-
Notifications
You must be signed in to change notification settings - Fork 8k
Description
Description
The following scenario
I have a POST comment form field with name, email, url, replyTo, comment, and additional Captcha + 2 checkboxes, 2 hidden inputs, and the submit button. No more than 11 values to send.
Recently, I noticed that the POST data is incomplete and always missing the name and email values, even though they were definitely sent individually or as a pair.
Neither PHP global $_POST nor the internally used $serendipity[‘POST’] show these two values set.
They are also not in $_COOKIE. BUT they are present in $_REQUEST[‘serendipity’]. A previous output of $rawdata = file_get_contents(‘php://input’); shows them as given.
I have been testing PHP 8.5 since the summer, but as I can now see, I have the same phenomenon on PHP 8.4 (.13/.15) as well.
The whole thing is on my local development server with Apache SAPI (TS).
I recently had to switch to WIN 11 and have been aware of this behavior since then. Can this play a role?
I have reviewed all my commits in this regard to see if I accidentally reset POST data name and email somewhere, but could not find anything.
I have read “Apache: Fixed bug GH-9949 (Partial content on incomplete POST request)” from PHP 8.2.1 as well as https://stackoverflow.com/questions/5077969/ php-some-post-values-missing-but-are-present-in-php-input. The result remains the same.
I cannot determine where this content loss is coming from.
How can they be present in the REQUEST if they are not in GET, POST, or COOKIE?
At this point, I can only assume that somewhere during the internal PHP transfer from ‘php://input’ to the global POST array, the two get lost. It remains a mystery for me why only these two values.
Tested with
Array
(
[url] => http://example.org
[comment] => <p>test test with raw post data to POST
[name] => nuschel
[email] => nu@example.org
[subscribe] => on
[parent_id] => 0)for manually filled fields, as well as
Array
(
[entry_id] => 10
[name] =>
[email] =>
[url] => http://example.org
[replyTo] => 0
[comment] => <p>test with full house and Notify me when these comments are updated</p>
[token] => d3fac723205aad2a
[captcha] => 37t
[subscribe] => on
[submit] => Submit comment)for the entire POST Array (which shows them nuked)
My current workaround is
if (!empty($serendipity['POST']['submit']) && !isset($_REQUEST['serendipity']['csuccess'])) {
$comment['url'] = $serendipity['POST']['url'];
$comment['comment'] = trim((string)$serendipity['POST']['comment']);
$comment['name'] = $serendipity['POST']['name'] ?? $_REQUEST['serendipity']['name']; // simplest approach to register incomplete POST requests for name
$comment['email'] = $serendipity['POST']['email'] ?? $_REQUEST['serendipity']['email']; // simplest approach to register incomplete POST requests for email
$comment['subscribe'] = $serendipity['POST']['subscribe'] ?? null;
$comment['parent_id'] = $serendipity['POST']['replyTo'];
…
print_r($comment); die();which gives the first array output above.
This works ... but is dirty.
Can someone please shed some light on this ?? !!
Thank you
PHP Version
PHP 5 and PHP 4 latest versions
Operating System
No response