![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to rfc1867.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / php / main|
Return to rfc1867.c CVS log | Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / php / main |
1.1 misho 1: /*
2: +----------------------------------------------------------------------+
3: | PHP Version 5 |
4: +----------------------------------------------------------------------+
5: | Copyright (c) 1997-2012 The PHP Group |
6: +----------------------------------------------------------------------+
7: | This source file is subject to version 3.01 of the PHP license, |
8: | that is bundled with this package in the file LICENSE, and is |
9: | available through the world-wide-web at the following url: |
10: | http://www.php.net/license/3_01.txt |
11: | If you did not receive a copy of the PHP license and are unable to |
12: | obtain it through the world-wide-web, please send a note to |
13: | license@php.net so we can mail you a copy immediately. |
14: +----------------------------------------------------------------------+
15: | Authors: Rasmus Lerdorf <rasmus@php.net> |
16: | Jani Taskinen <jani@php.net> |
17: +----------------------------------------------------------------------+
18: */
19:
20: /* $Id: rfc1867.c 321634 2012-01-01 13:15:04Z felipe $ */
21:
22: /*
23: * This product includes software developed by the Apache Group
24: * for use in the Apache HTTP server project (http://www.apache.org/).
25: *
26: */
27:
28: #include <stdio.h>
29: #include "php.h"
30: #include "php_open_temporary_file.h"
31: #include "zend_globals.h"
32: #include "php_globals.h"
33: #include "php_variables.h"
34: #include "rfc1867.h"
35: #include "ext/standard/php_string.h"
36:
37: #define DEBUG_FILE_UPLOAD ZEND_DEBUG
38:
39: PHPAPI int (*php_rfc1867_callback)(unsigned int event, void *event_data, void **extra TSRMLS_DC) = NULL;
40:
41: #if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
42: #include "ext/mbstring/mbstring.h"
43:
44: static void safe_php_register_variable(char *var, char *strval, int val_len, zval *track_vars_array, zend_bool override_protection TSRMLS_DC);
45:
46: #define SAFE_RETURN { \
47: php_mb_flush_gpc_variables(num_vars, val_list, len_list, array_ptr TSRMLS_CC); \
48: if (lbuf) efree(lbuf); \
49: if (abuf) efree(abuf); \
50: if (array_index) efree(array_index); \
51: zend_hash_destroy(&PG(rfc1867_protected_variables)); \
52: zend_llist_destroy(&header); \
53: if (mbuff->boundary_next) efree(mbuff->boundary_next); \
54: if (mbuff->boundary) efree(mbuff->boundary); \
55: if (mbuff->buffer) efree(mbuff->buffer); \
56: if (mbuff) efree(mbuff); \
57: return; }
58:
59: void php_mb_flush_gpc_variables(int num_vars, char **val_list, int *len_list, zval *array_ptr TSRMLS_DC) /* {{{ */
60: {
61: int i;
62: if (php_mb_encoding_translation(TSRMLS_C)) {
63: if (num_vars > 0 &&
64: php_mb_gpc_encoding_detector(val_list, len_list, num_vars, NULL TSRMLS_CC) == SUCCESS) {
65: php_mb_gpc_encoding_converter(val_list, len_list, num_vars, NULL, NULL TSRMLS_CC);
66: }
67: for (i = 0; i<num_vars; i += 2) {
68: safe_php_register_variable(val_list[i], val_list[i+1], len_list[i+1], array_ptr, 0 TSRMLS_CC);
69: efree(val_list[i]);
70: efree(val_list[i+1]);
71: }
72: efree(val_list);
73: efree(len_list);
74: }
75: }
76: /* }}} */
77:
78: void php_mb_gpc_realloc_buffer(char ***pval_list, int **plen_list, int *num_vars_max, int inc TSRMLS_DC) /* {{{ */
79: {
80: /* allow only even increments */
81: if (inc & 1) {
82: inc++;
83: }
84: (*num_vars_max) += inc;
85: *pval_list = (char **)erealloc(*pval_list, (*num_vars_max+2)*sizeof(char *));
