ID: 18792
User updated by: t.bubeck@reinform.de
Reported By: t.bubeck@reinform.de
-Status: Feedback
+Status: Open
Bug Type: HTTP related
Operating System: Red Hat 7.1
PHP Version: 4.2.2
New Comment:
I think that rfc2616, Section 2.2 is important:
Many HTTP/1.1 header field values consist of words separated by LWS
or special characters. These special characters MUST be in a
quoted
string to be used within a parameter value (as defined in section
3.6). token = 1*<any CHAR except CTLs or
separators>
separators = "(" | ")" | "<" | ">" |
"@"
| "," | ";" | ":" | "\" |
<">
| "/" | "[" | "]" | "?" |
"="
| "{" | "}" | SP | HT
In any case you have to remember, that strings could be quoted by '"',
so that it is not enought to terminate the boundary after the next ","
(as my patch did). To be fully correct, you should be able to deal with
something like that:
boundary="XXX\"", param=value.
However, it may be enough to check for "," and ";":
This is the regular expression used by perl's CGI.pm:
my($boundary) = $ENV{'CONTENT_TYPE'} =~ /boundary=\"?([^\";,]+)\"?/;
It ends a boundary after ";" or ",". My patch only terminates the
boundary string after ",". It may be better to also use ";" together
with ",".
Previous Comments:
------------------------------------------------------------------------
[2002-08-16 14:32:00] kalowsky@php.net
Okay, it must be a Netscape proxy thing, as I cannot reproduce it here
(found an old MSIE 5.0). My only issue with your patch is my
understanding of the RFC says that the boundry end can be any character
(correct me if I'm wrong) not just a ".".
Think your patch can be adapted to support this? Determined by the, oh
say, the end of the Content-Type header maybe?
------------------------------------------------------------------------
[2002-08-16 14:24:29] t.bubeck@reinform.de
I'm not able to check the bug with IE 5.5 or 6.0, because I'm not able
to install this software. The bug
occurs from within a corporate network, where software installation is
not possible.
Apart from that, I'm not sure, if _you_ would have been able to
reproduce the bug, because it seems to be a
mix between IE and Netscape Proxy, which shows the bug.
------------------------------------------------------------------------
[2002-08-16 14:21:43] t.bubeck@reinform.de
Here is the HTML page containing the form to send. It is part of
"message compose" of SquirrelMail 1.2.7 and
is generated by PHP. Do you need the PHP source, too?
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<LINK REL="stylesheet" TYPE="text/css"
HREF="/squirrel/themes/css/sans-10.css">
<title>Squirrelmail</title><script language="JavaScript"
type="text/javascript">
<!--
function checkForm() {
var f = document.forms.length;
var i = 0;
var pos = -1;
while( pos == -1 && i < f ) {
var e = document.forms[i].elements.length;
var j = 0;
while( pos == -1 && j < e ) {
if ( document.forms[i].elements[j].type == 'text' ) {
pos = j;
}
j++;
}
i++;
}
if( pos >= 0 ) {
document.forms[i-1].elements[pos].focus();
}
}
// -->
</script>
</head>
<BODY TEXT="#841722" BGCOLOR="#FFFFFF" LINK="#c6204a"
VLINK="#c6204a"
ALINK="#c6204a" onLoad="checkForm();">
<A NAME=pagetop></A>
<TABLE BGCOLOR="#FFFFFF" BORDER=0 WIDTH="100%" CELLSPACING=0
CELLPADDING=2>
<TR BGCOLOR="#fad6b6" >
<TD ALIGN=left>
Aktueller Ordner: <B>inbox </B>
</TD>
<TD ALIGN=right><b><a href="/squirrel/src/signout.php"
target="_top">Abmelden</a></b></TD>
</TR>
<TR BGCOLOR="#FFFFFF">
<TD ALIGN=left>
<a href="/squirrel/src/compose.php?mailbox=%23mh%2Finbox"
target="right">Mail schreiben</a>
