Bug #75741 [Com]: enable_post_data_reading not working on PHP-FPM

Edit report at https://bugs.php.net/bug.php?id=75741&edit=1 ID: 75741 Comment by: adelin at mcbsoft dot com Reported by: manhiro at gmail dot com Summary: enable_post_data_reading not working on PHP-FPM Status: Assigned Type: Bug Package: FPM related Operating System: CentOS 6.7 PHP Version: 7.1.12 Assigned To: bukka Block user comment: N Private report: N New Comment: I confirm the same behavior, by setting the value in a different manner (and using nginx webserver). I've tried to set "enable_post_data_reading" to "Off" value on a specific path, using a dedicated "ini" conf file, by using the [PATH=/path/to/dir] directive. phpinfo() reports that "enable_post_data_reading" is indeed "Off" for the local value (which is within the specified path), however when I try to submit form with POST data, var_dump($_POST) still prints the POST fields, though it shouldn't. When I set the master value to Off from the main php.ini, it works accordingly, $_POST fields aren't populated anymore. Tested with v5.6, v7.1, v7.3 - all of them have this issue. Hope it helps. Thanks, Best, A. Previous Comments: ------------------------------------------------------------------------ [2018-01-21 22:29:49] bukka@php.net Ok, changing status back to Open. Will take a look later. ------------------------------------------------------------------------ [2018-01-21 01:20:03] manhiro at gmail dot com I tried on php7.2.1. However, it didn't work. Test script: --------------- //test.html <html> <head> <title>test</title> </head> <body> <form action="upload.php" method="POST" enctype="multipart/form-data"> <input type="file" name="test" /><br> <input type="submit" /> </form> </body> </html> //upload.php <?php var_dump($_FILES); //.user.ini enable_post_data_reading = Off upload_max_filesize = 10M phpinfo result: ---------------- Local Value | Master Value ---------------------------- Off | On Expected result: ---------------- array(0) { } Actual result: -------------- array(1) { ["test"]=> array(5) { ["name"]=> string(21) "test.mp4" ["type"]=> string(9) "video/mp4" ["tmp_name"]=> string(14) "/tmp/php9fldnI" ["error"]=> int(0) ["size"]=> int(5230167) } } ------------------------------------------------------------------------ [2018-01-19 14:44:21] bukka@php.net I think this should be already changed in 7.2. It was the way how FPM handled user.ini before 7.2 so the fix didn't go to the bug fixing release (preventing some relaxing of the rules). The fix was this one: https://github.com/php/php-src/commit/cfc6c4d2973c795cb400435a28805a73c02d23e2 As it was already reported in https://bugs.php.net/bug.php?id=75212 I will close this as a duplicate. If it didn't fixed your issue (if this issue is still present in 7.2), please let me know (comment on this) and I will take a look. ------------------------------------------------------------------------ [2017-12-28 01:22:01] manhiro at gmail dot com Description: ------------ Apache 2.4.6 PHP 7.1.12 I'm trying to manually parse multipart form data on PHP-FPM. When I set the 'enable_post_data_reading = Off' in php.ini file, I can get raw post data. Example: $handle = fopen("php://input", "rb"); while (!feof($handle)) { // do something } However, when I set that in .user.ini file, I can't get raw post data. I think that the .user.ini file is correct because phpinfo() shows as bellow. Local Value | Master Value ---------------------------- Off | On Note: sapi_activate() in the file main/SAPI.c: ---------------------------- /* Handle request method */ if (SG(server_context)) { if (PG(enable_post_data_reading) && SG(request_info).content_type && SG(request_info).request_method && !strcmp(SG(request_info).request_method, "POST")) { /* HTTP POST may contain form data to be processed into variables * depending on given content type */ sapi_read_post_data(); } else { SG(request_info).content_type_dup = NULL; } /* Cookies */ SG(request_info).cookie_data = sapi_module.read_cookies(); } if (sapi_module.activate) { sapi_module.activate(); } if (sapi_module.input_filter_init) { sapi_module.input_filter_init(); } ---------------------------- I guess that the above code to handle request method is executed before loading .user.ini file. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=75741&edit=1