More security-related (control) patches:

- Avoid displaying errors during startup, unless display_startup_errors is enabled.
- Implemented post_size_max limit.  Defaults to 8MB.
- Implemented file_uploads on/off directive (defaults to on).

diff --git a/main/SAPI.c b/main/SAPI.c
index 78532923835431fdf78820e321b376213e8f511a..df1d5fb9570223c3f39b6c0b5f99c0aeb1bf8745 100644 (file)
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -115,8 +115,10 @@ SAPI_API void sapi_handle_post(void *arg SLS_DC)
 {
        if (SG(request_info).post_entry) {
                SG(request_info).post_entry->post_handler(SG(request_info).content_type_dup, arg SLS_CC);
-               efree(SG(request_info).post_data);
-               SG(request_info).post_data = NULL;
+               if (SG(request_info).post_data) {
+                       efree(SG(request_info).post_data);
+                       SG(request_info).post_data = NULL;
+               }
                efree(SG(request_info).content_type_dup);
                SG(request_info).content_type_dup = NULL;
        }
@@ -156,7 +158,7 @@ static void sapi_read_post_data(SLS_D)
                post_reader_func = post_entry->post_reader;
        } else {
                if (!sapi_module.default_post_reader) {
-                       sapi_module.sapi_error(E_ERROR, "Unsupported content type:  '%s'", content_type);
+                       sapi_module.sapi_error(E_WARNING, "Unsupported content type:  '%s'", content_type);
                        return;
                }
                SG(request_info).post_entry = NULL;
@@ -175,6 +177,11 @@ SAPI_POST_READER_FUNC(sapi_read_standard_form_data)
        int read_bytes;
        int allocated_bytes=SAPI_POST_BLOCK_SIZE+1;
 
+       if (SG(request_info).content_length > SG(post_max_size)) {
+               php_error(E_WARNING, "POST Content-Length of %d bytes exceeds the limit of %d bytes",
+                                       SG(request_info).content_length, SG(post_max_size));
+               return;
+       }
        SG(request_info).post_data = emalloc(allocated_bytes);
 
        for (;;) {
@@ -183,6 +190,10 @@ SAPI_POST_READER_FUNC(sapi_read_standard_form_data)
                        break;
                }
                SG(read_post_bytes) += read_bytes;
+               if (SG(read_post_bytes) > SG(post_max_size)) {
+                       php_error(E_WARNING, "Actual POST length does not match Content-Length, and exceeds %d bytes", SG(post_max_size));
+                       return;
+               }
                if (read_bytes < SAPI_POST_BLOCK_SIZE) {
                        break;
                }
@@ -285,14 +296,17 @@ SAPI_API void sapi_activate(SLS_D)
        } else {
                SG(request_info).headers_only = 0;
        }
+       SG(rfc1867_uploaded_files) = NULL;
 
        if (SG(server_context)) {
                if (SG(request_info).request_method 
                        && !strcmp(SG(request_info).request_method, "POST")) {
                        if (!SG(request_info).content_type) {
-                               sapi_module.sapi_error(E_ERROR, "No content-type in POST request");
+                               sapi_module.sapi_error(E_WARNING, "No content-type in POST request");
+                               SG(request_info).content_type_dup = NULL;
+                       } else {
+                               sapi_read_post_data(SLS_C);
                        }
-                       sapi_read_post_data(SLS_C);
                } else {
                        SG(request_info).content_type_dup = NULL;
                }
@@ -301,7 +315,6 @@ SAPI_API void sapi_activate(SLS_D)
                        sapi_module.activate(SLS_C);
                }
        }
-       SG(rfc1867_uploaded_files) = NULL;
 }
 
 

diff --git a/main/SAPI.h b/main/SAPI.h
index d1cef23f7b00304683e8b2867bc5347384a6406a..da2894e7427e66804585fca3a02e200b4700a53e 100644 (file)
--- a/main/SAPI.h
+++ b/main/SAPI.h
@@ -64,7 +64,7 @@ typedef struct {
        char *query_string;
        char *post_data;
        char *cookie_data;
-       uint content_length;
+       long content_length;
        uint post_data_length;
 
        char *path_translated;
@@ -101,6 +101,7 @@ typedef struct {
        char *default_mimetype;
        char *default_charset;
        HashTable *rfc1867_uploaded_files;
+       long post_max_size;
 } sapi_globals_struct;
 