<a href="/squirrel/src/addressbook.php"
target="right">Adressen</a>
<a href="/squirrel/src/folders.php"
target="right">Ordner</a>
<a href="/squirrel/src/options.php"
target="right">Optionen</a>
<a href="/squirrel/src/search.php?mailbox=%23mh%2Finbox"
target="right">Suchen</a>
<a href="/squirrel/src/help.php"
target="right">Hilfe</a>
</TD>
<TD ALIGN="right"><A HREF="http://www.squirrelmail.org/"
TARGET="_blank">SquirrelMail</A></TD>
</TR>
</TABLE>
<FORM name=compose action="compose.php" METHOD=POST
ENCTYPE="multipart/form-data">
<input type="hidden" name="session" value="1">
<TABLE WIDTH="100%" ALIGN=center CELLSPACING=0 BORDER=0>
<TR>
<TD BGCOLOR="#FFFFFF" WIDTH="10%" ALIGN=RIGHT>
An: </TD><TD BGCOLOR="#FFFFFF" WIDTH="90%">
<INPUT TYPE=text NAME="send_to" VALUE="" SIZE=60><BR>
</TD>
</TR>
<TR>
<TD BGCOLOR="#FFFFFF" ALIGN=RIGHT>
CC: </TD><TD BGCOLOR="#FFFFFF" ALIGN=LEFT>
<INPUT TYPE=text NAME="send_to_cc" SIZE=60 VALUE=""><BR>
</TD>
</TR>
<TR>
<TD BGCOLOR="#FFFFFF" ALIGN=RIGHT>
BCC: </TD><TD BGCOLOR="#FFFFFF" ALIGN=LEFT>
<INPUT TYPE=text NAME="send_to_bcc" VALUE="" SIZE=60><BR>
</TD></TR>
<TR>
<TD BGCOLOR="#FFFFFF" ALIGN=RIGHT>
Betreff: </TD><TD BGCOLOR="#FFFFFF" ALIGN=LEFT>
<INPUT TYPE=text NAME=subject SIZE=60 VALUE=""></td></tr>
<TR><TD>
</TD><TD>
Priorität: <select name="mailprio"><option
value="1">Hoch</option><option value="3"
selected>Normal</option><option
selected>value="5">Niedrig</option></select>
Receipt: <input type="checkbox" name="request_mdn" value=1>On read
<input type="checkbox"
name="request_dr" value=1>On Delivery <TR><td>
</td><td>
<INPUT TYPE=SUBMIT NAME="sigappend" VALUE="Signatur">
<input type=submit name="html_addr_search" value="Adressen">
<INPUT TYPE=SUBMIT NAME=send VALUE="Senden">
<input type="submit" name ="draft" value="Entwurf speichern">
<script type="text/javascript">
<!--
document.write("<input type=\"button\" value=\"Rechtschreibprüfung\"
onclick=\"window.open('../plugins/squirrelspell/sqspell_interface.php',
'sqspell',
'status=yes,width=550,height=370,resizable=yes')\">");
//-->
</script>
</TD></TR>
<TR>
<TD BGCOLOR="#FFFFFF" COLSPAN=2>
<TEXTAREA NAME=body ROWS=20 COLS="76"
WRAP="VIRTUAL">
+-------+-------------------------------------------------------------+
| | dr. tilmann bubeck reinform medien- und |
| | informationstechnologie AG |
| rein | fon : +49 (711) 7 82 76-52 koenigstrasse 80 |
| form | fax : +49 (711) 7 82 76-46 70173 stuttgart / germany |
| AG | cell.: +49 (172) 8 84 29 72 fon: +49 (711) 7 82 76-50 |
| | email: t.bubeck@reinform.de http://www.reinform.de |
+-------+-------------------------------------------------------------+
</TEXTAREA><BR>
</TD>
</TR>
<TR><TD COLSPAN=2 ALIGN=LEFT> <INPUT TYPE=SUBMIT NAME=send
VALUE="Senden"></TD></TR>
<TR>
<TD VALIGN=MIDDLE ALIGN=RIGHT>
Anhang: </TD>
<TD VALIGN=MIDDLE ALIGN=LEFT>
<INPUT NAME="attachfile" SIZE=48 TYPE="file">
<input type="submit" name="attach"
value="Hinzufügen">
</TD>
</TR>
</TABLE>
<INPUT TYPE=hidden NAME=mailbox VALUE="#mh/inbox">
</FORM></BODY></HTML>
------------------------------------------------------------------------
[2002-08-16 13:12:30] kalowsky@php.net
more importantly, does this happen with the newer versions of MSIE
(5.5, or 6.0)?
------------------------------------------------------------------------
[2002-08-16 13:09:33] ilia@prohost.org
Could you please provide a sample page or source code to the form that
would allow us to replicate the problem?
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
http://bugs.php.net/18792
--
Edit this bug report at http://bugs.php.net/?id=18792&edit=1