86: *plen_list = (int *)erealloc(*plen_list, (*num_vars_max+2)*sizeof(int));
87: }
88: /* }}} */
89:
90: void php_mb_gpc_stack_variable(char *param, char *value, char ***pval_list, int **plen_list, int *num_vars, int *num_vars_max TSRMLS_DC) /* {{{ */
91: {
92: char **val_list = *pval_list;
93: int *len_list = *plen_list;
94:
95: if (*num_vars >= *num_vars_max) {
96: php_mb_gpc_realloc_buffer(pval_list, plen_list, num_vars_max, 16 TSRMLS_CC);
97: /* in case realloc relocated the buffer */
98: val_list = *pval_list;
99: len_list = *plen_list;
100: }
101:
102: val_list[*num_vars] = (char *)estrdup(param);
103: len_list[*num_vars] = strlen(param);
104: (*num_vars)++;
105: val_list[*num_vars] = (char *)estrdup(value);
106: len_list[*num_vars] = strlen(value);
107: (*num_vars)++;
108: }
109: /* }}} */
110:
111: #else
112:
113: #define SAFE_RETURN { \
114: if (lbuf) efree(lbuf); \
115: if (abuf) efree(abuf); \
116: if (array_index) efree(array_index); \
117: zend_hash_destroy(&PG(rfc1867_protected_variables)); \
118: zend_llist_destroy(&header); \
119: if (mbuff->boundary_next) efree(mbuff->boundary_next); \
120: if (mbuff->boundary) efree(mbuff->boundary); \
121: if (mbuff->buffer) efree(mbuff->buffer); \
122: if (mbuff) efree(mbuff); \
123: return; }
124: #endif
125:
126: /* The longest property name we use in an uploaded file array */
127: #define MAX_SIZE_OF_INDEX sizeof("[tmp_name]")
128:
129: /* The longest anonymous name */
130: #define MAX_SIZE_ANONNAME 33
131:
132: /* Errors */
133: #define UPLOAD_ERROR_OK 0 /* File upload succesful */
134: #define UPLOAD_ERROR_A 1 /* Uploaded file exceeded upload_max_filesize */
135: #define UPLOAD_ERROR_B 2 /* Uploaded file exceeded MAX_FILE_SIZE */
136: #define UPLOAD_ERROR_C 3 /* Partially uploaded */
137: #define UPLOAD_ERROR_D 4 /* No file uploaded */
138: #define UPLOAD_ERROR_E 6 /* Missing /tmp or similar directory */
139: #define UPLOAD_ERROR_F 7 /* Failed to write file to disk */
140: #define UPLOAD_ERROR_X 8 /* File upload stopped by extension */
141:
142: void php_rfc1867_register_constants(TSRMLS_D) /* {{{ */
143: {
144: REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_OK", UPLOAD_ERROR_OK, CONST_CS | CONST_PERSISTENT);
145: REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_INI_SIZE", UPLOAD_ERROR_A, CONST_CS | CONST_PERSISTENT);
146: REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_FORM_SIZE", UPLOAD_ERROR_B, CONST_CS | CONST_PERSISTENT);
147: REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_PARTIAL", UPLOAD_ERROR_C, CONST_CS | CONST_PERSISTENT);
148: REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_NO_FILE", UPLOAD_ERROR_D, CONST_CS | CONST_PERSISTENT);
149: REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_NO_TMP_DIR", UPLOAD_ERROR_E, CONST_CS | CONST_PERSISTENT);
150: REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_CANT_WRITE", UPLOAD_ERROR_F, CONST_CS | CONST_PERSISTENT);
151: REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_EXTENSION", UPLOAD_ERROR_X, CONST_CS | CONST_PERSISTENT);
152: }
153: /* }}} */
154:
155: static void normalize_protected_variable(char *varname TSRMLS_DC) /* {{{ */
156: {
157: char *s = varname, *index = NULL, *indexend = NULL, *p;
158:
159: /* overjump leading space */
160: while (*s == ' ') {
161: s++;
162: }
163:
164: /* and remove it */
165: if (s != varname) {
166: memmove(varname, s, strlen(s)+1);
167: }
168:
169: for (p = varname; *p && *p != '['; p++) {
170: switch(*p) {
171: case ' ':
172: case '.':
173: *p = '_';
174: break;
175: }
176: }
177:
178: /* find index */
179: index = strchr(varname, '[');
180: if (index) {
181: index++;
182: s = index;
183: } else {