 

diff --git a/main/main.c b/main/main.c
index a87cf5969b360608489cf4047560120dac9eb171..9601c0abd071d51e0c348f4fe9444a80ef8e1a9e 100644 (file)
--- a/main/main.c
+++ b/main/main.c
@@ -122,7 +122,7 @@ static PHP_INI_MH(OnChangeMemoryLimit)
        int new_limit;
 
        if (new_value) {
-               new_limit = atoi(new_value);
+               new_limit = php_atoi(new_value);
        } else {
                new_limit = 1<<30;              /* effectively, no limit */
        }
@@ -207,6 +207,7 @@ PHP_INI_BEGIN()
        STD_PHP_INI_BOOLEAN("allow_call_time_pass_reference","1",PHP_INI_SYSTEM|PHP_INI_PERDIR,         OnUpdateBool,   allow_call_time_pass_reference, zend_compiler_globals,  compiler_globals)
        STD_PHP_INI_BOOLEAN("asp_tags",                         "0",            PHP_INI_SYSTEM|PHP_INI_PERDIR,          OnUpdateBool,                   asp_tags,                               zend_compiler_globals,  compiler_globals)
        STD_PHP_INI_BOOLEAN("display_errors",           "1",            PHP_INI_ALL,            OnUpdateBool,                   display_errors,                 php_core_globals,       core_globals)
+       STD_PHP_INI_BOOLEAN("display_startup_errors",   "0",    PHP_INI_ALL,            OnUpdateBool,                   display_startup_errors, php_core_globals,       core_globals)
        STD_PHP_INI_BOOLEAN("enable_dl",                        "1",            PHP_INI_SYSTEM,         OnUpdateBool,                   enable_dl,                              php_core_globals,       core_globals)
        STD_PHP_INI_BOOLEAN("error_append_string",      NULL,           PHP_INI_ALL,            OnUpdateString,                 error_append_string,    php_core_globals,       core_globals)
        STD_PHP_INI_BOOLEAN("error_prepend_string",     NULL,           PHP_INI_ALL,            OnUpdateString,                 error_prepend_string,   php_core_globals,       core_globals)
@@ -240,7 +241,9 @@ PHP_INI_BEGIN()
        PHP_INI_ENTRY("max_execution_time",                     "30",           PHP_INI_ALL,                    OnUpdateTimeout)
        STD_PHP_INI_ENTRY("open_basedir",                       NULL,           PHP_INI_SYSTEM,         OnUpdateStringUnempty,  open_basedir,                   php_core_globals,       core_globals)
        STD_PHP_INI_ENTRY("safe_mode_exec_dir",         "1",            PHP_INI_SYSTEM,         OnUpdateString,                 safe_mode_exec_dir,             php_core_globals,       core_globals)
-       STD_PHP_INI_ENTRY("upload_max_filesize",        "2097152",      PHP_INI_ALL,            OnUpdateInt,                    upload_max_filesize,    php_core_globals,       core_globals)
+       STD_PHP_INI_ENTRY("upload_max_filesize",        "2M",           PHP_INI_ALL,            OnUpdateInt,                    upload_max_filesize,    php_core_globals,       core_globals)
+       STD_PHP_INI_ENTRY("file_uploads",                       "1",            PHP_INI_ALL,            OnUpdateBool,                   file_uploads,                   php_core_globals,       core_globals)
+       STD_PHP_INI_ENTRY("post_max_size",                      "8M",           PHP_INI_SYSTEM,         OnUpdateInt,                    post_max_size,                  sapi_globals_struct,sapi_globals)
        STD_PHP_INI_ENTRY("upload_tmp_dir",                     NULL,           PHP_INI_SYSTEM,         OnUpdateStringUnempty,  upload_tmp_dir,                 php_core_globals,       core_globals)
        STD_PHP_INI_ENTRY("user_dir",                           NULL,           PHP_INI_SYSTEM,         OnUpdateStringUnempty,  user_dir,                               php_core_globals,       core_globals)
        STD_PHP_INI_ENTRY("variables_order",            NULL,           PHP_INI_ALL,            OnUpdateStringUnempty,  variables_order,                php_core_globals,       core_globals)
@@ -249,7 +252,7 @@ PHP_INI_BEGIN()
        PHP_INI_ENTRY("browscap",                                       NULL,           PHP_INI_SYSTEM,         NULL)
        PHP_INI_ENTRY("error_reporting",                        NULL,           PHP_INI_ALL,            OnUpdateErrorReporting)
 #if MEMORY_LIMIT
-       PHP_INI_ENTRY("memory_limit",                           "8388608",      PHP_INI_ALL,            OnChangeMemoryLimit)
+       PHP_INI_ENTRY("memory_limit",                           "8M",           PHP_INI_ALL,            OnChangeMemoryLimit)
 #endif
        PHP_INI_ENTRY("precision",                                      "14",           PHP_INI_ALL,            OnSetPrecision)
        PHP_INI_ENTRY("sendmail_from",                          NULL,           PHP_INI_ALL,            NULL)
@@ -384,7 +387,8 @@ static void php_error_cb(int type, const char *error_filename, const uint error_
                        snprintf(log_buffer, 1024, "PHP %s:  %s in %s on line %d", error_type_str, buffer, error_filename, error_lineno);
                        php_log_err(log_buffer);
                }
-               if (module_initialized && PG(display_errors)) {
+               if (module_initialized && PG(display_errors)
+                       && (!PG(during_request_startup) || PG(display_startup_errors))) {
                        char *prepend_string = INI_STR("error_prepend_string");
                        char *append_string = INI_STR("error_append_string");
                        char *error_format;
@@ -593,6 +597,8 @@ int php_request_startup(CLS_D ELS_DC PLS_DC SLS_DC)
        signal(SIGCHLD,sigchld_handler);
 #endif
 
