| 1234567891011 |
- ; speedtest_worker.js defaults xhr_ul_blob_megabytes to 20.
- ; PHP's stock post_max_size = 8M rejects those upload chunks before
- ; empty.php can send its headers. 32M leaves modest headroom.
- post_max_size = 32M
- ; LibreSpeed does not use the session upload progress feature, and PHP's advisory
- ; for CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) names it as a way to reach the
- ; vulnerable code path, recommending it be off if it is not needed. Updating PHP is
- ; the real fix; this only removes a feature nobody here uses.
- session.upload_progress.enabled = 0
|
