Is there an existing issue for this?

• I have searched the existing issues

What happened?

Currently, updating the Max Upload Size (MB) pictured below results in the maxRequestLength and requestLengthDiskThreshold values being the same.

The default for DNN is as follows:

    <httpRuntime targetFramework="4.7.2" shutdownTimeout="120" executionTimeout="1200" useFullyQualifiedRedirectUrl="true" maxRequestLength="29296" requestLengthDiskThreshold="81920" maxUrlLength="2048" requestPathInvalidCharacters="&lt;,&gt;,*,%,:,\,?" enableVersionHeader="false" requestValidationMode="2.0" fcnMode="Single" />

Updating the value for Max Upload Size (MB) to 12 in the UI results in the following

    <httpRuntime targetFramework="4.7.2" shutdownTimeout="120" executionTimeout="1200" useFullyQualifiedRedirectUrl="true" maxRequestLength="12288" requestLengthDiskThreshold="12288" maxUrlLength="2048" requestPathInvalidCharacters="&lt;,&gt;,*,%,:,\,?" enableVersionHeader="false" requestValidationMode="2.0" fcnMode="Single" />

Updating the value for Max Upload Size (MB) back to 28 in the UI results in the following

    <httpRuntime targetFramework="4.7.2" shutdownTimeout="120" executionTimeout="1200" useFullyQualifiedRedirectUrl="true" maxRequestLength="28672" requestLengthDiskThreshold="28672" maxUrlLength="2048" requestPathInvalidCharacters="&lt;,&gt;,*,%,:,\,?" enableVersionHeader="false" requestValidationMode="2.0" fcnMode="Single" />

For those that don't know, here is the math for calculating:

1 Megabyte = 1024 Kilobyte

The result for a value of 28 (MB) in the UI, should translate to a value of 28672 in the maxRequestLength value, and it does when saved.

However, this shows that the default value of 29296 does NOT in fact translate to 28 (MB). It would translate to approximately 28.61 (MB). So, if 28 (MB) is our desired default value, we need to update the default web.config value accordingly, and ensure the math for the PersonaBar UI is correct in reading/displaying it.

Microsoft default values are as follows:

• maxRequestLength = 4096 (KB)
• requestLengthDiskThreshold = 81920 (B)

Note: Thank you Microsoft for not making the unit of measurement the same for both of these.  🤦🏼 

Based on the default values by Microsoft, it can be implied (as a general rule of thumb) to set the requestLengthDiskThreshold to 1.95% of the maxRequestLength value. However, the value of requestLengthDiskThreshold should never exceed that of maxRequestLength (when converted for the unit of measurement).

So, our calculated values for maxRequestLength and requestLengthDiskThreshold should be proportionate to the default values set originally by Microsoft.

That said, I believe we should also add another field to the PersonaBar UI to allow manual changes to requestLengthDiskThreshold proportionate defaults (calculated when entering maxRequestLength), as there are situations where changing this value is warranted and there is currently no way of making these changes in the UI. A value exceeding maxRequestLength should not be allowed.

Steps to reproduce?

1. Go to web.config and note default values for httpRuntime
2. Go to Settings > Security > More > More Security Settings
3. Change value for Max Upload Size (MB)
4. Go to web.config and note new values for maxRequestLength and requestDiskThresholdLength in httpRuntime

Current Behavior

Values for maxRequestLength and requestDiskThresholdLength in httpRuntime are the same after saving in UI.

Expected Behavior

Values for maxRequestLength and requestDiskThresholdLength in httpRuntime should be based proportionately according to the defaults established by Microsoft.

Relevant log output

n/a

Anything else?

We have never, by default, added the following to the web.config. Should we consider adding this? It is required for working with large files in IIS 7+. Please note the unit of measurement for maxAllowedContentLength is in Bytes (not KB). 🤦🏼

<system.webServer>
    <security>
      <requestFiltering>
        <requestLimits maxAllowedContentLength="28672000" />
      </requestFiltering>
    </security>
</system.webServer>

Affected Versions

9.12.0 (latest release), 10.0.0 (alpha)

What browsers are you seeing the problem on?

No response

Code of Conduct

• I agree to follow this project's Code of Conduct