184: return;
185: }
186:
187: /* done? */
188: while (index) {
189: while (*index == ' ' || *index == '\r' || *index == '\n' || *index=='\t') {
190: index++;
191: }
192: indexend = strchr(index, ']');
193: indexend = indexend ? indexend + 1 : index + strlen(index);
194:
195: if (s != index) {
196: memmove(s, index, strlen(index)+1);
197: s += indexend-index;
198: } else {
199: s = indexend;
200: }
201:
202: if (*s == '[') {
203: s++;
204: index = s;
205: } else {
206: index = NULL;
207: }
208: }
209: *s = '\0';
210: }
211: /* }}} */
212:
213: static void add_protected_variable(char *varname TSRMLS_DC) /* {{{ */
214: {
215: int dummy = 1;
216:
217: normalize_protected_variable(varname TSRMLS_CC);
218: zend_hash_add(&PG(rfc1867_protected_variables), varname, strlen(varname)+1, &dummy, sizeof(int), NULL);
219: }
220: /* }}} */
221:
222: static zend_bool is_protected_variable(char *varname TSRMLS_DC) /* {{{ */
223: {
224: normalize_protected_variable(varname TSRMLS_CC);
225: return zend_hash_exists(&PG(rfc1867_protected_variables), varname, strlen(varname)+1);
226: }
227: /* }}} */
228:
229: static void safe_php_register_variable(char *var, char *strval, int val_len, zval *track_vars_array, zend_bool override_protection TSRMLS_DC) /* {{{ */
230: {
231: if (override_protection || !is_protected_variable(var TSRMLS_CC)) {
232: php_register_variable_safe(var, strval, val_len, track_vars_array TSRMLS_CC);
233: }
234: }
235: /* }}} */
236:
237: static void safe_php_register_variable_ex(char *var, zval *val, zval *track_vars_array, zend_bool override_protection TSRMLS_DC) /* {{{ */
238: {
239: if (override_protection || !is_protected_variable(var TSRMLS_CC)) {
240: php_register_variable_ex(var, val, track_vars_array TSRMLS_CC);
241: }
242: }
243: /* }}} */
244:
245: static void register_http_post_files_variable(char *strvar, char *val, zval *http_post_files, zend_bool override_protection TSRMLS_DC) /* {{{ */
246: {
247: int register_globals = PG(register_globals);
248:
249: PG(register_globals) = 0;
250: safe_php_register_variable(strvar, val, strlen(val), http_post_files, override_protection TSRMLS_CC);
251: PG(register_globals) = register_globals;
252: }
253: /* }}} */
254:
255: static void register_http_post_files_variable_ex(char *var, zval *val, zval *http_post_files, zend_bool override_protection TSRMLS_DC) /* {{{ */
256: {
257: int register_globals = PG(register_globals);
258:
259: PG(register_globals) = 0;
260: safe_php_register_variable_ex(var, val, http_post_files, override_protection TSRMLS_CC);
261: PG(register_globals) = register_globals;
262: }
263: /* }}} */
264:
265: static int unlink_filename(char **filename TSRMLS_DC) /* {{{ */
266: {
267: VCWD_UNLINK(*filename);
268: return 0;
269: }
270: /* }}} */
271:
272: void destroy_uploaded_files_hash(TSRMLS_D) /* {{{ */
273: {
274: zend_hash_apply(SG(rfc1867_uploaded_files), (apply_func_t) unlink_filename TSRMLS_CC);
275: zend_hash_destroy(SG(rfc1867_uploaded_files));
276: FREE_HASHTABLE(SG(rfc1867_uploaded_files));
277: }
278: /* }}} */
279:
280: /* {{{ Following code is based on apache_multipart_buffer.c from libapreq-0.33 package. */
281:
282: #define FILLUNIT (1024 * 5)
283:
284: typedef struct {
285:
286: /* read buffer */
287: char *buffer;
288: char *buf_begin;
289: int bufsize;
290: int bytes_in_buffer;
291:
292: /* boundary info */
293: char *boundary;
294: char *boundary_next;
295: int boundary_next_len;
296:
297: } multipart_buffer;
298:
299: typedef struct {
300: char *key;
301: char *value;
302: } mime_header_entry;
303:
304: /*
305: * Fill up the buffer with client data.
306: * Returns number of bytes added to buffer.