+       PG(during_request_startup) = 1;
+
        global_lock();
        
        php_output_startup();
@@ -616,7 +622,10 @@ int php_request_startup(CLS_D ELS_DC PLS_DC SLS_DC)
        } else if (PG(implicit_flush)) {
                php_start_implicit_flush();
        }
-       
+
+       /* We turn this off in php_execute_script() */
+       /* PG(during_request_startup) = 0; */
+
        return SUCCESS;
 }
 
@@ -825,6 +834,7 @@ int php_module_startup(sapi_module_struct *sf)
        SG(request_info).headers_only = 0;
        SG(request_info).argv0 = NULL;
        PG(connection_status) = PHP_CONNECTION_NORMAL;
+       PG(during_request_startup) = 0;
 
 #if HAVE_SETLOCALE
        setlocale(LC_CTYPE, "");
@@ -1159,6 +1169,8 @@ PHPAPI void php_execute_script(zend_file_handle *primary_file CLS_DC ELS_DC PLS_
        UpdateIniFromRegistry(primary_file->filename);
 #endif
 
+       PG(during_request_startup) = 0;
+
        if (primary_file->type == ZEND_HANDLE_FILENAME 
                        && primary_file->filename) {
                V_GETCWD(old_cwd, OLD_CWD_SIZE-1);

diff --git a/main/php_globals.h b/main/php_globals.h
index 4aec8a6a873971123e347d382e6312148fbe495e..39e9d1620060309bd8478c8856560d4a28b1eadf 100644 (file)
--- a/main/php_globals.h
+++ b/main/php_globals.h
@@ -71,6 +71,7 @@ struct _php_core_globals {
 
        zend_bool track_errors;
        zend_bool display_errors;
+       zend_bool display_startup_errors;
        zend_bool log_errors;
        char *error_log;
 
@@ -113,7 +114,11 @@ struct _php_core_globals {
 
        zend_bool html_errors;
 
-       zend_bool modules_activated;    
+       zend_bool modules_activated;
+
+       zend_bool file_uploads;
+
+       zend_bool during_request_startup;
 };
 
 

diff --git a/main/php_ini.c b/main/php_ini.c
index 6f4c870d1f8cb96b25de20c75520010c4db066a7..aec25c3f8c9f96eee9464f30d5180988757f52da 100644 (file)
--- a/main/php_ini.c
+++ b/main/php_ini.c
@@ -409,6 +409,30 @@ PHPAPI void display_ini_entries(zend_module_entry *module)
 }
 
 
+PHPAPI int php_atoi(const char *str, int str_len)
+{
+       int retval;
+
+       if (!str_len) {
+               str_len = strlen(str);
+       }
+       retval = atoi(str);
+       if (str_len>0) {
+               switch (str[str_len-1]) {
+                       case 'k':
+                       case 'K':
+                               retval *= 1024;
+                               break;
+                       case 'm':
+                       case 'M':
+                               retval *= 1048576;
+                               break;
+               }
+       }
+       return retval;
+}
+
+
 /* Standard message handlers */
 
