php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #75741 enable_post_data_reading not working on PHP-FPM
Submitted: 2017-12-28 01:22 UTC Modified: 2018-01-21 22:29 UTC
Votes:6
Avg. Score:4.8 ± 0.4
Reproduced:6 of 6 (100.0%)
Same Version:1 (16.7%)
Same OS:0 (0.0%)
From: manhiro at gmail dot com Assigned: bukka (profile)
Status: Assigned Package: FPM related
PHP Version: 7.1.12 OS: CentOS 6.7
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: manhiro at gmail dot com
New email:
PHP Version: OS:

 

 [2017-12-28 01:22 UTC] manhiro at gmail dot com
Description:
------------
Apache 2.4.6
PHP 7.1.12

I'm trying to manually parse multipart form data on PHP-FPM.
When I set the 'enable_post_data_reading = Off' in php.ini file,  I can get raw post data.

Example:
$handle = fopen("php://input", "rb");
while (!feof($handle)) {
  // do something
}

However, when I set that in .user.ini file, I can't get raw post data.
I think that the .user.ini file is correct because phpinfo() shows as bellow.

 Local Value | Master Value
----------------------------
 Off         | On
 
 
Note:
sapi_activate() in the file main/SAPI.c:
----------------------------
/* Handle request method */
if (SG(server_context)) {
	if (PG(enable_post_data_reading)
	&& 	SG(request_info).content_type
	&&  SG(request_info).request_method
	&& !strcmp(SG(request_info).request_method, "POST")) {
		/* HTTP POST may contain form data to be processed into variables
		 * depending on given content type */
		sapi_read_post_data();
	} else {
		SG(request_info).content_type_dup = NULL;
	}

	/* Cookies */
	SG(request_info).cookie_data = sapi_module.read_cookies();
}
if (sapi_module.activate) {
	sapi_module.activate();
}
if (sapi_module.input_filter_init) {
	sapi_module.input_filter_init();
}
----------------------------
I guess that the above code to handle request method is executed before loading .user.ini file.


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2018-01-19 14:44 UTC] bukka@php.net
-Status: Open +Status: Duplicate -Assigned To: +Assigned To: bukka
 [2018-01-19 14:44 UTC] bukka@php.net
I think this should be already changed in 7.2. It was the way how FPM handled user.ini before 7.2 so the fix didn't go to the bug fixing release (preventing some relaxing of the rules).

The fix was this one: https://github.com/php/php-src/commit/cfc6c4d2973c795cb400435a28805a73c02d23e2

As it was already reported in https://bugs.php.net/bug.php?id=75212 I will close this as a duplicate. If it didn't fixed your issue (if this issue is still present in 7.2), please let me know (comment on this) and I will take a look.
 [2018-01-21 01:20 UTC] manhiro at gmail dot com
I tried on php7.2.1.
However, it didn't work.

Test script:
---------------
//test.html

<html>
<head>
<title>test</title>
</head>
<body>
<form action="upload.php" method="POST" enctype="multipart/form-data">
<input type="file" name="test" /><br>
<input type="submit" />
</form>
</body>
</html>

//upload.php

<?php

var_dump($_FILES);

//.user.ini

enable_post_data_reading = Off
upload_max_filesize = 10M


phpinfo result:
----------------

 Local Value | Master Value
----------------------------
 Off         | On

Expected result:
----------------
array(0) { } 

Actual result:
--------------
array(1) { ["test"]=> array(5) { ["name"]=> string(21) "test.mp4" ["type"]=> string(9) "video/mp4" ["tmp_name"]=> string(14) "/tmp/php9fldnI" ["error"]=> int(0) ["size"]=> int(5230167) } }
 [2018-01-21 22:29 UTC] bukka@php.net
-Status: Duplicate +Status: Open
 [2018-01-21 22:29 UTC] bukka@php.net
Ok, changing status back to Open. Will take a look later.
 [2019-08-15 16:03 UTC] adelin at mcbsoft dot com
I confirm the same behavior, by setting the value in a different manner (and using nginx webserver).

I've tried to set "enable_post_data_reading" to "Off" value on a specific path, using a dedicated "ini" conf file, by using the [PATH=/path/to/dir] directive.

phpinfo() reports that "enable_post_data_reading" is indeed "Off" for the local value (which is within the specified path), however when I try to submit form with POST data, var_dump($_POST) still prints the POST fields, though it shouldn't.

When I set the master value to Off from the main php.ini, it works accordingly, $_POST fields aren't populated anymore.

Tested with v5.6, v7.1, v7.3 - all of them have this issue.
Hope it helps.

Thanks,
Best,
A.
 [2023-08-14 06:52 UTC] suhern dot chen at gmail dot com
PHP 8.1 also has this issue
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue Mar 19 02:01:28 2024 UTC