РаспространённыС ΠΏΠΎΠ΄Π²ΠΎΠ΄Π½Ρ‹Π΅ ΠΊΠ°ΠΌΠ½ΠΈ

Π­Π»Π΅ΠΌΠ΅Π½Ρ‚Ρƒ MAX_FILE_SIZE нСльзя ΡƒΠΊΠ°Π·Ρ‹Π²Π°Ρ‚ΡŒ Ρ€Π°Π·ΠΌΠ΅Ρ€ Ρ„Π°ΠΉΠ»Π°, ΠΊΠΎΡ‚ΠΎΡ€Ρ‹ΠΉ ΠΏΡ€Π΅Π²Ρ‹ΡˆΠ°Π΅Ρ‚ ΠΏΡ€Π΅Π΄Π΅Π», ΠΊΠΎΡ‚ΠΎΡ€Ρ‹ΠΉ установили Π² Π΄ΠΈΡ€Π΅ΠΊΡ‚ΠΈΠ²Π΅ upload_max_filesize Ρ„Π°ΠΉΠ»Π° php.ini. ΠžΠ³Ρ€Π°Π½ΠΈΡ‡Π΅Π½ΠΈΠ΅ ΠΏΠΎ ΡƒΠΌΠΎΠ»Ρ‡Π°Π½ΠΈΡŽ составляСт 2 ΠΌΠ΅Π³Π°Π±Π°ΠΉΡ‚Π°.

Если установили ограничСния памяти, ΠΌΠΎΠΆΠ΅Ρ‚ ΠΏΠΎΡ‚Ρ€Π΅Π±ΠΎΠ²Π°Ρ‚ΡŒΡΡ ΡƒΠ²Π΅Π»ΠΈΡ‡Π΅Π½ΠΈΠ΅ значСния ΠΎΠΏΡ†ΠΈΠΈ memory_limit. Π£Π±Π΅Π΄ΠΈΡ‚Π΅ΡΡŒ, Ρ‡Ρ‚ΠΎ Π·Π½Π°Ρ‡Π΅Π½ΠΈΠ΅ Π΄ΠΈΡ€Π΅ΠΊΡ‚ΠΈΠ²Ρ‹ memory_limit достаточно.

ВрСмя, ΠΊΠΎΡ‚ΠΎΡ€ΠΎΠ΅ потрСбуСтся для Ρ€Π°Π±ΠΎΡ‚Ρ‹ скрипта, ΠΌΠΎΠΆΠ΅Ρ‚ ΠΏΡ€Π΅Π²Ρ‹ΡΠΈΡ‚ΡŒ Π·Π½Π°Ρ‡Π΅Π½ΠΈΠ΅ ΠΎΠΏΡ†ΠΈΠΈ max_execution_time, Ссли для Π΄ΠΈΡ€Π΅ΠΊΡ‚ΠΈΠ²Ρ‹ установили малСнькоС Π·Π½Π°Ρ‡Π΅Π½ΠΈΠ΅. Π£Π±Π΅Π΄ΠΈΡ‚Π΅ΡΡŒ, Ρ‡Ρ‚ΠΎ Π·Π½Π°Ρ‡Π΅Π½ΠΈΠ΅ Π΄ΠΈΡ€Π΅ΠΊΡ‚ΠΈΠ²Ρ‹ max_execution_time достаточно.

