如何永久增加 max_input_vars？ php.ini 方法会定期被覆盖

Question

I manage a VPS, where I would like to increase the max_input_vars for one of the WordPress sites that is hosted on the VPS. To do this, I headed over to /var/www/vhosts/system/example.com/etc/ and entered the following into the enclosed php.ini file:

max_input_vars =4000

Whilst this worked, the file gets overridden periodically and thus I lose my modification.

Is there an alternative way to achieve this modification, without the worry of the php.ini being automatically overridden?

I have tried the following but all have resulted in the website being taken offline:

.htaccess

php_value max_input_vars 4000

wp-config

@ini_set( 'max_input_vars' , 4000 );

Update: 09/01/2020

I have also tried entering php_admin_flag max_input_vars On into the /etc/apache2/apache2.conf file followed by entering max_input_vars =4000 into the /var/www/vhosts/system/example.com/etc/php.ini file.

Unfortunately, the max_input_vars =4000 still gets overridden with the default of 1000 being reset. Furthermore, this approach produces the following notifications; within the server:

Could I be doing something wrong here?

Answer 1

So,max_input_vars is PHP_INI_PERDIR which means it can be set in either php.ini, .htaccess, httpd.conf or .user.ini ( since PHP 5.3 ).

PHP only has one solution for preventing local directive overrides ( local directives override master directives in PHP so it bubbles from the bottom up ) and that's to set an admin_flag on the directive, thus preventing the master configuration from being override locally. To do this it will depend on which PHP SAPI you're using.

mod_php (Apache httpd)

You can set php_admin_flag in your apache config (ie virtualhost file or httpd.conf) using php_admin_flag max_input_vars On in your httpd config. This will prevent the loaded value from your php.ini to be overridden by .htaccess or ini_set() .

php-fpm (fastcgi)

You can set the php_admin_flag in your php-fpm config or individual pool configs with the syntax php_admin_flag[max_input_vars] = On .

NB

However, before proceeding please take under advisement the importance of not setting this directive too high as it can cause a known Denial of Service attack in PHP. From the manual...

Use of this directive mitigates the possibility of denial of service attacks which use hash collisions. If there are more input variables than specified by this directive, an E_WARNING is issued, and further input variables are truncated from the request.