php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #55510 $_FILES 'name' missing first character after upload.
Submitted: 2011-08-25 19:36 UTC Modified: 2011-08-30 12:25 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: aaron at gwmicro dot com Assigned: arpad
Status: Closed Package: Filesystem function related
PHP Version: 5.3.8 OS: Windows Server 2008 R2
Private report: No CVE-ID:
 [2011-08-25 19:36 UTC] aaron at gwmicro dot com
Description:
------------
After uploading a file using a multipart/form-data HTML form, the resulting file name is missing the initial character (i.e. readme.txt becomes eadme.txt).

Server: Apache/2.2.19 (Win32) mod_ssl/2.2.19 OpenSSL/1.0.0d PHP/5.3.8

Test script:
---------------
<FORM ACTION="<? echo $_SERVER['PHP_SELF']; ?>" METHOD="POST" ENCTYPE="multipart/form-data">
File: <INPUT TYPE="file" NAME="filename">
<INPUT TYPE="submit" VALUE="go">
</FORM>
<?
if (isset($_FILES)) {
	var_dump($_FILES);
}
?>

array(1) { ["filename"]=> array(5) { ["name"]=> string(10) "eadme.txt" ["type"]=> string(10) "text/plain" ["tmp_name"]=> string(31) "C:\temp\file_upload\php7D44.tmp" ["error"]=> int(0) ["size"]=> int(3420) } } 

Expected result:
----------------
$_FILES['filename']['name'] should be intact rather than missing the first character. 

["name"]=> string(10) "readme.txt"

Actual result:
--------------
$_FILES['filename']['name'] is missing the first character:

["name"]=> string(10) "eadme.txt"

Patches

fix-upload-win-mqgpc-bug-55510.patch (last revision 2011-08-29 02:43 UTC) by arpad@php.net)

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-08-25 19:46 UTC] aaron at gwmicro dot com
While I'm not enamored with the idea of running a beta in production, this problem appears to be resolved in 5.4.0beta1-dev.
 [2011-08-26 19:02 UTC] v-mafick at microsoft dot com
I've setup Apache 2.2.19 and PHP 5.3.8 (though not with mod_ssl) and have run the test script you provided, but it doesn't produce the problem you reported (it works fine).

In your report, $_FILES['filename']['name'] reports the length of the string as 10, even though only 9 characters are displayed.

Is it possible that somewhere in your program you're converting between charsets or mangling the filename.

Also, could you provide a packet capture of the network traffic between your web browser and your web application. You can do this with Wireshark (Windows/Linux) or NetMon (Windows).
 [2011-08-26 20:46 UTC] aaron at gwmicro dot com
Yes, I will attempt to get this information to you. I can say that we were using 5.2.13 without incident prior to updating to 5.3.8. After updating to 5.3.8, we were notified by users that they could no longer download files that they were successfully uploading. That was when I determined the missing first character. Because we didn't want to go backward, I put on the 5.4 version, and the problem went away. Note that no changes were made in the PHP source during the process of changing versions. I will try to back all that with the requested data.
 [2011-08-26 23:02 UTC] johannes@php.net
-Status: Open +Status: Feedback
 [2011-08-26 23:02 UTC] johannes@php.net
Keeping state at "Feedback" until data requested by mafick is provided.
 [2011-08-28 17:21 UTC] aaron at gwmicro dot com
Here are the capture contents using Wireshark and PHP 5.3.8:

No.     Time        Source                Destination           Protocol Length Info
   1203 7.252093    10.0.0.251            184.18.147.3          HTTP     986    POST /private/aaron/filename.php HTTP/1.1  (text/plain)

Frame 1203: 986 bytes on wire (7888 bits), 986 bytes captured (7888 bits)
Ethernet II, Src: AsustekC_8e:2f:bb (00:26:18:8e:2f:bb), Dst: 3com_49:bb:06 (00:01:02:49:bb:06)
Internet Protocol Version 4, Src: 10.0.0.251 (10.0.0.251), Dst: 184.18.147.3 (184.18.147.3)
Transmission Control Protocol, Src Port: 65260 (65260), Dst Port: http (80), Seq: 1, Ack: 1, Len: 932
Hypertext Transfer Protocol
MIME Multipart Media Encapsulation, Type: multipart/form-data, Boundary: "---------------------------9503744825200"
    [Type: multipart/form-data]
    First boundary: -----------------------------9503744825200\r\n
    Encapsulated multipart part:  (text/plain)
        Content-Disposition: form-data; name="filename"; filename="readme.txt"\r\n
        Content-Type: text/plain\r\n\r\n
        Line-based text data: text/plain
            Hello! This is a test.
    Last boundary: \r\n-----------------------------9503744825200--\r\n