Π—Π°ΠΌΠ΅Ρ‡Π°Π½ΠΈΠ΅: Π”ΠΈΡ€Π΅ΠΊΡ‚ΠΈΠ²Π° max_execution_time влияСт Ρ‚ΠΎΠ»ΡŒΠΊΠΎ Π½Π° врСмя выполнСния самого скрипта. ВрСмя, ΠΊΠΎΡ‚ΠΎΡ€ΠΎΠ΅ заняли дСйствия Π·Π° ΠΏΡ€Π΅Π΄Π΅Π»Π°ΠΌΠΈ скрипта, β€” систСмныС Π²Ρ‹Π·ΠΎΠ²Ρ‹ Ρ„ΡƒΠ½ΠΊΡ†ΠΈΠΉ system() ΠΈΠ»ΠΈ sleep(), запросы ΠΊ Π±Π°Π·Π΅ Π΄Π°Π½Π½Ρ‹Ρ…, врСмя, ΠΊΠΎΡ‚ΠΎΡ€ΠΎΠ΅ заняла Π·Π°Π³Ρ€ΡƒΠ·ΠΊΠ° Ρ„Π°ΠΉΠ»Π° Π½Π° сСрвСр, ΠΈ Ρ‚. Π΄. β€” Π½Π΅ учитываСтся ΠΏΡ€ΠΈ ΠΎΠΏΡ€Π΅Π΄Π΅Π»Π΅Π½ΠΈΠΈ максимального Π²Ρ€Π΅ΠΌΠ΅Π½ΠΈ Ρ€Π°Π±ΠΎΡ‚Ρ‹ скрипта.

Π’Π½ΠΈΠΌΠ°Π½ΠΈΠ΅

Π”ΠΈΡ€Π΅ΠΊΡ‚ΠΈΠ²Π° max_input_time устанавливаСт максимальноС врСмя Π² сСкундах, Π² Ρ‚Π΅Ρ‡Π΅Π½ΠΈΠ΅ ΠΊΠΎΡ‚ΠΎΡ€ΠΎΠ³ΠΎ скрипту Ρ€Π°Π·Ρ€Π΅ΡˆΠ°Π΅Ρ‚ΡΡ ΠΏΠΎΠ»ΡƒΡ‡Π°Ρ‚ΡŒ Π²Ρ…ΠΎΠ΄Π½Ρ‹Π΅ Π΄Π°Π½Π½Ρ‹Π΅; врСмя Π·Π°Π³Ρ€ΡƒΠ·ΠΊΠΈ Ρ„Π°ΠΉΠ»Π° Ρ‚ΠΎΠΆΠ΅ Π²ΠΊΠ»ΡŽΡ‡Π°Π΅Ρ‚ΡΡ. Π—Π°Π³Ρ€ΡƒΠ·ΠΊΠ° Π±ΠΎΠ»ΡŒΡˆΠΈΡ… Ρ„Π°ΠΉΠ»ΠΎΠ², Π½Π°Π±ΠΎΡ€Π° Ρ„Π°ΠΉΠ»ΠΎΠ² ΠΈΠ»ΠΈ ΠΎΠ±Ρ€Π°Π±ΠΎΡ‚ΠΊΠ° запросов ΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚Π΅Π»Π΅ΠΉ с ΠΌΠ΅Π΄Π»Π΅Π½Π½Ρ‹ΠΌΠΈ соСдинСниями ΠΌΠΎΠΆΠ΅Ρ‚ ΠΏΡ€Π΅Π²Ρ‹ΡΠΈΡ‚ΡŒ Π·Π½Π°Ρ‡Π΅Π½ΠΈΠ΅ ΠΏΠΎ ΡƒΠΌΠΎΠ»Ρ‡Π°Π½ΠΈΡŽ Π² 60 сСкунд.

Π‘Π΅Ρ€Π²Π΅Ρ€ Π½Π΅ Π·Π°Π³Ρ€ΡƒΠ·ΠΈΡ‚ большиС Ρ„Π°ΠΉΠ»Ρ‹, Ссли для Π΄ΠΈΡ€Π΅ΠΊΡ‚ΠΈΠ²Ρ‹ post_max_size установили слишком малСнькоС Π·Π½Π°Ρ‡Π΅Π½ΠΈΠ΅. ΠŸΡ€ΠΎΠ²Π΅Ρ€ΡŒΡ‚Π΅, Ρ‡Ρ‚ΠΎ Π·Π½Π°Ρ‡Π΅Π½ΠΈΠ΅ Π΄ΠΈΡ€Π΅ΠΊΡ‚ΠΈΠ²Ρ‹ post_max_size достаточно.

