[2009-05-08 13:46 UTC] carsten_sttgt at gmx dot de

Description:
------------
Hello,

PHP does not work correctly with POST requests and a Content-Type of MULTIPART/form-data, if the parameter name "BOUNDARY" is in uppercase.

According to RFC2045, matching of media type, subtype and parameter (attributes) is always case-insensitive.

(only the value of the BOUNDARY parameter is compared case-sensitive)

Tested on Windows with 5.2-dev, 5.3-dev and 6.0-dev. CGI and Apache module.

Regards,
Carsten



Reproduce code:
---------------
Put this textfile in your PHP directory:
**************** test.txt ******************
--250-16659-1241787336=:9320
Content-Type: TEXT/plain; CHARSET=iso-8859-1
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-Disposition: form-data; name=nick

php-faq
--250-16659-1241787336=:9320
Content-Type: TEXT/plain; CHARSET=iso-8859-1
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-Disposition: form-data; name=desc

post demo script
--250-16659-1241787336=:9320--
********************************************

Put this phpfile in your PHP directory:
**************** test.php ******************
<?php
var_dump($_POST);
?>
********************************************

Open a command prompt, go to your PHP dir and execute:
# set REQUEST_METHOD=POST
# set REDIRECT_STATUS=1
# set SCRIPT_FILENAME=test.php
# set CONTENT_LENGTH=391
# set CONTENT_TYPE=MULTIPART/form-data; BOUNDARY="250-16659-1241787336=:9320"
# type test.text | php-cgi.exe

if you set CONTENT_TYPE in this way, you have the correct result:
# set CONTENT_TYPE=MULTIPART/form-data; boundary="250-16659-1241787336=:9320"

Regards,
Carsten

BTW:
e.g. the IMAP-Module from PHP is using/generating BOUNDARY in uppercase.


Expected result:
----------------
Content-type: text/html

array(2) {
  ["nick"]=>
  string(7) "php-faq"
  ["desc"]=>
  string(16) "post demo script"
}


Actual result:
--------------
Content-type: text/html

<br />
<b>Warning</b>:  Missing boundary in multipart/form-data POST data in <b>Unknown
</b> on line <b>0</b><br />
array(0) {
}