[PHP-BUG] Req #68605 [NEW]: $_FILES should not only be filled when POST

From:             lewiscowles at me dot com
Operating system: ALL
PHP version:      Irrelevant
Package:          PHP Language Specification
Bug Type:         Feature/Change Request
Bug description:$_FILES should not only be filled when POST

Description:
------------
basically I am going to have to switch a major part of my app to Python
because I cannot PUT multiple files via CURL custom request. Made worse
by the fact PHP seems to have a bug that cuts off php:/input after the
first file (probably to do with C strings and EOF)

Test script:
---------------
// server receiving data (putEcho.php was used)
<?php $reqMeth = ( isset( $_SERVER['REQUEST_METHOD'] ) ? strtoupper(
$_SERVER['REQUEST_METHOD'] ) : 'GET' ); ?>
<?php
$_PUT = array();
if( $reqMeth == 'PUT' ) {
	$putF = fopen( "php://input", "r" );
	$tmp = fread( $putF, MAX_POST_SIZE*10 ); // limit maximum PUT size to
maximum POST size (seems reasonable)
	fclose($putF);
	$_PUT =  parse_raw_http_request( $tmp );
}
?>
put:
<?php var_dump( $_PUT ); ?>
file:
<?php var_dump( $_FILES ); ?>
<?php
//
// Functions
//
function parse_raw_http_request($input) {
	//var_dump($input);
	$a_data = array();
	// grab multipart boundary from content type header
	$matches = explode( str_ireplace( 'multipart/form-data; boundary=', '',
$_SERVER['CONTENT_TYPE'] ), $input ); //preg_match('/boundary=(.*)$/',
$_SERVER['CONTENT_TYPE'], $matches);
	// content type is probably regular form-encoded
	if (!count($matches)) {
		// we expect regular puts to containt a query string containing data
		parse_str(urldecode($input), $a_data);
		return $a_data;
	}
	$boundary = $matches[0];
	// split content by boundary and get rid of last -- element
	$a_blocks = explode($boundary,$input);//preg_split("/-+$boundary/",
$input);
	//array_pop($a_blocks);
	// loop data blocks
	foreach ($a_blocks as $id => $block) {
		if (empty($block)) { continue; }
		//var_dump( $block );
		// you'll have to var_dump $block to understand this and maybe replace
\n or \r with a visibile char
		// parse uploaded files
		if (mb_strpos($block, 'application/octet-stream') !== FALSE) {
			//var_dump( $block );
			// match "name", then everything after "stream" (optional) except for
prepending newlines
			preg_match("/name=\"([^\"]*)\".*filename=\"([^\"]*)\".*stream[\n|\r]+([^\n\r].*)?$/ms",
$block, $matches);
			$a_data['files'][$matches[1]]['filename'] = basename( $matches[2] );
//for some reason CURL can send files with an absolute path
			$a_data['files'][$matches[1]]['data'] = $matches[3];
		} else { // parse all other fields
			// match "name" and optional value in between newline sequences
			preg_match('/name=\"([^\"]*)\"[\n|\r]+([^\n\r].*)?\r$/su', $block,
$matches);
			$a_data[$matches[1]] = $matches[2];
		}
	}
	return $a_data;
}

// client to send data (name does not matter)
<?php

$data = array(
	'text'=>'bob
    bob
	漢字</textarea>
	ghghg
表外字?
表外字?表外字?',
	'file1' =>	new CURLFile( __DIR__.'/need a second monicle.jpg' ),
	'kanji'=>'漢字表外字?表外字?表外字?',
	'file2' => new CURLFile(
__DIR__.'/10620539_301923573265336_9157682394656180014_n.jpg' )
);
?>
<pre><?php var_dump( json_decode( CURL_REQ(
'http://censored/putEcho.php', 'PUT', $data/*$_POST*/ ), true ) );
?></pre>
<?php
//
// CURL lightweight helper Function...
//
function CURL_REQ( $url, $method, &$data ) {
	$ch = curl_init( $url );
	curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
	curl_setopt( $ch, CURLOPT_CUSTOMREQUEST, $method );
	curl_setopt( $ch, CURLOPT_POSTFIELDS, $data );
	$response = curl_exec( $ch );
	return $response;
}

Expected result:
----------------
I expected (although I think I understand why) to be able to manually
parse the results of my request, even if PHP did not support populating
the $_FILES array...

Basically within 15minutes I was able to get this to work with Python,
but a large part of my system is PHP. I am always telling people PHP is
a great language and developers are part of the problem, but it seems to
me that the decision to not populate $_FILES is a bit mad

for desired outcome, I like how python FLASK is able to give me 
request.args ($_GET)
request.form ($_PUT or $_POST)
request.files ($_FILES)

and wondered if it was something that could be easily patched into PHP.

In any case I have the C code and will try custom compiling, then
patching, but my weekend is now dead, so it may be some time before I
come up with something and after 20mins python working, it might just be
easier for me to convert HTTP methods to python =(

Actual result:
--------------
well in the example given everything after the first file is missing
from php://input stream, so not even the second var gets through... I
can mitigate this by moving the posted form field values easily, but I
never get more than one file, and I am unsure if it is complete (seems
to end if 255 and 0 if I run ord on the last two bytes)

-- 
Edit bug report at https://bugs.php.net/bug.php?id=68605&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=68605&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=68605&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=68605&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=68605&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=68605&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=68605&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=68605&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=68605&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=68605&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=68605&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=68605&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=68605&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=68605&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68605&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=68605&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=68605&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=68605&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=68605&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=68605&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=68605&r=mysqlcfg