php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #48962 cURL does not upload files with specified filename
Submitted: 2009-07-17 16:14 UTC Modified: 2009-07-21 17:51 UTC
From: alexei dot svitkine at gmail dot com Assigned:
Status: Closed Package: cURL related
PHP Version: 5.2.10 OS: Linux
Private report: No CVE-ID:
 [2009-07-17 16:14 UTC] alexei dot svitkine at gmail dot com
Description:
------------
Currently, using cURL from PHP, it is not possible to specify a custom 
filename on the file sent with the POST. PHP always tells cURL to send 
the full path from the filesystem to the server.

However, it is possible to do this from the command-line using:

curl -F 'file=@/tmp/myfile;filename=foo.zip' http://example.com 

This bug is similar to:

http://bugs.php.net/bug.php?id=46696

In that bug (which is now fixed), PHP ignored the 'type' parameter 
which was passed in a similar way as 'filename' above, but was fixed 
to detect it.


Reproduce code:
---------------
# File test1.php

$data = array('file' => '@/tmp/myfile;filename=foobar');

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'http://localhost/upload.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_exec($ch);

echo curl_error($ch);

# File test2.php

$data = array('file' => '@/tmp/myfile;filename=foobar;type=application/zip');

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'http://localhost/upload.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_exec($ch);

echo curl_error($ch);

# File upload.php

print_r($_FILES);


Expected result:
----------------
# Result of test1.php

Array
(
    [item_file] => Array
        (
            [name] => foobar
            [type] => application/octet-stream
            [tmp_name] => /var/tmp/phpCEVFto
            [error] => 0
            [size] => 36257
        )

)

# Result of test1.php

Array
(
    [item_file] => Array
        (
            [name] => foobar
            [type] => application/zip
            [tmp_name] => /var/tmp/phpCEVFto
            [error] => 0
            [size] => 36257
        )

)

Actual result:
--------------
The ";filename=foobar" part is either treated as part of the file path 
(in test1.php), so the file is not found, and curl_exec() fails, or it 
is treated as part of the 'type' (in test2.php), so incorrect 
information is sent.

In either case, PHP currently does not look for the 'filename' parameter 
as it does for the 'type' parameter, and handles it incorrectly. The fix 
should be made to the "case CURLOPT_POSTFIELDS:" code in 
ext/curl/interface.c, similar to how 'type' is already handled there.

This report applies to PHP 5.2.10 and PHP 5.3.0.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-07-21 15:56 UTC] svn@php.net
Automatic comment from SVN on behalf of iliaa
Revision: http://svn.php.net/viewvc/?view=revision&revision=284546
Log: Fixed bug #48962 (cURL does not upload files with specified filename).
 [2009-07-21 15:56 UTC] iliaa@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 [2009-07-21 17:51 UTC] alexei dot svitkine at gmail dot com
In the fixed code:

Shouldn't the line "CURLFORM_FILENAME, filename ? filename : postval," 
instead be "CURLFORM_FILENAME, filename ? filename + 
sizeof(";filename=") - 1: postval,"?

Otherwise, "filename" will point to the character that was set to 
NULL...)
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Thu Apr 17 21:01:56 2014 UTC