|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #75741 enable_post_data_reading not working on PHP-FPM
Submitted: 2017-12-28 01:22 UTC Modified: 2018-01-21 22:29 UTC
Avg. Score:4.6 ± 0.7
Reproduced:7 of 7 (100.0%)
Same Version:1 (14.3%)
Same OS:0 (0.0%)
From: manhiro at gmail dot com Assigned: bukka (profile)
Status: Assigned Package: FPM related
PHP Version: 7.1.12 OS: CentOS 6.7
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2017-12-28 01:22 UTC] manhiro at gmail dot com
Apache 2.4.6
PHP 7.1.12

I'm trying to manually parse multipart form data on PHP-FPM.
When I set the 'enable_post_data_reading = Off' in php.ini file,  I can get raw post data.

$handle = fopen("php://input", "rb");
while (!feof($handle)) {
  // do something

However, when I set that in .user.ini file, I can't get raw post data.
I think that the .user.ini file is correct because phpinfo() shows as bellow.

 Local Value | Master Value
 Off         | On
sapi_activate() in the file main/SAPI.c:
/* Handle request method */
if (SG(server_context)) {
	if (PG(enable_post_data_reading)
	&& 	SG(request_info).content_type
	&&  SG(request_info).request_method
	&& !strcmp(SG(request_info).request_method, "POST")) {
		/* HTTP POST may contain form data to be processed into variables
		 * depending on given content type */
	} else {
		SG(request_info).content_type_dup = NULL;

	/* Cookies */
	SG(request_info).cookie_data = sapi_module.read_cookies();
if (sapi_module.activate) {
if (sapi_module.input_filter_init) {
I guess that the above code to handle request method is executed before loading .user.ini file.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2018-01-19 14:44 UTC]
-Status: Open +Status: Duplicate -Assigned To: +Assigned To: bukka
 [2018-01-19 14:44 UTC]
I think this should be already changed in 7.2. It was the way how FPM handled user.ini before 7.2 so the fix didn't go to the bug fixing release (preventing some relaxing of the rules).

The fix was this one:

As it was already reported in I will close this as a duplicate. If it didn't fixed your issue (if this issue is still present in 7.2), please let me know (comment on this) and I will take a look.
 [2018-01-21 01:20 UTC] manhiro at gmail dot com
I tried on php7.2.1.
However, it didn't work.

Test script:

<form action="upload.php" method="POST" enctype="multipart/form-data">
<input type="file" name="test" /><br>
<input type="submit" />





enable_post_data_reading = Off
upload_max_filesize = 10M

phpinfo result:

 Local Value | Master Value
 Off         | On

Expected result:
array(0) { } 

Actual result:
array(1) { ["test"]=> array(5) { ["name"]=> string(21) "test.mp4" ["type"]=> string(9) "video/mp4" ["tmp_name"]=> string(14) "/tmp/php9fldnI" ["error"]=> int(0) ["size"]=> int(5230167) } }
 [2018-01-21 22:29 UTC]
-Status: Duplicate +Status: Open
 [2018-01-21 22:29 UTC]
Ok, changing status back to Open. Will take a look later.
 [2019-08-15 16:03 UTC] adelin at mcbsoft dot com
I confirm the same behavior, by setting the value in a different manner (and using nginx webserver).

I've tried to set "enable_post_data_reading" to "Off" value on a specific path, using a dedicated "ini" conf file, by using the [PATH=/path/to/dir] directive.

phpinfo() reports that "enable_post_data_reading" is indeed "Off" for the local value (which is within the specified path), however when I try to submit form with POST data, var_dump($_POST) still prints the POST fields, though it shouldn't.

When I set the master value to Off from the main php.ini, it works accordingly, $_POST fields aren't populated anymore.

Tested with v5.6, v7.1, v7.3 - all of them have this issue.
Hope it helps.

 [2023-08-14 06:52 UTC] suhern dot chen at gmail dot com
PHP 8.1 also has this issue
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun May 19 17:01:33 2024 UTC