Bug #77285 [Asn]: Missing REQUEST_METHOD in INPUT_SERVER
Edit report at https://bugs.php.net/bug.php?id=77285&edit=1
ID: 77285
User updated by: m49434s at gmail dot com
Reported by: m49434s at gmail dot com
Summary: Missing REQUEST_METHOD in INPUT_SERVER
Status: Assigned
Type: Bug
Package: Filter related
Operating System: FreeBSD
PHP Version: 7.3.0
Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
Many thanks for looking into this.
Yes, lighttpd 1.4.59 with mod_fastcgi is used
Previous Comments:
------------------------------------------------------------------------
[2021-10-20 14:59:10] cmb@php.net
Thanks for checking and the swift reply!
Are you using FCGI or FPM specifically?
------------------------------------------------------------------------
[2021-10-20 14:44:26] m49434s at gmail dot com
filter_has_var is still reporting false for INPUT_SERVER / REQUEST_METHOD in PHP 7.4.19, although
$_SERVER has it:
PHP version: 7.4.19
filter_has_var: INPUT_SERVER field REQUEST_METHOD does not exist
Array
(
[PATH] => /bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
[PHP_FCGI_CHILDREN] => 2
[PHP_FCGI_MAX_REQUESTS] => 500
[PATH_TRANSLATED] => /usr/local/www
[ORIG_SCRIPT_FILENAME] => /usr/local/www/test.php/
[SSL_CIPHER_ALGKEYSIZE] => 256
[SSL_CIPHER_USEKEYSIZE] => 256
[SSL_CIPHER] => TLS_AES_256_GCM_SHA384
[SSL_PROTOCOL] => TLSv1.3
[HTTP_COOKIE] => <removed>
[HTTP_ACCEPT_LANGUAGE] => en-US,en;q=0.9,de-DE;q=0.8,de;q=0.7,fr;q=0.6
[HTTP_ACCEPT_ENCODING] => gzip, deflate, br
[HTTP_REFERER] => https://192.168.0.44/test.php
[HTTP_SEC_FETCH_DEST] => document
[HTTP_SEC_FETCH_USER] => ?1
[HTTP_SEC_FETCH_MODE] => navigate
[HTTP_SEC_FETCH_SITE] => same-origin
[HTTP_ACCEPT] =>
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
[HTTP_USER_AGENT] => Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/95.0.4638.54 Safari/537.36
[CONTENT_TYPE] => application/x-www-form-urlencoded
[HTTP_DNT] => 1
[HTTP_UPGRADE_INSECURE_REQUESTS] => 1
[HTTP_ORIGIN] => https://192.168.0.44
[HTTP_SEC_CH_UA_PLATFORM] => "Linux"
[HTTP_SEC_CH_UA_MOBILE] => ?0
[HTTP_SEC_CH_UA] => "Google Chrome";v="95",
"Chromium";v="95", ";Not A Brand";v="99"
[HTTP_CACHE_CONTROL] => max-age=0
[HTTP_CONTENT_LENGTH] => 19
[HTTP_HOST] => 192.168.0.44
[REMOTE_PORT] => 55474
[REMOTE_ADDR] => 192.168.0.65
[SERVER_NAME] => 192.168.0.44
[SERVER_ADDR] => 192.168.0.44
[SERVER_PORT] => 443
[HTTPS] => on
[REQUEST_SCHEME] => https
[GATEWAY_INTERFACE] => CGI/1.1
[SERVER_SOFTWARE] => WebGUI
[SERVER_PROTOCOL] => HTTP/2.0
[REQUEST_METHOD] => POST
[DOCUMENT_ROOT] => /usr/local/www
[SCRIPT_FILENAME] => /usr/local/www/test.php
[SCRIPT_NAME] => /test.php
[REDIRECT_STATUS] => 200
[REQUEST_URI] => /test.php
[QUERY_STRING] =>
[CONTENT_LENGTH] => 19
[FCGI_ROLE] => RESPONDER
[PHP_SELF] => /test.php
[REQUEST_TIME_FLOAT] => 1634740929.8279
[REQUEST_TIME] => 1634740929
)
------------------------------------------------------------------------
[2021-10-20 10:24:10] cmb@php.net
I cannot reproduce this with PHP-7.4 and the CGI SAPI. Can
anybody else still reproduce this with any of the actively
supported PHP versions[1]?
[1] <https://www.php.net/supported-versions.php>
------------------------------------------------------------------------
[2018-12-12 13:55:09] ma dot zoon at quicknet dot nl
i can confirm proper working on php 7.2.13 and broken on php 7.3.0.
------------------------------------------------------------------------
[2018-12-11 22:44:19] m49434s at gmail dot com
Description:
------------
With PHP 7.3.0 input validation using filter_input(INPUT_SERVER,'REQUEST_METHOD',...) is
broken because the field 'REQUEST_METHOD' is not mapped. The code is working as expected
in 7.2.x and previous releases.
Test script:
---------------
<?php
if(filter_has_var(INPUT_SERVER,'REQUEST_METHOD')):
echo 'filter_has_var: INPUT_SERVER field REQUEST_METHOD exists',PHP_EOL,PHP_EOL;
else:
echo 'filter_has_var: INPUT_SERVER field REQUEST_METHOD does not exist',PHP_EOL,PHP_EOL;
echo '<pre>';
print_r($_SERVER);
echo '</pre>';
endif;
?>
<form action="test.php" method="post" id="iform"
name="iform">
<input type="text" id="username" name="username"
placeholder="Username" autofocus="autofocus">
<input type="password" id="password" name="password"
placeholder="Password">
<input type="submit" value="Login">
</form>
Expected result:
----------------
The script should display 'filter_has_var: INPUT_SERVER field REQUEST_METHOD exists' after
pressing the login button.
Actual result:
--------------
Script displays 'filter_has_var: INPUT_SERVER field REQUEST_METHOD does not exist'
followed by the content of $_SERVER after pressing the login button.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=77285&edit=1
Thread (8 messages)