Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My users want to upload large files (50-100MB) in the CMS backend of a PHP web application. I could adjust the upload_max_filesize and post_max_size settings for PHP globally in this virtual host, but I'm afraid that would make Denial of Service attacks easier than necessary.

In theory, these two settings can be adjusted per directory (either in the virtual host config file, or via .htaccess files), and I only need the larger values in the admin area. Unfortunately, this application has only a start.php in the web root (single point of entry), and all other PHP files are included from there. This appears to make a per-directory setting impossible. I've tried to match the path used in the CMS with <Location>, but even with the correct path, the php_value directives don't have any effect.

<LocationMatch ^/admin>
   php_value  upload_max_filesize  100MB
   php_value  post_max_size        100MB
</LocationMatch>

(mod_rewrite is used to translate a path like /admin/content/bla to /start.php?_p=/admin/content/bla, which is why the "start.php" file name does not appear in the above expression.)

Is there any way to make this work? I'm also open for alternative suggestions; for example, an IP-based setup might be possible in our case.

TIA.

share|improve this question
    
The basis for doing on per directory is that you are afraid that it will make dos attacks easier. What is your reasoning that allowing bigger uploads will make dos attacks easier? If the file uploading is done in the CMS backend (which Im sure has access control), how will the attacker access the uploading mechanism? –  Josh Brower Jul 12 '10 at 19:03
    
They can't access the CMS, but they could just post to any other .php file (by building their own form). I've thought about this some more, and I've discovered that I have an even bigger problem. The way Apache is set up in the distro I'm using, POST is allowed to any resource - even images and other static resources. Ideally, POST should be disallowed for any resource type other than PHP, and then PHP's internal settings could be used to limit the request size. I need to figure out how fix this first. Thanks for asking the right question to get my brain going. –  Zilk Jul 23 '10 at 23:04
add comment

1 Answer

First try if it works at least using '/':

<LocationMatch ^/>

If yes, then try one of these:

<LocationMatch ^/start.php\?_p=/admin>

<LocationMatch ^/start.php?_p=/admin>

<LocationMatch _p=/admin>

Pleae also note that:

< Location> sections are processed in the order they appear in the configuration file, after the sections and .htaccess files are read, and after the sections.

src: http://httpd.apache.org/docs/2.0/mod/core.html#location

share|improve this answer
    
Thanks. I've confirmed that the expression matches, but the php_value directives appear to have no effect there. –  Zilk Jul 23 '10 at 22:57
    
If you are using php5-cgi, php_value might not work. –  Weboide Jul 24 '10 at 13:04
    
The query string is not matched with the Location or LocationMatch directives. –  joschi Oct 31 '10 at 6:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.