Changing upload_max_filesize on PHP

Ross_2025 0
Viewed 327023

I'm using PHP 5.3.0 and have encountered something that might be a bug (in which case I'll report it) or might be me - so I'm asking to make sure.

When running this code:

<?php
ini_set('upload_max_filesize', '10M');
echo ini_get('upload_max_filesize'), ", " , ini_get('post_max_size')

I end up with:

2M, 8M

This is despite my php.ini setting these higher:

upload_max_filesize = 10M
post_max_size = 10M

(occuring only once)

Because the error occurs after setting the value as well as it being set in php.ini I'm inclined to think it's a bug. Can anyone confirm or point me where I'm going wrong?

Update: Looks like restarting Apache fixed this - I always thought it didn't need to be restarted if you changed php.ini.

upload php
11 Answers

You can't use shorthand notation to set configuration values outside of PHP.ini. I assume it's falling back to 2MB as the compiled default when confronted with a bad value.

On the other hand, I don't think upload_max_filesize could be set using ini_set(). The "official" list states that it is PHP_INI_PERDIR .

Rob_35420

Are you using a shared hosting provider? It could be master settings overriding anything you're trying to change. Have you tried adding those into your .htaccess?

php_value upload_max_filesize 10M
php_value post_max_size 10M
user_703930

This can also be controlled with the apache configuration. Check the httpd.conf and/or .htaccess for something like the following:

php_value upload_max_filesize 10M
user_423040

Please be advised that setting a large post_max_size or upload_max_filesize for a complete server or a complete virtual host is not a good idea as it may lead to increased security risks.

The risk is that an attacker may send very large POST requests and overloading your server memory and CPU as it has to parse and process those requests before handling them to your PHP script.

So it's best to limit changing this setting to some files or directories. For example if I want to /admin/files/ and /admin/images/ I can use:

<If "%{REQUEST_URI} =~ m!^/admin/(files|images)/! && -n %{HTTP_COOKIE}">
    php_value post_max_size 256M
    php_value upload_max_filesize 256M
</If>

I also require the request to have a cookie to avoid basic attacks. This will not protect you against attacks coming from non-authenticated users, but may delay any attack.

This setting can be used in Apache server configuration files, and .htaccess files as well.

user_12247770

This solution can be applied only if the issue is on a WordPress installation!

If you don't have FTP access or too lazy to edit files,

You can use Increase Maximum Upload File Size plugin to increase the maximum upload file size.

user_39943040
Related