Page MenuHomePhabricator

$wgMaxUploadSize doesn't affect normal file uploads
Closed, ResolvedPublic

Description

Author: robindinse

Description:
The $wgMaxUploadSize setting only seems to be active if $wgAllowCopyUploads is enabled. wgMaxUploadSize should work anyway because e.g. sometimes webservers can't handle big pictures, so it must be possible to set the maximum upload size down.

My suggestion is to replace /includes/specials/SpecialUpload.php line 1047:
$val2 = $wgAllowCopyUploads ? min( $wgMaxUploadSize, $val2 ) : $val2;

with

$val2 = min( $wgMaxUploadSize, $val2 );

.

I hope I am helpful. :-)


Version: unspecified
Severity: minor

Details

Reference
bz17941

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 10:36 PM
bzimport set Reference to bz17941.
bzimport added a subscriber: Unknown Object (MLST).

overlordq wrote:

From the documentation of the variable:

Note: This option currently has no effect on the normal upload feature!
Note: The limits for file uploads are controlled by PHP configuration directives. To change the limits for file uploads, you need to modify php.ini, see the upload_max_filesize and post_max_size PHP configuration options as well as Manual:Configuring_file_uploads for details.

robindinse wrote:

And if I don't have access to change PHP ini settings?

karun.84 wrote:

An option if you do not have access to change it in your PHP ini settings is to create a .htaccess file

http://www.php.net/manual/en/configuration.changes.php mentions you can change configuration settings for php using the httpd.conf or .htaccess files.

I do not think there is too much that can be done to restrict the upload size, if you are not able to utilise one of the following methods for configuring php being php.ini, httpd.conf or .htaccess, when you are using the normal upload feature

(In reply to comment #1)

From the documentation of the variable:

Note: This option currently has no effect on the normal upload feature!

Changing summary accordingly.

karun.84 wrote:

I have updated the information on the Wiki in relation to why we cannot restrict the upload size using normal file uploads and this method at http://www.mediawiki.org/wiki/Manual:Configuring_file_uploads#Set_maximum_size_for_file_uploads

An alternative option could be to use JavaScript or Java to check the file size before it is uploaded. If JavaScript is disabled it would not resolve this issue.

(In reply to comment #5)

An alternative option could be to use JavaScript or Java to check the file size
before it is uploaded. If JavaScript is disabled it would not resolve this
issue.

Firefogg should take into account that limit.

I think that it would be consistent if $wgMaxUploadSize were also enforced for uploads,
even if PHP configuration has the last word about it. For instance, the php limit may be
higher than the desired for the wiki in order to support another app.

karun.84 wrote:

(In reply to comment #6)

(In reply to comment #5)

Firefogg should take into account that limit.

I think that it would be consistent if $wgMaxUploadSize were also enforced for
uploads,
even if PHP configuration has the last word about it. For instance, the php
limit may be
higher than the desired for the wiki in order to support another app.

I have been trying to find a solution to the problem that is not dependent on ActiveX and using JavaScript. Ive found many examples that use ActiveX such as http://www.codingforums.com/archive/index.php/t-68495.html
With some other solutions I have looked at, browser security restrictions generally prevent them.

I think we need a solution that is not browser dependent, and does not require ActiveX.

(In reply to comment #7)

I have been trying to find a solution to the problem that is not dependent on
ActiveX and using JavaScript. Ive found many examples that use ActiveX such as
http://www.codingforums.com/archive/index.php/t-68495.html
With some other solutions I have looked at, browser security restrictions
generally prevent them.

I think we need a solution that is not browser dependent, and does not require
ActiveX.

PHP suggest the MAX_UPLOAD_LIMIT input but the browser's don't take it into account :(

karun.84 wrote:

(In reply to comment #8)

PHP suggest the MAX_UPLOAD_LIMIT input but the browser's don't take it into
account :(

It appears to be an upstream problem, where we need web browsers to be fixed to check that file size does not exceed a maximum size, before uploading a file.