No.     Time        Source                Destination           Protocol Length Info
   1205 7.252782    10.0.0.1              10.0.0.251            HTTP     986    POST /private/aaron/filename.php HTTP/1.1  (text/plain)

Frame 1205: 986 bytes on wire (7888 bits), 986 bytes captured (7888 bits)
Ethernet II, Src: 3com_49:bb:06 (00:01:02:49:bb:06), Dst: AsustekC_8e:2f:bb (00:26:18:8e:2f:bb)
Internet Protocol Version 4, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.251 (10.0.0.251)
Transmission Control Protocol, Src Port: 65260 (65260), Dst Port: http (80), Seq: 1, Ack: 1, Len: 932
Hypertext Transfer Protocol
MIME Multipart Media Encapsulation, Type: multipart/form-data, Boundary: "---------------------------9503744825200"
    [Type: multipart/form-data]
    First boundary: -----------------------------9503744825200\r\n
    Encapsulated multipart part:  (text/plain)
        Content-Disposition: form-data; name="filename"; filename="readme.txt"\r\n
        Content-Type: text/plain\r\n\r\n
        Line-based text data: text/plain
            Hello! This is a test.
    Last boundary: \r\n-----------------------------9503744825200--\r\n
 [2011-08-28 17:38 UTC] aaron at gwmicro dot com
I started going back version by version from 5.3.8 to see where the problem started, and it seems to have begun with 5.3.7, as 5.3.6 works correctly. Once again, I'm just replacing PHP builds -- I'm not modifying any else. With 5.3.6, I get back what I would expect:

array(1) { ["filename"]=> array(5) { ["name"]=> string(10) "readme.txt" ["type"]=> string(10) "text/plain" ["tmp_name"]=> string(31) "C:\temp\file_upload\php594F.tmp" ["error"]=> int(0) ["size"]=> int(22) } } 

With 5.3.7 and 5.3.8, I get back the missing first letter:

array(1) { ["filename"]=> array(5) { ["name"]=> string(10) "eadme.txt" ["type"]=> string(10) "text/plain" ["tmp_name"]=> string(31) "C:\temp\file_upload\php594F.tmp" ["error"]=> int(0) ["size"]=> int(22) } } 

With 5.4.beta1-dev, I'm back to getting everything that I expect:

array(1) { ["filename"]=> array(5) { ["name"]=> string(10) "readme.txt" ["type"]=> string(10) "text/plain" ["tmp_name"]=> string(31) "C:\temp\file_upload\php594F.tmp" ["error"]=> int(0) ["size"]=> int(22) } }
 [2011-08-29 02:43 UTC] arpad@php.net
The following patch has been added/updated:

Patch Name: fix-upload-win-mqgpc-bug-55510.patch
Revision:   1314585804
URL:        https://bugs.php.net/patch-display.php?bug=55510&patch=fix-upload-win-mqgpc-bug-55510.patch&revision=1314585804
 [2011-08-29 02:46 UTC] arpad@php.net
-Status: Feedback +Status: Verified
 [2011-08-29 02:46 UTC] arpad@php.net
This bug is present on Windows with magic_quotes_gpc on. "s" is then always set and the change in r312103 means the leading char is skipped.
 [2011-08-29 21:10 UTC] arpad@php.net
Automatic comment from SVN on behalf of arpad
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=315742
Log: fix #55510: $_FILES 'name' missing first character after upload
 [2011-08-29 21:12 UTC] arpad@php.net
-Status: Verified +Status: Closed -Assigned To: +Assigned To: arpad
 [2011-08-29 21:12 UTC] arpad@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.


 [2011-08-29 21:14 UTC] arpad@php.net
Automatic comment from SVN on behalf of arpad
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=315743
Log: NEWS entry for fix #55510: $_FILES 'name' missing first character after upload
 [2011-08-30 12:25 UTC] aaron at gwmicro dot com
I can confirm that this is fixed in 5.3 r315756. Thank you for the fix, and the quick turn around.
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Sun Apr 20 01:02:05 2014 UTC