 PHPAPI PHP_INI_MH(OnUpdateBool)
@@ -442,7 +466,7 @@ PHPAPI PHP_INI_MH(OnUpdateInt)
 
        p = (long *) (base+(size_t) mh_arg1);
 
-       *p = atoi(new_value);
+       *p = php_atoi(new_value, new_value_length);
        return SUCCESS;
 }
 

diff --git a/main/php_ini.h b/main/php_ini.h
index 7c5721f6ca828ccd6d7b491f5e302faff7b72c9b..5b1994a711687a481480515b130159f1c182c4e0 100644 (file)
--- a/main/php_ini.h
+++ b/main/php_ini.h
@@ -137,6 +137,7 @@ PHPAPI PHP_INI_DISP(display_link_numbers);
 
 pval *cfg_get_entry(char *name, uint name_length);
 
+PHPAPI int php_atoi(const char *str, int str_len);
 
 /* Standard message handlers */
 PHPAPI PHP_INI_MH(OnUpdateBool);

diff --git a/main/rfc1867.c b/main/rfc1867.c
index 5d5d4fcf6fe8d92e85188b24076a8af73406a5f1..d4d4de59c19829e859bf11e9437a9423f3a109a9 100644 (file)
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -105,7 +105,7 @@ void destroy_uploaded_files_hash(SLS_D)
 /*
  * Split raw mime stream up into appropriate components
  */
-static void php_mime_split(char *buf, int cnt, char *boundary, zval *array_ptr SLS_DC)
+static void php_mime_split(char *buf, int cnt, char *boundary, zval *array_ptr SLS_DC PLS_DC)
 {
        char *ptr, *loc, *loc2, *loc3, *s, *name, *filename, *u, *temp_filename;
        int len, state = 0, Done = 0, rem, urem;
@@ -119,7 +119,6 @@ static void php_mime_split(char *buf, int cnt, char *boundary, zval *array_ptr S
        zend_bool upload_successful;
        zend_bool magic_quotes_gpc;
        ELS_FETCH();
-       PLS_FETCH();
 
        zend_hash_init(&PG(rfc1867_protected_variables), 5, NULL, NULL, 0);
 
@@ -428,6 +427,12 @@ SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
        char *boundary;
        uint boundary_len;
        zval *array_ptr = (zval *) arg;
+       PLS_FETCH();
+
+       if (!PG(file_uploads)) {
+               php_error(E_WARNING, "File uploads are disabled");
+               return;
+       }
 
        boundary = strstr(content_type_dup, "boundary");
        if (!boundary || !(boundary=strchr(boundary, '='))) {
@@ -438,7 +443,7 @@ SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
        boundary_len = strlen(boundary);
 
        if (SG(request_info).post_data) {
-               php_mime_split(SG(request_info).post_data, SG(request_info).post_data_length, boundary, array_ptr SLS_CC);
+               php_mime_split(SG(request_info).post_data, SG(request_info).post_data_length, boundary, array_ptr SLS_CC PLS_CC);
        }
 }
 

diff --git a/php.ini-dist b/php.ini-dist
index af572acc8553147327bfbbf99381da89ccb45626..12096db572de60dfe025d52cd13237f629c17c2f 100644 (file)
--- a/php.ini-dist
+++ b/php.ini-dist
@@ -135,7 +135,7 @@ expose_php  =       On              ; Decides whether PHP may expose the fact that it is installed
 ;;;;;;;;;;;;;;;;;;;
 
 max_execution_time = 30     ; Maximum execution time of each script, in seconds
-memory_limit = 8388608         ; Maximum amount of memory a script may consume (8MB)
+memory_limit = 8M                      ; Maximum amount of memory a script may consume (8MB)
 
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -167,6 +167,10 @@ display_errors     =       On      ; Print out errors (as a part of the output)
                                                ; Keeping display_errors enabled on a production web site may reveal
                                                ; security information to end users, such as file paths on your Web server,
                                                ; your database schema or other information.
+display_startup_errors = Off           ; Even when display_errors is on, errors that occur during
+                                                                       ; PHP's startup sequence are not displayed.  It's strongly
+                                                                       ; recommended to keep display_startup_errors off, except for
+                                                                       ; when debugging.
 log_errors             =       Off     ; Log errors into a log file (server-specific log, stderr, or error_log (below))
                                                ; As stated above, you're strongly advised to use error logging in place of
                                                ; error displaying on production web sites.
@@ -201,6 +205,7 @@ register_argc_argv  =       On              ; This directive tells PHP whether to declare the argv&
                                                                ; variables (that would contain the GET information).  If you
                                                                ; don't use these variables, you should turn it off for
                                                                ; increased performance
+post_max_size          =       8M              ; Maximum size of POST data that PHP will accept.
 gpc_order                      =       "GPC"   ; This directive is deprecated.  Use variables_order instead.
 
