php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #76444 can't read stream from multipart requests
Submitted: 2018-06-11 08:23 UTC Modified: 2021-07-27 12:05 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: clark at electrobeat dot dk Assigned:
Status: Open Package: Streams related
PHP Version: 7.0.30 OS: debian stretch
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: clark at electrobeat dot dk
New email:
PHP Version: OS:

 

 [2018-06-11 08:23 UTC] clark at electrobeat dot dk
Description:
------------
It's not possible to read the request stream from multipart/form-data requets

$body = file_get_contents('php://input');

It seems like it has been a open bug for many years so I don't get why it has never been fixed!?

If a user uploads a file you can't even check if the data part is gzipped or anything..

It doesn't make sense that you only can read streams from some request streams but not from others!?

Test script:
---------------
$boundary = 'jlasdifj439';
$field1 = json_encode(['test' => 123]);
$body = '--'.$boundary."\r\n"
	.'Content-Disposition: form-data; name="json"; filename="file.pdf"'."\r\n"
	.'Content-Type: application/json'."\r\n"
	.'Content-Length: '.strlen($field1)."\r\n\r\n"
	.$field1."\r\n"
	.'--'.$boundary.'--';

$socket = curl_init();
curl_setopt_array($socket, [
	CURLOPT_POST 			=> true,
	CURLOPT_RETURNTRANSFER 	=> true,
	CURLOPT_VERBOSE 		=> true,
	CURLOPT_ENCODING 		=> '',
	CURLOPT_HTTP_VERSION 	=> CURL_HTTP_VERSION_2_0,
]);
curl_setopt($socket, CURLOPT_URL, 'https://api-scan.dynaccount.com/');
curl_setopt($socket, CURLOPT_HTTPHEADER, [
	'Content-Type: multipart/form-data; boundary='.$boundary,
]);
curl_setopt($socket, CURLOPT_POSTFIELDS, $body);
if(!$response = curl_exec($socket)){
	echo "ERROR!";
}
echo $response;


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2018-06-11 08:26 UTC] clark at electrobeat dot dk
want to delete the url to my server
 [2018-06-11 09:07 UTC] requinix@php.net
-Type: Bug +Type: Feature/Change Request
 [2018-06-11 09:07 UTC] requinix@php.net
It hasn't been fixed because it isn't a bug.

http://php.net/manual/en/wrappers.php.php
> php://input is not available with enctype="multipart/form-data".

File upload requests are often large. They can't necessarily be buffered to memory, though buffering to a temp file would probably be a reasonable fallback. And obviously being a data stream so it's not naturally seekable.

But it sounds like what you really want is to get the multipart headers. AFAIK that's a brand new idea.
 [2018-06-11 09:28 UTC] clark at electrobeat dot dk
Is it possible to get the headers from the parts of a multipart request?
 [2018-06-11 09:29 UTC] clark at electrobeat dot dk
could anyone please remove the URL in the description to my server..
 [2018-06-11 09:59 UTC] requinix@php.net
By "brand new idea" I meant that I've never heard of anyone needing a way to do that, let alone knowing how to.
And looking through the code, I don't see a way to do it.

But I think I see a possible workaround when using nginx and php-fpm: have nginx write the request body to a file (client_body_in_file_only=clean), pass the filename as a CGI environment variable (fastcgi_param REQUEST_BODY_FILE $request_body_file) which PHP will recognize, then you can open and read the file in code too.
 [2021-07-27 12:05 UTC] cmb@php.net
Related to request #48219.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Apr 25 11:01:30 2024 UTC