File Upload

[Thomas Mlynarczyk]

Hello,

I want to upload files via an HTML form and store them somewhere on my
webspace. So far so good. I am just a bit concerned about security issues
and traffic. My provider has set a file size limit of 20MB in php.ini. My
questions are:

1) If some evil web terrorist tries to upload a file which is larger than
the maximum allowed by the setting in php.ini - will the transfer be
cancelled by the server when the limit is reached so that there will not be
unnecessary traffic or will the whole file still be transmitted to the
server?
2) If the transfer is cancelled, is there a way for me to limit the maximum
upload file size to *less* than what my provider specifies - serverside?
3) How can I prevent evil people from uploading file after file (using some
automated process) and thus filling up my webspace and using up my monthly
traffic volume?

Thanks and greetings,
Thomas

P.S.: Does this NG have a FAQ?

--

[David Walker]

> I want to upload files via an HTML form and store them somewhere on my

webspace. So far so good. I am just a bit concerned about security issues
and traffic. My provider has set a file size limit of 20MB in php.ini. My
questions are:
Is this going to be for the public to upload, or just you? If its just you
you can have some sort of authentication on the page before they get the
upload form. If not you will be able to track the uploads if you have the
form on posting write their IP, and maybe some other details to a file.
Then on uploads check that file for the IP and dates / sizes, and if they're
uploading too much too quickly just don't allow the upload. The script to
do that would also check for old upload records and delete them from the log
file if necessary so it doesn't just keep growing.
1) If some evil web terrorist tries to upload a file which is larger than
I think 'evil web terrorists' have better things to do than fill up your
20MB!
2) If the transfer is cancelled, is there a way for me to limit the maximum upload file size to *less* than what my provider specifies - serverside?
Yeah - just on your processing of the upload examine the file size - if its
too big reject it. You have to write the code to move the file from the
temp dir to your own directory, so you can do whatever you like to the file.
3) How can I prevent evil people from uploading file after file (using some automated process) and thus filling up my webspace and using up my monthly
traffic volume?
See above - you can check anything you like, and a simple script and log
file would sort this out.
P.S.: Does this NG have a FAQ?

Not that I know of - but the PHP documentation is usually very good. The
web based version of the docs also have user comments on, a lot of which can
be helpful if you're stuck with something.

David

[Thomas Mlynarczyk]

Also sprach David Walker:

[File Upload]

Is this going to be for the public to upload, or just you?
It's for the public.
If its
just you you can have some sort of authentication on the page before
they get the upload form. If not you will be able to track the
uploads if you have the form on posting write their IP, and maybe
some other details to a file. Then on uploads check that file for the
IP and dates / sizes, and if they're uploading too much too quickly
just don't allow the upload. The script to do that would also check
for old upload records and delete them from the log file if necessary
so it doesn't just keep growing.

Thanks for the suggestion. I will try something like that.

1) If some evil web terrorist tries to upload a file which is larger
than

I think 'evil web terrorists' have better things to do than fill up
your 20MB!

Still, if someone doesn't like me as much as (s)he should, they might try
bad jokes like this. Besides, the 20MB is the maximum file size for uploads,
not my total web space. Following your above suggestion, however, should
make any misuse much harder.

2) If the transfer is cancelled, is there a way for me to limit the
maximum upload file size to *less* than what my provider specifies -
serverside?

Yeah - just on your processing of the upload examine the file size -
if its too big reject it.

This, however, means that the whole file was already completely transmitted
to the server, and some of my free monthly transfer budget has been used up
in the process. I am looking for a solution which will prevent any data
transfer to the server exceeding a specified limit. There is MAX_FILE_SIZE
to specify a size limit client side, but as it's client side one cannot rely
on it, especially if someone tries to deliberately get around it.

P.S.: Does this NG have a FAQ?

Not that I know of - but the PHP documentation is usually very good.
The web based version of the docs also have user comments on, a lot
of which can be helpful if you're stuck with something.

Yes, that's true. Still, I'd like some more explanation on how "things are
handled" internally. For example, if setting a maximum size for upload files
in php.ini means that the server will somehow cancel the transmission
process when the limit is reached, and thus preventing traffic "over the
limit".