307: */
308: static int fill_buffer(multipart_buffer *self TSRMLS_DC)
309: {
310: int bytes_to_read, total_read = 0, actual_read = 0;
311:
312: /* shift the existing data if necessary */
313: if (self->bytes_in_buffer > 0 && self->buf_begin != self->buffer) {
314: memmove(self->buffer, self->buf_begin, self->bytes_in_buffer);
315: }
316:
317: self->buf_begin = self->buffer;
318:
319: /* calculate the free space in the buffer */
320: bytes_to_read = self->bufsize - self->bytes_in_buffer;
321:
322: /* read the required number of bytes */
323: while (bytes_to_read > 0) {
324:
325: char *buf = self->buffer + self->bytes_in_buffer;
326:
327: actual_read = sapi_module.read_post(buf, bytes_to_read TSRMLS_CC);
328:
329: /* update the buffer length */
330: if (actual_read > 0) {
331: self->bytes_in_buffer += actual_read;
332: SG(read_post_bytes) += actual_read;
333: total_read += actual_read;
334: bytes_to_read -= actual_read;
335: } else {
336: break;
337: }
338: }
339:
340: return total_read;
341: }
342:
343: /* eof if we are out of bytes, or if we hit the final boundary */
344: static int multipart_buffer_eof(multipart_buffer *self TSRMLS_DC)
345: {
346: if ( (self->bytes_in_buffer == 0 && fill_buffer(self TSRMLS_CC) < 1) ) {
347: return 1;
348: } else {
349: return 0;
350: }
351: }
352:
353: /* create new multipart_buffer structure */
354: static multipart_buffer *multipart_buffer_new(char *boundary, int boundary_len)
355: {
356: multipart_buffer *self = (multipart_buffer *) ecalloc(1, sizeof(multipart_buffer));
357:
358: int minsize = boundary_len + 6;
359: if (minsize < FILLUNIT) minsize = FILLUNIT;
360:
361: self->buffer = (char *) ecalloc(1, minsize + 1);
362: self->bufsize = minsize;
363:
364: spprintf(&self->boundary, 0, "--%s", boundary);
365:
366: self->boundary_next_len = spprintf(&self->boundary_next, 0, "\n--%s", boundary);
367:
368: self->buf_begin = self->buffer;
369: self->bytes_in_buffer = 0;
370:
371: return self;
372: }
373:
374: /*
375: * Gets the next CRLF terminated line from the input buffer.
376: * If it doesn't find a CRLF, and the buffer isn't completely full, returns
377: * NULL; otherwise, returns the beginning of the null-terminated line,
378: * minus the CRLF.
379: *
380: * Note that we really just look for LF terminated lines. This works
381: * around a bug in internet explorer for the macintosh which sends mime
382: * boundaries that are only LF terminated when you use an image submit
383: * button in a multipart/form-data form.
384: */
385: static char *next_line(multipart_buffer *self)
386: {
387: /* look for LF in the data */
388: char* line = self->buf_begin;
389: char* ptr = memchr(self->buf_begin, '\n', self->bytes_in_buffer);
390:
391: if (ptr) { /* LF found */
392:
393: /* terminate the string, remove CRLF */
394: if ((ptr - line) > 0 && *(ptr-1) == '\r') {
395: *(ptr-1) = 0;
396: } else {
397: *ptr = 0;
398: }
399:
400: /* bump the pointer */
401: self->buf_begin = ptr + 1;
402: self->bytes_in_buffer -= (self->buf_begin - line);
403:
404: } else { /* no LF found */
405:
406: /* buffer isn't completely full, fail */
407: if (self->bytes_in_buffer < self->bufsize) {
408: return NULL;
409: }
410: /* return entire buffer as a partial line */
411: line[self->bufsize] = 0;
412: self->buf_begin = ptr;
413: self->bytes_in_buffer = 0;
414: }
415:
416: return line;
417: }
418:
419: /* Returns the next CRLF terminated line from the client */
420: static char *get_line(multipart_buffer *self TSRMLS_DC)
421: {
422: char* ptr = next_line(self);
423:
424: if (!ptr) {
425: fill_buffer(self TSRMLS_CC);
426: ptr = next_line(self);
427: }
428:
429: return ptr;
430: }
431:
432: /* Free header entry */
433: static void php_free_hdr_entry(mime_header_entry *h)
434: {
435: if (h->key) {
436: efree(h->key);
437: }
438: if (h->value) {
439: efree(h->value);
440: }
441: }
442:
443: /* finds a boundary */
444: static int find_boundary(multipart_buffer *self, char *boundary TSRMLS_DC)
445: {
446: char *line;
447:
448: /* loop thru lines */
449: while( (line = get_line(self TSRMLS_CC)) )
450: {
451: /* finished if we found the boundary */
452: if (!strcmp(line, boundary)) {
453: return 1;
454: }
455: }
456:
457: /* didn't find the boundary */
458: return 0;
459: }
460:
461: /* parse headers */
462: static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header TSRMLS_DC)
463: {
