php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Request #75121 PHP cuts out charset information from content-type in file uploads
Submitted: 2017-08-25 15:12 UTC Modified: -
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: jocrutrisi at ibsats dot com Assigned:
Status: Open Package: Unknown/Other Function
PHP Version: 7.2.0beta3 OS: All
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: jocrutrisi at ibsats dot com
New email:
PHP Version: OS:

 

 [2017-08-25 15:12 UTC] jocrutrisi at ibsats dot com 
Description:
------------
Seems like PHP cuts out attributes, including charset, from "Content-Type" when assigning the "type" attribute in file uploads: https://github.com/php/php-src/blob/c8aa6f3a9a3d2c114d0c5e0c9fdd0a465dbb54a5/main/rfc1867.c#L1180

That's information loss, this information is important when processing text uploads.

I realize doing the right thing (assigning full type to "type") is now not an option for BC reasons.

But I'd like to propose that we add another field to the $_FILES file entry, "charset", which contains the charset when it's there (and when it's not, the field can be missing or null).

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-08-25 15:19 UTC] danack@php.net 
Wow....that's something.

Could you post an example for content-type string so that when it gets fixed, someone has an example to add as a test.
 [2017-08-25 15:28 UTC] jocrutrisi at ibsats dot com 
It's covered here (and elsewhere):

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type

https://tools.ietf.org/html/rfc7231#section-3.1.1.1

Basically it looks like (the names ARE CASE-INSENSITIVE, much like header names):

Content-Type: text/plain; charset=utf-8

The charset is not always supplied, but in some cases it is. It's possible that other attributes may also be appended in the same fashion, but I don't think any are documented right now (there's the boundary but that's only for multipart content)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Mon Nov 25 12:01:31 2024 UTC