 ; Magic quotes
@@ -225,8 +230,6 @@ default_mimetype = "text/html"
 include_path   =                   ; UNIX: "/path1:/path2"  Windows: "\path1;\path2"
 doc_root               =                                       ; the root of the php pages, used only if nonempty
 user_dir               =                                       ; the directory under which php opens the script using /~username, used only if nonempty
-;upload_tmp_dir        =                       ; temporary directory for HTTP uploaded files (will use system default if not specified)
-upload_max_filesize = 2097152       ; 2 Meg default limit on file uploads
 extension_dir  =       ./                              ; directory in which the loadable extensions (modules) reside
 enable_dl              = On                            ; Whether or not to enable the dl() function.
                                                                        ; The dl() function does NOT properly work in multithreaded
@@ -234,6 +237,14 @@ enable_dl          = On                            ; Whether or not to enable the dl() function.
                                                                        ; on them.
 
 
+;;;;;;;;;;;;;;;;
+; File Uploads ;
+;;;;;;;;;;;;;;;;
+file_uploads   = On                            ; Whether to allow HTTP file uploads
+;upload_tmp_dir        =                       ; temporary directory for HTTP uploaded files (will use system default if not specified)
+upload_max_filesize = 2M                   ; Maximum allowed size for uploaded files
+
+
 ;;;;;;;;;;;;;;;;;;;;;;
 ; Dynamic Extensions ;
 ;;;;;;;;;;;;;;;;;;;;;;

diff --git a/php.ini-optimized b/php.ini-optimized
index 901f300dd6d9de7c2c51dd4e36890332b13dbee6..7143b89e2769cf2f7613be115f5ae33bb809408b 100644 (file)
--- a/php.ini-optimized
+++ b/php.ini-optimized
@@ -122,7 +122,7 @@ expose_php  =       On              ; Decides whether PHP may expose the fact that it is installed
 ;;;;;;;;;;;;;;;;;;;
 
 max_execution_time = 30     ; Maximum execution time of each script, in seconds
-memory_limit = 8388608         ; Maximum amount of memory a script may consume (8MB)
+memory_limit = 8M                      ; Maximum amount of memory a script may consume (8MB)
 
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -154,6 +154,10 @@ display_errors     =       On      ; Print out errors (as a part of the output)
                                                ; Keeping display_errors enabled on a production web site may reveal
                                                ; security information to end users, such as file paths on your Web server,
                                                ; your database schema or other information.
+display_startup_errors = Off           ; Even when display_errors is on, errors that occur during
+                                                                       ; PHP's startup sequence are not displayed.  It's strongly
+                                                                       ; recommended to keep display_startup_errors off, except for
+                                                                       ; when debugging.
 log_errors             =       Off     ; Log errors into a log file (server-specific log, stderr, or error_log (below))
                                                ; As stated above, you're strongly advised to use error logging in place of
                                                ; error displaying on production web sites.
@@ -184,6 +188,7 @@ register_argc_argv  =       Off             ; This directive tells PHP whether to declare the argv
                                                                ; don't use these variables, you should turn it off for
                                                                ; increased performance (you should try not to use it anyway,
                                                                ; for less likelihood of security bugs in your code).
+post_max_size          =       8M              ; Maximum size of POST data that PHP will accept.
 gpc_order                      =       "GPC"   ; This directive is deprecated.  Use variables_order instead.
 
