Bug #60788 [Com]: Curl file upload send bogus data to lighttpd web server
Edit report at https://bugs.php.net/bug.php?id=60788edit=1 ID: 60788 Comment by: valentin_grigoras at yahoo dot com Reported by:valentin_grigoras at yahoo dot com Summary:Curl file upload send bogus data to lighttpd web server Status: Bogus Type: Bug Package:cURL related Operating System: Linux/Windows PHP Version:5.3.9 Block user comment: N Private report: N New Comment: I don't see how it is a curl issue, since if I do the upload from command line, it works as expected, including from the servers with PHP 5.3.9: curl -F myfile=@/tmp/test_remote.txt http://xx.xx.xx.xx/cgi-bin/test.sh; --header Expect: /tmp/response.txt When I try attached code from PHP 5.3.x the file is sent to Lighttpd server so upload actually works (I assume this is correct part from your answer) but the server variables are not correct and filename is not received properly. it is wrong in the sense that a receiver should not assume otherwise I'm not sure how to interpret this, since I attached environment variables to see that POST_myfile_name=/tmp/test_remote.txt (sender full path) instead of POST_myfile_name=test_remote.txt (the name of uploaded file). Previous Comments: [2012-01-18 17:11:36] paj...@php.net It is not something PHP is responsible for, but here is the comment from the cURL project lead: it is correct in the sense that libcurl will use the path name specified to it. it is wrong in the sense that a receiver should not assume otherwise If you still consider that this should be different, please discuss this issue in the cURL tracker or on their mailing list. [2012-01-18 11:48:12] valentin_grigoras at yahoo dot com Description: Curl file upload fail when destination server was Lighttpd because received data is altered (POST variable FORM_file_name is set to original path of the uploaded file instead of actual file name). Destination server has lighttpd/1.4.29 Test servers had PHP 5.2.4, 5.3.2 (ubuntu 5.14) and 5.3.8 (Windows). Last one was updated to 5.3.9 Following code works on PHP 5.2.x and worked on older versions of PHP, but does not work on any 5.3.x versions. Same code was tested against Apache web server and it worked. Test script: --- ?php $url_post['myfile']='@/tmp/test_remote.txt'; $myHeaders=array( Expect: ); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, http://xx.xx.xx.xx/cgi-bin/test.sh;); curl_setopt($ch, CURLOPT_PORT, 80); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HTTPHEADER, $myHeaders); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_POSTFIELDS, $url_post); $curl_reponse=curl_exec($ch); echo 'Response: '.$curl_reponse; ? Expected result: CONTENT_TYPE=multipart/form-data; boundary=0de142dacc53 GATEWAY_INTERFACE=CGI/1.1 HASERL_SHELL=/bin/sh HASERLVER=0.9.27 REMOTE_ADDR=xx.xx.xx.xx POST_myfile=/tmp/m1fafJ HASERL_UPLOAD_DIR=/tmp DOCUMENT_ROOT=/www/ REMOTE_PORT=47209 HTTP_ACCEPT=*/* CONTENT_LENGTH=195 POST_myfile_name=test_remote.txt HASERL_UPLOAD_LIMIT=1000 SCRIPT_FILENAME=/www/cgi-bin/test.sh HTTP_HOST=xx.xx.xx.xx REQUEST_URI=/cgi-bin/test.sh HASERL_myfile_path=/tmp/m1fafJ SERVER_SOFTWARE=lighttpd/1.4.29 HASERL_ACCEPT_ALL=0 FORM_myfile=/tmp/m1fafJ SERVER_PROTOCOL=HTTP/1.1 SESSIONID=6c004f16ab26 REDIRECT_STATUS=200 FORM_myfile_name=test_remote.txt REQUEST_METHOD=POST SERVER_ADDR=0.0.0.0 PWD=/www/cgi-bin/cmh SERVER_PORT=80 SCRIPT_NAME=/cgi-bin/test.sh HTTP_CONTENT_LENGTH=195 SERVER_NAME=xx.xx.xx.xx Actual result: -- CONTENT_TYPE=multipart/form-data; boundary=bc7136747ad5 GATEWAY_INTERFACE=CGI/1.1 HASERL_SHELL=/bin/sh HASERLVER=0.9.27 REMOTE_ADDR=xx.xx.xx.xx POST_myfile=/tmp/Y9JqDF HASERL_UPLOAD_DIR=/tmp DOCUMENT_ROOT=/www/ REMOTE_PORT=52983 HTTP_ACCEPT=*/* CONTENT_LENGTH=10790 POST_myfile_name=/tmp/test_remote.txt HASERL_UPLOAD_LIMIT=1000 SCRIPT_FILENAME=/www/cgi-bin/test.sh HTTP_HOST=xx.xx.xx.xx REQUEST_URI=/cgi-bin/test.sh HASERL_myfile_path=/tmp/Y9JqDF SERVER_SOFTWARE=lighttpd/1.4.29 HASERL_ACCEPT_ALL=0 FORM_myfile=/tmp/Y9JqDF SERVER_PROTOCOL=HTTP/1.1 SESSIONID=6aa54f16ab0a REDIRECT_STATUS=200 FORM_myfile_name=/tmp/test_remote.txt REQUEST_METHOD=POST SERVER_ADDR=0.0.0.0 PWD=/www/cgi-bin SERVER_PORT=80 SCRIPT_NAME=/cgi-bin/test.sh HTTP_CONTENT_LENGTH=10790 SERVER_NAME=192.168.8.30 -- Edit this bug report at https://bugs.php.net/bug.php?id=60788edit=1
