Bug #61471 [ReO->Csd]: Incomplete POST does not timeout but is passed to PHP
Edit report at https://bugs.php.net/bug.php?id=61471&edit=1
ID: 61471
Updated by: nikic@php.net
Reported by: jakub dot lopuszanski at nasza-klasa dot pl
Summary: Incomplete POST does not timeout but is passed to
PHP
-Status: Re-Opened
+Status: Closed
Type: Bug
Package: Apache2 related
Operating System: linux
PHP Version: Irrelevant
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of z-shao@colopl.co.jp
Revision: http://git.php.net/?p=php-src.git;a=commit;h=80c8d84af303d2fddc9ba9f181c7117b9040811d
Log: Fixed bug #61471
Previous Comments:
------------------------------------------------------------------------
[2017-01-05 13:06:13] ab@php.net
The patch was reverted due to issues, see https://github.com/php/php-src/pull/2180 .
Reopening.
Thanks.
------------------------------------------------------------------------
[2016-12-29 07:56:55] laruence@php.net
Automatic comment on behalf of z-shao@colopl.co.jp
Revision: http://git.php.net/?p=php-src.git;a=commit;h=9b65a10256e244a6d80027c943b163dd1643abe2
Log: bug fixed #61471 in apache2handler
------------------------------------------------------------------------
[2012-03-22 08:02:04] jakub dot lopuszanski at nasza-klasa dot pl
Description:
------------
When a user has a really slow connection (we experienced the problem with POSTs
longer than single TCP/IP frame) it may happen, that in expected amount of time
the number of POST body bytes transmited is less than announced in Content-Length
header.
It seems, that even with the mod_reqtimeout installed and configured, apache2
happilly passes the request to PHP interpreter, with $_POST set to an empty array.
It does so if the reqeusted page is a PHP script, which is inconsistent with the
way a static HTML file is handled (400 Bad Request).
Test script:
---------------
I assume you have a script with var_dump($_POST) on the server.
Please note how 1755 is much greater than "foo=bar" length
netcat localhost 80
POST / HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 1755
foo=bar
Expected result:
----------------
408 Request Timeout
or
504 Gateway Timeout
or
400 Bad Request
or in the worst case
200 OK
array(1){
"foo" => "bar"
}
Actual result:
--------------
200 OK
array(0){
}
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=61471&edit=1
Thread (3 messages)