 ; Magic quotes
@@ -208,8 +213,6 @@ default_mimetype = "text/html"
 include_path   =                   ; UNIX: "/path1:/path2"  Windows: "\path1;\path2"
 doc_root               =                                       ; the root of the php pages, used only if nonempty
 user_dir               =                                       ; the directory under which php opens the script using /~username, used only if nonempty
-;upload_tmp_dir        =                       ; temporary directory for HTTP uploaded files (will use system default if not specified)
-upload_max_filesize = 2097152       ; 2 Meg default limit on file uploads
 extension_dir  =       ./                              ; directory in which the loadable extensions (modules) reside
 enable_dl              = On                            ; Whether or not to enable the dl() function.
                                                                        ; The dl() function does NOT properly work in multithreaded
@@ -217,6 +220,14 @@ enable_dl          = On                            ; Whether or not to enable the dl() function.
                                                                        ; on them.
 
 
+;;;;;;;;;;;;;;;;
+; File Uploads ;
+;;;;;;;;;;;;;;;;
+file_uploads   = On                            ; Whether to allow HTTP file uploads
+;upload_tmp_dir        =                       ; temporary directory for HTTP uploaded files (will use system default if not specified)
+upload_max_filesize = 2M                   ; Maximum allowed size for uploaded files
+
+
 ;;;;;;;;;;;;;;;;;;;;;;
 ; Dynamic Extensions ;
 ;;;;;;;;;;;;;;;;;;;;;;

diff --git a/php.ini-recommended b/php.ini-recommended
index 901f300dd6d9de7c2c51dd4e36890332b13dbee6..7143b89e2769cf2f7613be115f5ae33bb809408b 100644 (file)
--- a/php.ini-recommended
+++ b/php.ini-recommended
@@ -122,7 +122,7 @@ expose_php  =       On              ; Decides whether PHP may expose the fact that it is installed
 ;;;;;;;;;;;;;;;;;;;
 
 max_execution_time = 30     ; Maximum execution time of each script, in seconds
-memory_limit = 8388608         ; Maximum amount of memory a script may consume (8MB)
+memory_limit = 8M                      ; Maximum amount of memory a script may consume (8MB)
 
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -154,6 +154,10 @@ display_errors     =       On      ; Print out errors (as a part of the output)
                                                ; Keeping display_errors enabled on a production web site may reveal
                                                ; security information to end users, such as file paths on your Web server,
                                                ; your database schema or other information.
+display_startup_errors = Off           ; Even when display_errors is on, errors that occur during
+                                                                       ; PHP's startup sequence are not displayed.  It's strongly
+                                                                       ; recommended to keep display_startup_errors off, except for
+                                                                       ; when debugging.
 log_errors             =       Off     ; Log errors into a log file (server-specific log, stderr, or error_log (below))
                                                ; As stated above, you're strongly advised to use error logging in place of
                                                ; error displaying on production web sites.
@@ -184,6 +188,7 @@ register_argc_argv  =       Off             ; This directive tells PHP whether to declare the argv
                                                                ; don't use these variables, you should turn it off for
                                                                ; increased performance (you should try not to use it anyway,
                                                                ; for less likelihood of security bugs in your code).
+post_max_size          =       8M              ; Maximum size of POST data that PHP will accept.
 gpc_order                      =       "GPC"   ; This directive is deprecated.  Use variables_order instead.
 
 ; Magic quotes
@@ -208,8 +213,6 @@ default_mimetype = "text/html"
 include_path   =                   ; UNIX: "/path1:/path2"  Windows: "\path1;\path2"
 doc_root               =                                       ; the root of the php pages, used only if nonempty
 user_dir               =                                       ; the directory under which php opens the script using /~username, used only if nonempty
-;upload_tmp_dir        =                       ; temporary directory for HTTP uploaded files (will use system default if not specified)
-upload_max_filesize = 2097152       ; 2 Meg default limit on file uploads
 extension_dir  =       ./                              ; directory in which the loadable extensions (modules) reside
 enable_dl              = On                            ; Whether or not to enable the dl() function.
                                                                        ; The dl() function does NOT properly work in multithreaded
@@ -217,6 +220,14 @@ enable_dl          = On                            ; Whether or not to enable the dl() function.
                                                                        ; on them.
 
 
+;;;;;;;;;;;;;;;;
+; File Uploads ;
+;;;;;;;;;;;;;;;;
+file_uploads   = On                            ; Whether to allow HTTP file uploads
+;upload_tmp_dir        =                       ; temporary directory for HTTP uploaded files (will use system default if not specified)
+upload_max_filesize = 2M                   ; Maximum allowed size for uploaded files
+
+
 ;;;;;;;;;;;;;;;;;;;;;;
 ; Dynamic Extensions ;
 ;;;;;;;;;;;;;;;;;;;;;;