[PHP-BUG] Bug #60788 [NEW]: Curl file upload send bogus data to lighttpd web server
From: Operating system: Linux/Windows PHP version: 5.3.9 Package: cURL related Bug Type: Bug Bug description:Curl file upload send bogus data to lighttpd web server Description: Curl file upload fail when destination server was Lighttpd because received data is altered (POST variable FORM_file_name is set to original path of the uploaded file instead of actual file name). Destination server has lighttpd/1.4.29 Test servers had PHP 5.2.4, 5.3.2 (ubuntu 5.14) and 5.3.8 (Windows). Last one was updated to 5.3.9 Following code works on PHP 5.2.x and worked on older versions of PHP, but does not work on any 5.3.x versions. Same code was tested against Apache web server and it worked. Test script: --- ?php $url_post['myfile']='@/tmp/test_remote.txt'; $myHeaders=array( Expect: ); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, http://xx.xx.xx.xx/cgi-bin/test.sh;); curl_setopt($ch, CURLOPT_PORT, 80); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HTTPHEADER, $myHeaders); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_POSTFIELDS, $url_post); $curl_reponse=curl_exec($ch); echo 'Response: '.$curl_reponse; ? Expected result: CONTENT_TYPE=multipart/form-data; boundary=0de142dacc53 GATEWAY_INTERFACE=CGI/1.1 HASERL_SHELL=/bin/sh HASERLVER=0.9.27 REMOTE_ADDR=xx.xx.xx.xx POST_myfile=/tmp/m1fafJ HASERL_UPLOAD_DIR=/tmp DOCUMENT_ROOT=/www/ REMOTE_PORT=47209 HTTP_ACCEPT=*/* CONTENT_LENGTH=195 POST_myfile_name=test_remote.txt HASERL_UPLOAD_LIMIT=1000 SCRIPT_FILENAME=/www/cgi-bin/test.sh HTTP_HOST=xx.xx.xx.xx REQUEST_URI=/cgi-bin/test.sh HASERL_myfile_path=/tmp/m1fafJ SERVER_SOFTWARE=lighttpd/1.4.29 HASERL_ACCEPT_ALL=0 FORM_myfile=/tmp/m1fafJ SERVER_PROTOCOL=HTTP/1.1 SESSIONID=6c004f16ab26 REDIRECT_STATUS=200 FORM_myfile_name=test_remote.txt REQUEST_METHOD=POST SERVER_ADDR=0.0.0.0 PWD=/www/cgi-bin/cmh SERVER_PORT=80 SCRIPT_NAME=/cgi-bin/test.sh HTTP_CONTENT_LENGTH=195 SERVER_NAME=xx.xx.xx.xx Actual result: -- CONTENT_TYPE=multipart/form-data; boundary=bc7136747ad5 GATEWAY_INTERFACE=CGI/1.1 HASERL_SHELL=/bin/sh HASERLVER=0.9.27 REMOTE_ADDR=xx.xx.xx.xx POST_myfile=/tmp/Y9JqDF HASERL_UPLOAD_DIR=/tmp DOCUMENT_ROOT=/www/ REMOTE_PORT=52983 HTTP_ACCEPT=*/* CONTENT_LENGTH=10790 POST_myfile_name=/tmp/test_remote.txt HASERL_UPLOAD_LIMIT=1000 SCRIPT_FILENAME=/www/cgi-bin/test.sh HTTP_HOST=xx.xx.xx.xx REQUEST_URI=/cgi-bin/test.sh HASERL_myfile_path=/tmp/Y9JqDF SERVER_SOFTWARE=lighttpd/1.4.29 HASERL_ACCEPT_ALL=0 FORM_myfile=/tmp/Y9JqDF SERVER_PROTOCOL=HTTP/1.1 SESSIONID=6aa54f16ab0a REDIRECT_STATUS=200 FORM_myfile_name=/tmp/test_remote.txt REQUEST_METHOD=POST SERVER_ADDR=0.0.0.0 PWD=/www/cgi-bin SERVER_PORT=80 SCRIPT_NAME=/cgi-bin/test.sh HTTP_CONTENT_LENGTH=10790 SERVER_NAME=192.168.8.30 -- Edit bug report at https://bugs.php.net/bug.php?id=60788edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=60788r=trysnapshot54 Try a snapshot (PHP 5.3): https://bugs.php.net/fix.php?id=60788r=trysnapshot53 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=60788r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=60788r=fixed Fixed in SVN and need be documented: https://bugs.php.net/fix.php?id=60788r=needdocs Fixed in release: https://bugs.php.net/fix.php?id=60788r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=60788r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=60788r=needscript Try newer version: https://bugs.php.net/fix.php?id=60788r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=60788r=support Expected behavior: https://bugs.php.net/fix.php?id=60788r=notwrong Not enough info: https://bugs.php.net/fix.php?id=60788r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=60788r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=60788r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=60788r=php4 Daylight Savings:https://bugs.php.net/fix.php?id=60788r=dst IIS Stability: https://bugs.php.net/fix.php?id=60788r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=60788r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=60788r=float No Zend Extensions: https://bugs.php.net/fix.php?id=60788r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=60788r=mysqlcfg