ΠžΠΏΡ†ΠΈΡ max_file_uploads ΠΊΠΎΠ½Ρ‚Ρ€ΠΎΠ»ΠΈΡ€ΡƒΠ΅Ρ‚ максимальноС количСство Ρ„Π°ΠΉΠ»ΠΎΠ², ΠΊΠΎΡ‚ΠΎΡ€Ρ‹Π΅ Π·Π°Π³Ρ€ΡƒΠΆΠ°ΡŽΡ‚ Π½Π° сСрвСр Π² Ρ‚Π΅Ρ‡Π΅Π½ΠΈΠ΅ ΠΎΠ΄Π½ΠΎΠ³ΠΎ запроса. Π‘ΡƒΠΏΠ΅Ρ€Π³Π»ΠΎΠ±Π°Π»ΡŒΠ½Ρ‹ΠΉ массив $_FILES ΠΏΡ€Π΅ΠΊΡ€Π°Ρ‚ΠΈΡ‚ ΠΎΠ±Ρ€Π°Π±ΠΎΡ‚ΠΊΡƒ Ρ„Π°ΠΉΠ»ΠΎΠ², ΠΊΠ°ΠΊ Ρ‚ΠΎΠ»ΡŒΠΊΠΎ достигнСт ограничСния, Ссли загруТаСтся большС Ρ„Π°ΠΉΠ»ΠΎΠ², Ρ‡Π΅ΠΌ Π² ΠΎΠ³Ρ€Π°Π½ΠΈΡ‡Π΅Π½ΠΈΠΈ. НапримСр, Ссли Π·Π½Π°Ρ‡Π΅Π½ΠΈΠ΅ Π΄ΠΈΡ€Π΅ΠΊΡ‚ΠΈΠ²Ρ‹ max_file_uploads равняСтся 10, массив $_FILES Π½Π΅ Π±ΡƒΠ΄Π΅Ρ‚ ΡΠΎΠ΄Π΅Ρ€ΠΆΠ°Ρ‚ΡŒ большС 10 элСмСнтов.

Π‘Π΅Π· ΠΏΡ€ΠΎΠ²Π΅Ρ€ΠΊΠΈ Ρ‚ΠΎΠ³ΠΎ, с ΠΊΠ°ΠΊΠΈΠΌ Ρ„Π°ΠΉΠ»ΠΎΠΌ вСдётся Ρ€Π°Π±ΠΎΡ‚Π°, ΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚Π΅Π»ΠΈ смогут ΠΏΠΎΠ»ΡƒΡ‡ΠΈΡ‚ΡŒ доступ ΠΊ ΠΊΠΎΠ½Ρ„ΠΈΠ΄Π΅Π½Ρ†ΠΈΠ°Π»ΡŒΠ½ΠΎΠΉ ΠΈΠ½Ρ„ΠΎΡ€ΠΌΠ°Ρ†ΠΈΠΈ Π΄Ρ€ΡƒΠ³ΠΈΡ… ΠΊΠ°Ρ‚Π°Π»ΠΎΠ³ΠΎΠ².

Из-Π·Π° многообразия стилСй, Π² ΠΊΠΎΡ‚ΠΎΡ€Ρ‹Ρ… Ρ„Π°ΠΉΠ»ΠΎΠ²Ρ‹Π΅ систСмы Π²Π΅Π΄ΡƒΡ‚ список ΠΊΠ°Ρ‚Π°Π»ΠΎΠ³ΠΎΠ², PHP Π½Π΅ Π³Π°Ρ€Π°Π½Ρ‚ΠΈΡ€ΡƒΠ΅Ρ‚ ΠΏΡ€Π°Π²ΠΈΠ»ΡŒΠ½ΡƒΡŽ ΠΎΠ±Ρ€Π°Π±ΠΎΡ‚ΠΊΡƒ Ρ„Π°ΠΉΠ»ΠΎΠ² с экзотичСскими ΠΈΠΌΠ΅Π½Π°ΠΌΠΈ, Π½Π°ΠΏΡ€ΠΈΠΌΠ΅Ρ€ Ρ„Π°ΠΉΠ»ΠΎΠ² с ΠΏΡ€ΠΎΠ±Π΅Π»Π°ΠΌΠΈ Π² ΠΈΠΌΠ΅Π½Π°Ρ….

