From: Operating system: FreeBSD, Windows Server 2008 PHP version: 5.3.8 Package: Unknown/Other Function Bug Type: Bug Bug description:Content-Type header is not parsed correctly on HTTP POST request
Description: ------------ HTTP POST is not parsed correctly when the "boundary" parameter of the Content-Type HTTP header is not the last parameter on the line. --- Guessing (might be wrong): In the first case, PHP parses the ";" (and maybe also the rest of the line) after the boundary still as part of the boundary value. As a result, the POST DATA are not "understood" correctly. However, the following parts from RFC 1521 states clearly that ";" could not be part of the boundary: tspecials := "(" / ")" / "<" / ">" / "@" / "," / ";" / ":" / "\" / <"> / "/" / "[" / "]" / "?" / "=" ; Must be in quoted-string, ; to use within parameter values boundary := 0*69<bchars> bcharsnospace bchars := bcharsnospace / " " bcharsnospace := DIGIT / ALPHA / "'" / "(" / ")" / "+" /"_" / "," / "-" / "." / "/" / ":" / "=" / "?" Test script: --------------- Consider the following call to a PHP script running on an Apache server. Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BVoyv; charset=iso-8859-1 Accept: */* Content-Length: 72 Host: example.com Content-Disposition: form-data; name="data" abc --BVoyv-- And a corresponding PHP script: <?php print_r(getallheaders()); print_r($_REQUEST); ?> In this case, the POST data are not seen on the PHP side, as shown on the output: Array ( [Connection] => Keep-Alive [Content-Type] => multipart/form-data; boundary=BVoyv; charset=iso-8859-1 [Accept] => */* [Content-Length] => 72 [Host] => example.com ) Array ( ) However, after changing order of parameters in the Content-Type header to: "Content-Type: multipart/form-data; charset=iso-8859-1; boundary=BVoyv" the script output is as expected (notify appearing of the [data] line): Array ( [Connection] => Keep-Alive [Content-Type] => multipart/form-data; charset=iso-8859-1; boundary=BVoyv [Accept] => */* [Content-Length] => 72 [Host] => example.com ) Array ( [data] => abc ) Expected result: ---------------- Both cases should be equal to each other. Actual result: -------------- In the first case, the "data" parameter is not available to the script. -- Edit bug report at https://bugs.php.net/bug.php?id=55504&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=55504&r=trysnapshot54 Try a snapshot (PHP 5.3): https://bugs.php.net/fix.php?id=55504&r=trysnapshot53 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=55504&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=55504&r=fixed Fixed in SVN and need be documented: https://bugs.php.net/fix.php?id=55504&r=needdocs Fixed in release: https://bugs.php.net/fix.php?id=55504&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=55504&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=55504&r=needscript Try newer version: https://bugs.php.net/fix.php?id=55504&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=55504&r=support Expected behavior: https://bugs.php.net/fix.php?id=55504&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=55504&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=55504&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=55504&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=55504&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=55504&r=dst IIS Stability: https://bugs.php.net/fix.php?id=55504&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=55504&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=55504&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=55504&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=55504&r=mysqlcfg