Page MenuHomePhabricator

Restrict maximum file size for Phabricator file uploads
Closed, ResolvedPublic

Description

I don't see good reasons why someone should be able to upload a file that has hundreds of megabytes but that seems to be possible currently.
Would a limit of, say, 50MB or such be reasonable?
And does Phab have a setting for this? :-/

Details

Related Gerrit Patches:

Event Timeline

Restricted Application added a subscriber: TerraCodes. · View Herald TranscriptNov 24 2016, 11:34 AM
Aklapper triaged this task as Low priority.Nov 24 2016, 11:34 AM

If not, isn't there some PHP limit we can set?

Either that, or MySQL I guess. Just wondering if that would still make Phab show a useful UI message...

I don't see good reasons why someone should be able to upload a file that has hundreds of megabytes but that seems to be possible currently.

Why?

Is it currently being abused? space issues? or are we just hunting for a solution to something that isn't a problem [at this stage]?

Paladox added a subscriber: Paladox.EditedNov 24 2016, 1:03 PM

This will affect differential and diffusion. So it could cause repos to not create the patch correctly

As diffusion and differential use the file upload if the files are big. It is its way of copping with the file size. If we created a limit then we will have problems.

(Note I am not 100% correct but I believe that this will affect this)

@mmodell: Hmm, then I'm wondering how folks managed to manually upload >500MB files into Wikimedia Phabricator.

By default, Phabricator is configured to store files up to 1MB in MySQL, and
reject files larger than 1MB. To store larger files, you can either:

  • increase the MySQL limit to at least 8MB; or
  • configure another storage engine.

Doing either of these will enable the chunk storage engine and support for
arbitrarily large files.

So apparently it chunks the files. mysql-engine.max-size is not a hard limit on the upload size.

For now I'm going to decrease the limit to just under 8MB

But won't that limit photo uploads? It will make it hard for me to upload images to help someone who is debugging an issue. Since I think the screen shot is 8mb+. Using commons would be wasteful since on phabricator you can delete images.

Could we limit it to 20mb please? Since that will still decrease the risk of massive spamming but till allow users to take a screen shot as some use 4K/ full hd.

@Paladox: As of now I can't see a way to limit it to 20mb. It's either 4mb or nothing.

I will have to implement a custom upload limit somehow, afaict.

But won't that limit photo uploads? It will make it hard for me to upload images to help someone who is debugging an issue. Since I think the screen shot is 8mb+.

I have not come across many screenshots larger than 8MB in my life.

Using commons would be wasteful since on phabricator you can delete images.

That's irrelevant here.

As of now I can't see a way to limit it to 20mb. It's either 4mb or nothing.
I will have to implement a custom upload limit somehow, afaict.

@mmodell: If that's too complex / not a good use of time, feel free to decline this report.
I guess I'll just have to monitor the list of uploaded files a bit more often which works for me.

I don't think we should be allowing huge uploads, generally. I assume we don't have unlimited storage in mysql. People should upload to commons if they want to upload large files.

matmarex added a subscriber: matmarex.EditedDec 13 2016, 12:40 PM

The maximum file size appears to have been restricted, because I just tried to upload a 29.5 MB file (https://dl.dropboxusercontent.com/u/19535611/Fotografi%2C_katedral_i_Salamanca_-_Hallwylska_museet_-_107303.tif) and it's telling me "Exception: No configured storage engine can store this file. See "Configuring File Storage" in the documentation for information on configuring storage engines.". Looking in Phabricator's source code, this error message is generated right next to some filesize checks.

I would actually like to have a copy of that in here (the file triggers a couple bugs in MediaWiki). Meh, nevermind, it exists on Commons. That'll do.

Paladox added a comment.EditedDec 13 2016, 1:19 PM

@mmodell you need to change the config to bytes please.

Change 326932 had a related patch set (by Paladox) published:
Up the size for storage.mysql-engine.max-size to 20mb in bytes

https://gerrit.wikimedia.org/r/326932

Paladox moved this task from To Triage to Misc on the Phabricator board.Feb 17 2017, 4:57 PM
Dzahn added a subscriber: Dzahn.Feb 23 2017, 12:42 AM

I would suggest closing this as resolved (since we did restrict the maximum size, so done?!) and abandon https://gerrit.wikimedia.org/r/326932 unless we see a real problem here.

Change 326932 abandoned by Paladox:
Phabricator: Up the size for storage.mysql-engine.max-size to 20mb in bytes

https://gerrit.wikimedia.org/r/326932

mmodell closed this task as Resolved.Feb 25 2017, 7:29 AM
mmodell claimed this task.