--

[David Walker]

> This, however, means that the whole file was already completely
transmitted

to the server, and some of my free monthly transfer budget has been used up in the process. I am looking for a solution which will prevent any data
transfer to the server exceeding a specified limit. There is MAX_FILE_SIZE
to specify a size limit client side, but as it's client side one cannot rely on it, especially if someone tries to deliberately get around it.
Not really sure how it works unfortunately. I think it does probably stop
the uploads once its past the PHP file limit - as far as I remember it will
either just cut the file off at that point and save it as it is (incomplete)
or will just reject the transfer - this I think depends on the setting
somewhere when you're doing the upload handling in PHP.
Yes, that's true. Still, I'd like some more explanation on how "things are
handled" internally. For example, if setting a maximum size for upload files in php.ini means that the server will somehow cancel the transmission
process when the limit is reached, and thus preventing traffic "over the
limit".

Unfortunately as I just mentioned above I don't really know myself. I'm
pretty sure it would stop the upload if its a PHP size limit - I think PHP
is probably clever enough to know to do that.
Incidentally, I think you can change the PHP.ini settings dynamically for
individual pages - use ini_set - if you look in the PHP docs its all in
there how to do it so you could change the limit for individual pages, and
it'd be impossible for the client to get around it.

David

[Thomas Mlynarczyk]

Also sprach David Walker:

Incidentally, I think you can change the PHP.ini settings dynamically
for individual pages - use ini_set - if you look in the PHP docs its
all in there how to do it so you could change the limit for
individual pages, and it'd be impossible for the client to get around
it.

I just had a look at the php manual - well, I *can* modify
"upload_max_filesize" using ini_set(), but when my script processes this
command, the file will already have been uploaded, so my change will come
too late (a design bug)?

BTW, how does "post_max_size" influence "upload_max_filesize"? I mean,
files are uploaded via "post", so what's the effective size limit if
post_max_size=8M and upload_max_filesize=20M, as it is the case with my
provider? He has PHP running as CGI, not as an Apache module - does this
make any difference?

--

[David Walker]

> > Incidentally, I think you can change the PHP.ini settings dynamically

for individual pages - use ini_set - if you look in the PHP docs its
all in there how to do it so you could change the limit for
individual pages, and it'd be impossible for the client to get around
it.
I just had a look at the php manual - well, I *can* modify
"upload_max_filesize" using ini_set(), but when my script processes this
command, the file will already have been uploaded, so my change will come
too late (a design bug)?

If you put that at the top of the page recieving the upload, then that page
should I think be read before the upload starts. If not, try putting it on
both the sending and recieving page, and then its bound to be there
somewhere.
BTW, how does "post_max_size" influence "upload_max_filesize"? I mean,
files are uploaded via "post", so what's the effective size limit if
post_max_size=8M and upload_max_filesize=20M, as it is the case with my
provider? He has PHP running as CGI, not as an Apache module - does this
make any difference?

The best advice I can give here is to just try it. Play about with the
settings, try to upload different files, and see what it lets you do. Its
often easier than trying to predict behaviour not given in the manual - I do
a lot of my stuff just by testing simple scripts first, and once they work
transfer it to the proper page.
Otherwise someone else may be able to offer help - I haven't done enough
with uploads to really know, i've just allowed simple uploads to be done,
and move them - i don't have to worry about bandwidth or disk space, and the
page is protected so only a few people can access it anyway.
Good luck!

David

[Thomas Mlynarczyk]

Also sprach David Walker:

I just had a look at the php manual - well, I *can* modify
"upload_max_filesize" using ini_set(), but when my script processes
this command, the file will already have been uploaded, so my change
will come too late (a design bug)?
If you put that at the top of the page recieving the upload, then
that page should I think be read before the upload starts.

But the upload is part of the request for this page sent by the client. The
php script is called only after all of the client's request including post
data has been received - or am I wrong?
If not,
try putting it on both the sending and recieving page, and then its
bound to be there somewhere.

Even if I put it on the page that generates the upload form - as soon as
that page is sent out to the client the process is finished and the
ini_set() setting is lost. Or am I wrong again?

As for the precedence of different ini settings - I think you are right -
the best thing to do is try it out.

Thanks,
Thomas

[David Walker]

> > If you put that at the top of the page recieving the upload, then

that page should I think be read before the upload starts.
But the upload is part of the request for this page sent by the client.

