Skip to content

Commit b5184ef

Browse files
nikicnikic
committed
Remove unsafe curl file uploads
The option CURLOPT_SAFE_UPLOAD still exists, but cannot be disabled.
1 parent c24afc8 commit b5184ef

File tree

7 files changed

+29
-101
lines changed

7 files changed

+29
-101
lines changed

‎NEWS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@
5757

5858
- Curl:
5959
. Fixed bug #68937 (Segfault in curl_multi_exec). (Laruence)
60+
. Removed support for unsafe file uploads. (Nikita)
6061

6162
- Date:
6263
. Fixed day_of_week function as it could sometimes return negative values

‎UPGRADING‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -345,6 +345,10 @@ Standard library changes
345345
Other
346346
=====
347347

348+
- Curl:
349+
. Removed support for disabling the CURLOPT_SAFE_UPLOAD option. All curl file
350+
uploads must use the curl_file / CURLFile APIs.
351+
348352
- Date:
349353
. Removed $is_dst parameter from mktime() and gmmktime().
350354

‎ext/curl/interface.c‎

Lines changed: 10 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1747,7 +1747,6 @@ static php_curl *alloc_curl_handle()
17471747

17481748
zend_llist_init(&ch->to_free->str, sizeof(char *), (llist_dtor_func_t)curl_free_string, 0);
17491749
zend_llist_init(&ch->to_free->post, sizeof(struct HttpPost), (llist_dtor_func_t)curl_free_post, 0);
1750-
ch->safe_upload = 1; /* for now, for BC reason we allow unsafe API */
17511750

17521751
ch->to_free->slist = emalloc(sizeof(HashTable));
17531752
zend_hash_init(ch->to_free->slist, 4, NULL, curl_free_slist, 0);
@@ -2181,7 +2180,10 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
21812180
break;
21822181
case CURLOPT_SAFE_UPLOAD:
21832182
lval = zval_get_long(zvalue);
2184-
ch->safe_upload = (lval != 0);
2183+
if (lval == 0) {
2184+
php_error_docref(NULL, E_WARNING, "Disabling safe uploads is no longer supported");
2185+
return FAILURE;
2186+
}
21852187
break;
21862188

21872189
/* String options */
@@ -2558,43 +2560,12 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
25582560
/* The arguments after _NAMELENGTH and _CONTENTSLENGTH
25592561
* must be explicitly cast to long in curl_formadd
25602562
* use since curl needs a long not an int. */
2561-
if (!ch->safe_upload && *postval == '@') {
2562-
char *name, *type, *filename;
2563-
++postval;
2564-
2565-
php_error_docref("curl.curlfile", E_DEPRECATED,
2566-
"The usage of the @filename API for file uploading is deprecated. Please use the CURLFile class instead");
2567-
2568-
name = estrndup(postval, Z_STRLEN_P(current));
2569-
if ((type = (char *)php_memnstr(name, ";type=", sizeof(";type=") - 1,
2570-
name + Z_STRLEN_P(current)))) {
2571-
*type = '\0';
2572-
}
2573-
if ((filename = (char *)php_memnstr(name, ";filename=", sizeof(";filename=") - 1,
2574-
name + Z_STRLEN_P(current)))) {
2575-
*filename = '\0';
2576-
}
2577-
/* open_basedir check */
2578-
if (php_check_open_basedir(name)) {
2579-
efree(name);
2580-
return FAILURE;
2581-
}
2582-
error = curl_formadd(&first, &last,
2583-
CURLFORM_COPYNAME, string_key->val,
2584-
CURLFORM_NAMELENGTH, string_key->len,
2585-
CURLFORM_FILENAME, filename ? filename + sizeof(";filename=") - 1 : name,
2586-
CURLFORM_CONTENTTYPE, type ? type + sizeof(";type=") - 1 : "application/octet-stream",
2587-
CURLFORM_FILE, name,
2588-
CURLFORM_END);
2589-
efree(name);
2590-
} else {
2591-
error = curl_formadd(&first, &last,
2592-
CURLFORM_COPYNAME, string_key->val,
2593-
CURLFORM_NAMELENGTH, (zend_long)string_key->len,
2594-
CURLFORM_COPYCONTENTS, postval,
2595-
CURLFORM_CONTENTSLENGTH, (zend_long)Z_STRLEN_P(current),
2596-
CURLFORM_END);
2597-
}
2563+
error = curl_formadd(&first, &last,
2564+
CURLFORM_COPYNAME, string_key->val,
2565+
CURLFORM_NAMELENGTH, (zend_long)string_key->len,
2566+
CURLFORM_COPYCONTENTS, postval,
2567+
CURLFORM_CONTENTSLENGTH, (zend_long)Z_STRLEN_P(current),
2568+
CURLFORM_END);
25982569

