.o rg/httpdocs# php -v
PHP 5.1.6 (cli) (built: Nov 28 2007 22:52:49)

Since it is PHP version 5, I assume this is the right path for editing:

root@ldc310:/# nano /etc/php5/cli/php.ini

Any way I can be sure? How do I check?

Also, are you running PHP as an Apache module or CGI/FastCGI?

An Apache module.

-- lawrence

[NC]

On May 31, 12:04 am, Lawrence Krubner <lawre...@krubn er.comwrote:

NC wrote:

And what, if anything, is LimitRequestBod y directive
in Apache set to?

This returns nothing:

root@ldc310:~# cd /etc/apache2/
root@ldc310:/etc/apache2# grep -R LimitRequestBod y *

So I assume it is not set.

And if it's not set, it takes the default value, zero (meaning, no
limit).

And while we're checking for possibilities, are you editing
the same php.ini PHP is using?

I assume, but how could I be sure?

Run phpinfo() FROM THE BROWSER, not from command line. Look for
"Configurat ion File (php.ini) Path" in the output. The command-line
interpreter, the server module, and the CGI/FastCGI executable can
each have a different php.ini...

Since it is PHP version 5, I assume this is the right path for
editing:

root@ldc310:/# nano /etc/php5/cli/php.ini

I don't think so; note the "cli" in the path. Looks like you're
editing the php.ini that's used by the command-line interpreter,
not the one used by the Apache module.

Any way I can be sure? How do I check?

See the bit on phpinfo() above.

Cheers,
NC

[C. (http://symcbean.blogspot.com/)]

On May 31, 3:01 am, Lawrence Krubner <lawre...@krubn er.comwrote:

To guard against our users possibly uploading huge files, I've got this
in my php.ini file:

; Maximum size of POST data that PHP will accept.
post_max_size = 10M

On a server running Ubuntu Linux. The PHP version:

root@ldc310:/etc/php5/cli# php -v
PHP 5.1.6 (cli) (built: Nov 28 2007 22:52:49)

I just uploaded a 28 meg file to the server. I have a PHP script that
automatically resizes the images to less than a meg. However, I was
assuming that the upload should have failed, before the PHP script ever
had the chance to resize the file. How do I limit how much our users can
upload? I really don't want the users to have the power to upload 30 or
40 or 50 meg files.

The server does have Plesk installed, which I know, in times past, has
found ways to undermine the settings in php.ini.

No - override - exactly as it's supposed to do. But its worth noting
that the only time I've seen plesk is on hosted servers - which rather
implies that you're already paying somebody to answer these questions.

For instance, for
open_basedir, the value that gets written in the httpd.conf file, in
each vhost directory, takes precedence over whatever I put in php.ini.
But I've never seen Plesk undermine the importance of the post_max_size
setting, nor can I imagine where Plesk might store such a conf setting
if it did.

Any thoughts on what might be wrong? Are there other places some
configuration data might be taking precedent?

The post_max_size is PHP specific thing - assuming it did work as you
expect, it wouldn't stop anyone from posting more data to the
webserver - indeed, according to the manual, it only says that when
more than this limit is posted, the $_POST and $_GET vars are empty -
no mention of $_FILES. A better setting would be to set the limit
using upload_max_file size, but again this does not stop people from
abusing your bandwidth.

If you set the limit in the webserver config then it will terminate
the conenction.

C.

[Rik Wasmus]

On Sat, 31 May 2008 13:38:57 +0200, C. (http://symcbean.blogspot.com/)
<co************ @gmail.comwrote :

On May 31, 3:01 am, Lawrence Krubner <lawre...@krubn er.comwrote:

>To guard against our users possibly uploading huge files, I've got this
in my php.ini file:

; Maximum size of POST data that PHP will accept.
post_max_siz e = 10M

On a server running Ubuntu Linux. The PHP version:

root@ldc310:/etc/php5/cli# php -v
PHP 5.1.6 (cli) (built: Nov 28 2007 22:52:49)

I just uploaded a 28 meg file to the server. I have a PHP script that
automaticall y resizes the images to less than a meg. However, I was
assuming that the upload should have failed, before the PHP script ever
had the chance to resize the file. How do I limit how much our users can
upload? I really don't want the users to have the power to upload 30 or
40 or 50 meg files.

The server does have Plesk installed, which I know, in times past, has
found ways to undermine the settings in php.ini.

No - override - exactly as it's supposed to do. But its worth noting
that the only time I've seen plesk is on hosted servers - which rather
implies that you're already paying somebody to answer these questions.

Well, even on my personal VPS I have Plesk. Really takes the edge of
administrative tasks I have no interest in for a hobby server :)

>For instance, for
open_basedir , the value that gets written in the httpd.conf file, in
each vhost directory, takes precedence over whatever I put in php.ini..
But I've never seen Plesk undermine the importance of the post_max_size
setting, nor can I imagine where Plesk might store such a conf setting
if it did.

Any thoughts on what might be wrong? Are there other places some
configuratio n data might be taking precedent?

The post_max_size is PHP specific thing - assuming it did work as you
expect, it wouldn't stop anyone from posting more data to the
webserver - indeed, according to the manual, it only says that when
more than this limit is posted, the $_POST and $_GET vars are empty -
no mention of $_FILES. A better setting would be to set the limit
using upload_max_file size, but again this does not stop people from
abusing your bandwidth.

If you set the limit in the webserver config then it will terminate
the conenction.