The php script is called only after all of the client's request including post
data has been received - or am I wrong?
Not really sure how it works to be honest. I was thinking that it should
just so that things like this would work... then again, if you do upload a
big file the page never goes until the upload is complete. So, maybe
putting it on the sending page, as I said below might be a better idea???

If not,
try putting it on both the sending and recieving page, and then its
bound to be there somewhere.

Even if I put it on the page that generates the upload form - as soon as
that page is sent out to the client the process is finished and the
ini_set() setting is lost. Or am I wrong again?

Well I was thinking it must get the setting from one page or the other
otherwise theres no point in having it. Since the browser stays on the
sending page until the upload is complete it looks like this is more likely
to work.
As for the precedence of different ini settings - I think you are right -
the best thing to do is try it out.

Yeah - just shove it on a little script, see what happens.

David

[Thomas Mlynarczyk]

Also sprach David Walker:

Not really sure how it works to be honest. I was thinking that it
should just so that things like this would work... Well I was thinking it must get the setting from one page or the other
otherwise theres no point in having it.

Well, ini_set() is not just for setting this one option. It certainly works
fine with other things, only in this special case it is not very helpful.
But as PHP is running as a CGI with my provider, doesn't this mean I have my
very own "environment" all to myself, so theoretically I should be allowed
to modify "my" php.ini somehow? What actually is the difference between
those local and master values that phpinfo() reports?

Greetings, Thomas

[David Walker]

> Well, ini_set() is not just for setting this one option. It certainly
works

It doens't have all the values there though, so if they allowed that value
to be changed then it must do something. I now think that it must take
affect on the calling page if anything.

fine with other things, only in this special case it is not very helpful.
But as PHP is running as a CGI with my provider, doesn't this mean I have my very own "environment" all to myself, so theoretically I should be allowed
to modify "my" php.ini somehow? What actually is the difference between
those local and master values that phpinfo() reports?

To be honest i've never seen a difference between the Local and Master
values on any server yet. I don't think its to do with CGI though - thats
just a different way to get PHP to work, but it is usually a master thing
for the whole server, not separate for individual folders or whatever.
Unless they've given you access via something other than FTP or web based
uploads though, theres no way you'd ever see PHP.ini anyway.
Ask your ISP though, see what they say - probably won't be very helpful, but
just sending a quick e-mail can't hurt, and could maybe be useful if you get
someone who knows something to respond.

David

[Thomas Mlynarczyk]

I've just tried out different settings for post_max_size and
upload_max_filesize in php.ini. As was to be expected, the post_max_size
prevails, and if my file is bigger than that, the corresponding
$_FILES['myfile'] does not exist. So it actually makes no sense to make
upload_max_filesize bigger than post_max_size - still, this seems to be the
default setting...?

Well, ini_set() is not just for setting this one option. It
certainly works

It doens't have all the values there though, so if they allowed that
value to be changed then it must do something. I now think that it
must take affect on the calling page if anything.

So I have something else to try out tomorrow...

fine with other things, only in this special case it is not very
helpful. But as PHP is running as a CGI with my provider, doesn't
this mean I have my very own "environment" all to myself, so
theoretically I should be allowed to modify "my" php.ini somehow?
What actually is the difference between those local and master
values that phpinfo() reports?

To be honest i've never seen a difference between the Local and Master
values on any server yet. I don't think its to do with CGI though -
thats just a different way to get PHP to work, but it is usually a
master thing for the whole server, not separate for individual
folders or whatever. Unless they've given you access via something
other than FTP or web based uploads though, theres no way you'd ever
see PHP.ini anyway. Ask your ISP though, see what they say - probably
won't be very helpful, but just sending a quick e-mail can't hurt,
and could maybe be useful if you get someone who knows something to
respond.

"If", yes, indeed. Still, I will try.

Greetings, Thomas

[David Walker]

> I've just tried out different settings for post_max_size and

upload_max_filesize in php.ini. As was to be expected, the post_max_size
prevails, and if my file is bigger than that, the corresponding
$_FILES['myfile'] does not exist. So it actually makes no sense to make
upload_max_filesize bigger than post_max_size - still, this seems to be the default setting...?

Possibly if someone uploads by some method other than POST - not GET cos
that isn't big enough, so not sure what's left... Maybe something, but
doesn't matter.

You're getting closer to an answer anyway - just got to make sure it takes
affect on the right page now, which should be easy to try.

David