Π Π°Π·Ρ€Π°Π±ΠΎΡ‚Ρ‡ΠΈΠΊΠ°ΠΌ нСльзя ΡΠΌΠ΅ΡˆΠΈΠ²Π°Ρ‚ΡŒ ΠΎΠ±Ρ‹Ρ‡Π½Ρ‹Π΅ input-поля ΠΈ поля Π·Π°Π³Ρ€ΡƒΠ·ΠΊΠΈ Ρ„Π°ΠΉΠ»ΠΎΠ² Π² ΠΎΠ΄Π½ΠΎΠΉ ΠΈ Ρ‚ΠΎΠΉ ΠΆΠ΅ ΠΏΠ΅Ρ€Π΅ΠΌΠ΅Π½Π½ΠΎΠΉ Ρ„ΠΎΡ€ΠΌΡ‹ (Π½Π°ΠΏΡ€ΠΈΠΌΠ΅Ρ€, нСльзя ΡƒΠΊΠ°Π·Ρ‹Π²Π°Ρ‚ΡŒ Π² ΠΈΠΌΠ΅Π½ΠΈ input-элСмСнта Π·Π½Π°Ρ‡Π΅Π½ΠΈΠ΅ foo[]).

οΌ‹Π”ΠΎΠ±Π°Π²ΠΈΡ‚ΡŒ

ΠŸΡ€ΠΈΠΌΠ΅Ρ‡Π°Π½ΠΈΡ ΠΏΠΎΠ»ΡŒΠ·ΠΎΠ²Π°Ρ‚Π΅Π»Π΅ΠΉ 10 notes

up
16
amalcon _a_t_ eudoramail _d_o_t_ com ΒΆ
21 years ago
Note that, when you want to upload VERY large files (or you want to set the limiters VERY high for test purposes), all of the upload file size limiters are stored in signed 32-bit ints.  This means that setting a limit higher than about 2.1 GB will result in PHP seeing a large negative number.  I have not found any way around this.
up
7
Nirmal Natarajan ΒΆ
16 years ago
If using IIS 7.0 or above, the Request Filtering is enabled by default and the max allowed content length is set to 30 MB.

One must change this value if they want to allow file uploads of more than 30 MB.

Sample web.config entry:

<configuration>
    </system.webServer>
        <security>
            <requestFiltering>
                <requestLimits maxAllowedContentLength="314572800"/>
            </requestFiltering>
        </security>
    </system.webServer>
</configuration>

The above setting will allow 300 MB of data to be sent as a request. Hope this helps someone.
up
3
adrien.nizon+phpnet at gmail dot com ΒΆ
9 years ago
[Editor's note: to be more precise, MAX_FILE_SIZE can't exceed PHP_INT_MAX before PHP 7.1.]

Please note that the field MAX_FILE_SIZE cannot exceed 2147483647. Any greater value will lead to an upload error that will be displayed at the end of the upload

This is explained by the related C code :
if (!strcasecmp(param, "MAX_FILE_SIZE")) {
    max_file_size = atol(value);
}