If concerned, it would be best to limit at the source indeed, i.e. the
webserver. If one wants to do it in PHP, a php_admin_value in httpd.conf/
vhost config should work. They ought not be overridable bij .htaccess
files, and as max_upload_file size is PHP_INI_PERDIR since 4.2.3 an
ini_set() shouldn't work either.
--
Rik Wasmus
....spamrun finished

[MikeB]

On May 31, 6:38 am, "C. (http://symcbean.blogsp ot.com/)"
<colin.mckin... @gmail.comwrote :

If you set the limit in the webserver config then it will terminate
the conenction.

I probably should not get involved in a discussion like this, but I
can't help it. If the purpose is to save bandwidth, does the webserver
terminate the connection *after* if has uploaded to the specified
limit?

If tat is the case, that would be wasteful for an upload. Is there not
a facility that one could write just before the upload function is
involved to check the size of the file on the client and not start the
upload at that point? That would seem to be more bandwidth-sensible?

[MikeB]

On May 31, 10:45 am, Lawrence Krubner <lawre...@krubn er.comwrote:

NC wrote:

On May 31, 12:04 am, Lawrence Krubner <lawre...@krubn er.comwrote:

NC wrote:

>And what, if anything, is LimitRequestBod y directive
in Apache set to?
This returns nothing:

root@ldc310:~# cd /etc/apache2/
root@ldc310:/etc/apache2# grep -R LimitRequestBod y *

So I assume it is not set.

And if it's not set, it takes the default value, zero (meaning, no
limit).

>And while we're checking for possibilities, are you editing
the same php.ini PHP is using?
I assume, but how could I be sure?

Run phpinfo() FROM THE BROWSER, not from command line. Look for
"Configurat ion File (php.ini) Path" in the output. The command-line
interpreter, the server module, and the CGI/FastCGI executable can
each have a different php.ini...

Since it is PHP version 5, I assume this is the right path for
editing:

root@ldc310:/# nano /etc/php5/cli/php.ini

I don't think so; note the "cli" in the path. Looks like you're
editing the php.ini that's used by the command-line interpreter,
not the one used by the Apache module.

Thanks for catching that. Seems you were right.

If anyone has time and wants to do me a big favor, go here:

http://www.cyberbitten.com/my_private_page.php

login with:

user: test
password: test

then go here and try to upload a file that is bigger than 10 megs:

http://www.cyberbitten.com/my_privat...=mp_photos.htm

I appreciate anyone who can give this a test.

-- lawrence krubner

I've started an upload of a 20MB .exe file(Nessus-3.2.1.exe).

As I said in another post, perhaps you want to do a few checks to save
your bandwidth. Check that the file type is correct. Check the size
*before* you start the upload.

I'll report back if the upload crashes.

[MikeB]

On May 31, 11:04 am, MikeB <MPBr...@gmail. comwrote:

On May 31, 10:45 am, Lawrence Krubner <lawre...@krubn er.comwrote:

NC wrote:

On May 31, 12:04 am, Lawrence Krubner <lawre...@krubn er.comwrote:
>NC wrote:

>>And what, if anything, is LimitRequestBod y directive
>>in Apache set to?
>This returns nothing:

>root@ldc310: ~# cd /etc/apache2/
>root@ldc310:/etc/apache2# grep -R LimitRequestBod y *

>So I assume it is not set.

And if it's not set, it takes the default value, zero (meaning, no
limit).

>>And while we're checking for possibilities, are you editing
>>the same php.ini PHP is using?
>I assume, but how could I be sure?

Run phpinfo() FROM THE BROWSER, not from command line. Look for
"Configurat ion File (php.ini) Path" in the output. The command-line
interpreter, the server module, and the CGI/FastCGI executable can
each have a different php.ini...

>Since it is PHP version 5, I assume this is the right path for
>editing:

>root@ldc310:/# nano /etc/php5/cli/php.ini

I don't think so; note the "cli" in the path. Looks like you're
editing the php.ini that's used by the command-line interpreter,
not the one used by the Apache module.

Thanks for catching that. Seems you were right.

If anyone has time and wants to do me a big favor, go here:

http://www.cyberbitten.com/my_private_page.php

login with:

user: test
password: test

then go here and try to upload a file that is bigger than 10 megs:

http://www.cyberbitten.com/my_privat...=mp_photos.htm

I appreciate anyone who can give this a test.

-- lawrence krubner

I've started an upload of a 20MB .exe file(Nessus-3.2.1.exe).

As I said in another post, perhaps you want to do a few checks to save
your bandwidth. Check that the file type is correct. Check the size
*before* you start the upload.

I'll report back if the upload crashes.

I can't tell if it failed or uploaded successfully. I don't get an
error message or anything... ?

[The Natural Philosopher]

MikeB wrote:

On May 31, 6:38 am, "C. (http://symcbean.blogsp ot.com/)"
<colin.mckin... @gmail.comwrote :

>If you set the limit in the webserver config then it will terminate
the conenction.

I probably should not get involved in a discussion like this, but I
can't help it. If the purpose is to save bandwidth, does the webserver
terminate the connection *after* if has uploaded to the specified
limit?

The webserver doesn't KNOW what php's bandwidth limit is. It takes ALL
the POST data of which the uploaded file is part, and gives it to PHP.

If tat is the case, that would be wasteful for an upload. Is there not
a facility that one could write just before the upload function is
involved to check the size of the file on the client and not start the
upload at that point? That would seem to be more bandwidth-sensible?