Bug #666 Updated: Possibly denial of service attack using file upload facility

ID: 666 Updated by: rasmus Reported By: zavadsky@im.bas-net.by Status: Closed Bug Type: Feature/Change Request Assigned To: Comments: Ok, this was a good one. Very obvious too, but for some reason I hadn't thought of it before. Thanks for bringing it up. I have added two things to 3.0.4. First, the uploaded temporary file now gets deleted at the end of a request, and second, I added an upload_max_filesize directive along with the corresponding php3_upload_max_filesize Apache directive. This could be set to 0 to completely disallow file uploads and then specifically set higher on a per-server, per-dir or even per-file basis in the Apache .conf file. Full Bug description available at: http://ca.php.net/bugs.php3?id=666 -- PHP Development Mailing List http://www.php.net/ To unsubscribe send an empty message to php-dev-unsubscribe@lists.php.net For help: php-dev-help@lists.php.net