The string is converted into a long int, which max value is... 2147483647

Seems to be corrected since php-7.1.0beta3 (https://github.com/php/php-src/commit/cb4c195f0b85ca5d91fee1ebe90105b8bb68356c)
up
1
dg at artegic dot de ΒΆ
16 years ago
In case of non-deterministic occurence of the UPLOAD_ERR_PARTIAL error:  The HTTPD (e.g. Apache) should respond with a 'Accept-Ranges: none' header field.
up
2
admin at creationfarm dot com ΒΆ
23 years ago
The macintosh OS (not sure about OSx) uses a dual forked file system, unlike the rest of the world ;-). Every macintosh file has a data fork and a resource fork. When a dual forked file hits a single forked file system, something has to go, and it is the resource fork. This was recognized as a problem (bad idea to begin with) and apple started recomending that developers avoid sticking vital file info in the resource fork portion of a file, but some files are still very sensitive to this. The main ones to watch out for are macintosh font files and executables, once the resource fork is gone from a mac font or an executable it is useless. To protect the files they should be stuffed or zipped prior to upload to protect the resource fork. 

Most mac ftp clients (like fetch) allow files to be uploaded in Macbinhex, which will also protect the resource fork when transfering files via ftp. I have not seen this equivilent in any mac browser (but I haven't done too much digging either).

FYI, apple does have an old utility called ResEdit that lets you manipulate the resource fork portion of a file.
up
2
bohwaz ΒΆ
3 years ago
Please be advised that setting a large post_max_size or upload_max_filesize for a complete server or a complete virtual host is not a good idea as it may lead to increased security risks.

The risk is that an attacker may send very large POST requests and overloading your server memory and CPU as it has to parse and process those requests before handling them to your PHP script.

So it's best to limit changing this setting to some files or directories. For example if I want to /admin/files/ and /admin/images/ I can use:

<If "%{REQUEST_URI} =~ m!^/admin/(files|images)/! && -n %{HTTP_COOKIE}">
    php_value post_max_size 256M
    php_value upload_max_filesize 256M
</If>

I also require the request to have a cookie to avoid basic attacks. This will not protect you against attacks coming from non-authenticated users, but may delay any attack.

This setting can be used in Apache server configuration files, and .htaccess files as well.
up
1
morganaj at coleggwent dot ac dot uk ΒΆ
22 years ago
Here is another that may make your upload fall over.  If you are using Squid or similar proxy server make sure that this is not limiting the size of the HTTP headers. This took me weeks to figure out!
up
1
anders jenbo pc dk ΒΆ
18 years ago
A responce to admin at creationfarm dot com, Mac OS X and Windows running on a NTFS disk also uses a multi stream file system. Still only the data stream in transfared on http upload. It is preferable to pack Mac OS X files in .dmg files rathere then zip but the avarage user will find zip much easir and they are supported on more platforms.
up
0
tjaart at siam-data-services dot com ΒΆ
21 years ago
Took me a while to figure this one out...

I think this is actually a header problem, but it only
happens when doing a file upload.

If you attept a header("location:http://...) redirect after
processing a $_POST[''] from a form doing a file upload
(i.e. having enctype="multipart/form-data"), the redirect
doesn't work in IE if you don't have a space between
location: & http, i.e.
header("location:http://...)  vs
header("location: http://...)

===================================
<?php
if ($_POST['submit']=='Upload') {
    // Process File and the redirect...
    header("location: http://"..."/somewhere.php");
    exit;
}
?>
<html><head></head><body>
<form enctype="multipart/form-data" action="upload.php" method="POST">
    <input type="hidden" name="MAX_FILE_SIZE" value="20000">
    Your file: <input name="filename" type="file">
    <input name="submit" type="submit" value="Upload">
</form>
</body></html>
===================================

This only happens if all of the following are true:
header("location:http://...) with no space
Form being processed has enctype="multipart/form-data"
Browser=IE

To fix the problem, simply add the space.

Hope this helps someone else.
up
-2
tomcashman at unitekgroup dot com ΒΆ
23 years ago
For apache, also check the LimitRequestBody directive.
If you're running a Red Hat install, this might be set in /etc/httpd/conf.d/php.conf.
By default, mine was set to 512 KB.