#48190 [NEW]: wrong content-type parsing

From: carsten_sttgt at gmx dot de Operating system: Windows_NT PHP version: 5.3CVS-2009-05-08 (snap) PHP Bug Type: *Web Server problem Bug description: wrong content-type parsing Description: ------------ Hello, PHP does not work correctly with POST requests and a Content-Type of MULTIPART/form-data, if the parameter name "BOUNDARY" is in uppercase. According to RFC2045, matching of media type, subtype and parameter (attributes) is always case-insensitive. (only the value of the BOUNDARY parameter is compared case-sensitive) Tested on Windows with 5.2-dev, 5.3-dev and 6.0-dev. CGI and Apache module. Regards, Carsten Reproduce code: --------------- Put this textfile in your PHP directory: **************** test.txt ****************** --250-16659-1241787336=:9320 Content-Type: TEXT/plain; CHARSET=iso-8859-1 Content-Transfer-Encoding: QUOTED-PRINTABLE Content-Disposition: form-data; name=nick php-faq --250-16659-1241787336=:9320 Content-Type: TEXT/plain; CHARSET=iso-8859-1 Content-Transfer-Encoding: QUOTED-PRINTABLE Content-Disposition: form-data; name=desc post demo script --250-16659-1241787336=:9320-- ******************************************** Put this phpfile in your PHP directory: **************** test.php ****************** <?php var_dump($_POST); ?> ******************************************** Open a command prompt, go to your PHP dir and execute: # set REQUEST_METHOD=POST # set REDIRECT_STATUS=1 # set SCRIPT_FILENAME=test.php # set CONTENT_LENGTH=391 # set CONTENT_TYPE=MULTIPART/form-data; BOUNDARY="250-16659-1241787336=:9320" # type test.text | php-cgi.exe if you set CONTENT_TYPE in this way, you have the correct result: # set CONTENT_TYPE=MULTIPART/form-data; boundary="250-16659-1241787336=:9320" Regards, Carsten BTW: e.g. the IMAP-Module from PHP is using/generating BOUNDARY in uppercase. Expected result: ---------------- Content-type: text/html array(2) { ["nick"]=> string(7) "php-faq" ["desc"]=> string(16) "post demo script" } Actual result: -------------- Content-type: text/html <br /> <b>Warning</b>: Missing boundary in multipart/form-data POST data in <b>Unknown </b> on line <b>0</b><br /> array(0) { } -- Edit bug report at http://bugs.php.net/?id=48190&edit=1 -- Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=48190&r=trysnapshot52 Try a CVS snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=48190&r=trysnapshot53 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=48190&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=48190&r=fixedcvs Fixed in CVS and need be documented: http://bugs.php.net/fix.php?id=48190&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=48190&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=48190&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=48190&r=needscript Try newer version: http://bugs.php.net/fix.php?id=48190&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=48190&r=support Expected behavior: http://bugs.php.net/fix.php?id=48190&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=48190&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=48190&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=48190&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=48190&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=48190&r=dst IIS Stability: http://bugs.php.net/fix.php?id=48190&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=48190&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=48190&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=48190&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=48190&r=mysqlcfg