Detecting and handling POST requests greater than post_max_size

Question

A PHP site I'm working on has a form that allows users to upload zero or more files when editing an object. As part of testing the form, I try uploading files which take the total request size above post_max_size.

This causes the following entry to be generated in the server log:

PHP Warning:  POST Content-Length of 182213631 bytes exceeds the limit of 16777216 bytes in Unknown on line 0

Also the $_POST array is empty.

The warning I can live with, however the empty $_POST array causes problems because it usually contains some other information about the request, such as the ID of the object being edited. This prevents the site from displaying a useful error message, including the object's name etc. (e.g. 'you tried to edit object X, but the files you uploaded were too large').

Is there a way to detect and handle this particular issue in PHP? The form does have some JavaScript to display a warning if the files are too large, but that only works if the browser supports the File API (not all do), users often ignore warnings, and in general I try to replicate any client checks on the server because it's trivial to circumvent the client checks.

I'm aware that I can increase post_max_size and know how to do this, but the problem is gracefully handling an upload above that size.

PHP version: 5.6.40 (I'm aware this is out of support, but upgrading isn't easy or wholly under my control)

Flash Thunder · Answer 1 · 2020-09-14T07:53:59.407

Maybe something like that:

if ($_SERVER['REQUEST_METHOD'] == 'POST' && empty($_POST) &&
     empty($_FILES) && $_SERVER['CONTENT_LENGTH'] > 0){
   echo "POST data size exceeded!";
}

Please note that You can't distinguish files and other variables when that error appears. Sum of the objects length is being count, and when it is exceeded, $_POST is always empty. So if you want to keep other parameters, you probably should add them to $_GET like:

<form action="post.php?param1=1&param2=2" ... />

or by changing the URL of ajax request.

Edit: Oh they say pretty the same thing in the PHP documentation of post_max_size.

Detecting and handling POST requests greater than post_max_size

1 Answers1