25992570
zend_string_release(string_key);
26002571
} ZEND_HASH_FOREACH_END();

‎ext/curl/php_curl.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,6 @@ typedef struct {
179179
zend_resource *res;
180180
zend_bool in_callback;
181181
uint32_t clone;
182-
zend_bool safe_upload;
183182
} php_curl;
184183

185184
#define CURLOPT_SAFE_UPLOAD -1

‎ext/curl/tests/bug27023.phpt‎

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -3,36 +3,34 @@ Bug #27023 (CURLOPT_POSTFIELDS does not parse content types for files)
33
--INI--
44
error_reporting = E_ALL & ~E_DEPRECATED
55
--SKIPIF--
6-
<?php
7-
include 'skipif.inc';
8-
?>
6+
<?php include 'skipif.inc'; ?>
97
--FILE--
108
<?php
119

12-
include 'server.inc';
13-
$host = curl_cli_server_start();
10+
include 'server.inc';
11+
$host = curl_cli_server_start();
1412
$ch = curl_init();
15-
curl_setopt($ch, CURLOPT_SAFE_UPLOAD, 0);
13+
curl_setopt($ch, CURLOPT_SAFE_UPLOAD, 1);
1614
curl_setopt($ch, CURLOPT_URL, "{$host}/get.php?test=file");
1715
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
1816

19-
$params = array('file' => '@' . __DIR__ . '/curl_testdata1.txt');
17+
$file = curl_file_create(__DIR__ . '/curl_testdata1.txt');
18+
$params = array('file' => $file);
2019
curl_setopt($ch, CURLOPT_POSTFIELDS, $params);
2120
var_dump(curl_exec($ch));
2221

23-
$params = array('file' => '@' . __DIR__ . '/curl_testdata1.txt;type=text/plain');
22+
$file = curl_file_create(__DIR__ . '/curl_testdata1.txt', "text/plain");
23+
$params = array('file' => $file);
2424
curl_setopt($ch, CURLOPT_POSTFIELDS, $params);
2525
var_dump(curl_exec($ch));
2626

27-
$params = array('file' => '@' . __DIR__ . '/curl_testdata1.txt;filename=foo.txt');
27+
$file = curl_file_create(__DIR__ . '/curl_testdata1.txt', null, "foo.txt");
28+
$params = array('file' => $file);
2829
curl_setopt($ch, CURLOPT_POSTFIELDS, $params);
2930
var_dump(curl_exec($ch));
3031

31-
$params = array('file' => '@' . __DIR__ . '/curl_testdata1.txt;type=text/plain;filename=foo.txt');
32-
curl_setopt($ch, CURLOPT_POSTFIELDS, $params);
33-
var_dump(curl_exec($ch));
34-
35-
$params = array('file' => '@' . __DIR__ . '/curl_testdata1.txt;filename=foo.txt;type=text/plain');
32+
$file = curl_file_create(__DIR__ . '/curl_testdata1.txt', "text/plain", "foo.txt");
33+
$params = array('file' => $file);
3634
curl_setopt($ch, CURLOPT_POSTFIELDS, $params);
3735
var_dump(curl_exec($ch));
3836

@@ -44,4 +42,3 @@ string(%d) "curl_testdata1.txt|application/octet-stream"
4442
string(%d) "curl_testdata1.txt|text/plain"
4543
string(%d) "foo.txt|application/octet-stream"
4644
string(%d) "foo.txt|text/plain"
47-
string(%d) "foo.txt|text/plain"

‎ext/curl/tests/bug27023_2.phpt‎

Lines changed: 0 additions & 44 deletions
This file was deleted.

‎ext/curl/tests/curl_file_upload.phpt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,8 +71,8 @@ string(%d) "curl_testdata1.txt|text/plain"
7171
string(%d) "foo.txt"
7272
string(%d) "foo.txt|application/octet-stream"
7373

74-
Deprecated: curl_setopt(): The usage of the @filename API for file uploading is deprecated. Please use the CURLFile class instead in %s on line %d
75-
string(%d) "curl_testdata1.txt|application/octet-stream"
74+
Warning: curl_setopt(): Disabling safe uploads is no longer supported in %s on line %d
75+
string(0) ""
7676
string(0) ""
7777
string(%d) "array(1) {
7878
["file"]=>

0 commit comments

Comments
 (0)