464: char *line;
465: mime_header_entry prev_entry, entry;
466: int prev_len, cur_len;
467:
468: /* didn't find boundary, abort */
469: if (!find_boundary(self, self->boundary TSRMLS_CC)) {
470: return 0;
471: }
472:
473: /* get lines of text, or CRLF_CRLF */
474:
475: while( (line = get_line(self TSRMLS_CC)) && strlen(line) > 0 )
476: {
477: /* add header to table */
478: char *key = line;
479: char *value = NULL;
480:
481: /* space in the beginning means same header */
482: if (!isspace(line[0])) {
483: value = strchr(line, ':');
484: }
485:
486: if (value) {
487: *value = 0;
488: do { value++; } while(isspace(*value));
489:
490: entry.value = estrdup(value);
491: entry.key = estrdup(key);
492:
493: } else if (zend_llist_count(header)) { /* If no ':' on the line, add to previous line */
494:
495: prev_len = strlen(prev_entry.value);
496: cur_len = strlen(line);
497:
498: entry.value = emalloc(prev_len + cur_len + 1);
499: memcpy(entry.value, prev_entry.value, prev_len);
500: memcpy(entry.value + prev_len, line, cur_len);
501: entry.value[cur_len + prev_len] = '\0';
502:
503: entry.key = estrdup(prev_entry.key);
504:
505: zend_llist_remove_tail(header);
506: } else {
507: continue;
508: }
509:
510: zend_llist_add_element(header, &entry);
511: prev_entry = entry;
512: }
513:
514: return 1;
515: }
516:
517: static char *php_mime_get_hdr_value(zend_llist header, char *key)
518: {
519: mime_header_entry *entry;
520:
521: if (key == NULL) {
522: return NULL;
523: }
524:
525: entry = zend_llist_get_first(&header);
526: while (entry) {
527: if (!strcasecmp(entry->key, key)) {
528: return entry->value;
529: }
530: entry = zend_llist_get_next(&header);
531: }
532:
533: return NULL;
534: }
535:
536: static char *php_ap_getword(char **line, char stop)
537: {
538: char *pos = *line, quote;
539: char *res;
540:
541: while (*pos && *pos != stop) {
542: if ((quote = *pos) == '"' || quote == '\'') {
543: ++pos;
544: while (*pos && *pos != quote) {
545: if (*pos == '\\' && pos[1] && pos[1] == quote) {
546: pos += 2;
547: } else {
548: ++pos;
549: }
550: }
551: if (*pos) {
552: ++pos;
553: }
554: } else ++pos;
555: }
556: if (*pos == '\0') {
557: res = estrdup(*line);
558: *line += strlen(*line);
559: return res;
560: }
561:
562: res = estrndup(*line, pos - *line);
563:
564: while (*pos == stop) {
565: ++pos;
566: }
567:
568: *line = pos;
569: return res;
570: }
571:
572: static char *substring_conf(char *start, int len, char quote TSRMLS_DC)
573: {
574: char *result = emalloc(len + 2);
575: char *resp = result;
576: int i;
577:
578: for (i = 0; i < len; ++i) {
579: if (start[i] == '\\' && (start[i + 1] == '\\' || (quote && start[i + 1] == quote))) {
580: *resp++ = start[++i];
581: } else {
582: #if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
583: if (php_mb_encoding_translation(TSRMLS_C)) {
584: size_t j = php_mb_gpc_mbchar_bytes(start+i TSRMLS_CC);
585: while (j-- > 0 && i < len) {
586: *resp++ = start[i++];
587: }
588: --i;
589: } else {
590: *resp++ = start[i];
591: }
592: #else
593: *resp++ = start[i];
594: #endif
595: }
596: }
597:
598: *resp = '\0';
599: return result;
600: }
601:
602: static char *php_ap_getword_conf(char **line TSRMLS_DC)
603: {
604: char *str = *line, *strend, *res, quote;
605:
606: #if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
607: if (php_mb_encoding_translation(TSRMLS_C)) {
608: int len=strlen(str);
609: php_mb_gpc_encoding_detector(&str, &len, 1, NULL TSRMLS_CC);
610: }
611: #endif
612:
613: while (*str && isspace(*str)) {
614: ++str;
615: }
616:
617: if (!*str) {
618: *line = str;
619: return estrdup("");
620: }
621:
622: if ((quote = *str) == '"' || quote == '\'') {
623: strend = str + 1;
624: look_for_quote:
625: while (*strend && *strend != quote) {
626: if (*strend == '\\' && strend[1] && strend[1] == quote) {
627: strend += 2;
628: } else {
629: ++strend;
630: }
631: }
632: if (*strend && *strend == quote) {
633: char p = *(strend + 1);
634: if (p != '\r' && p != '\n' && p != '\0') {
635: strend++;
636: goto look_for_quote;
637: }
638: }
639:
640: res = substring_conf(str + 1, strend - str - 1, quote TSRMLS_CC);
641:
642: if (*strend == quote) {
643: ++strend;
644: }
645:
646: } else {
647:
648: strend = str;
649: while (*strend && !isspace(*strend)) {
650: ++strend;
651: }
652: res = substring_conf(str, strend - str, 0 TSRMLS_CC);
653: }
654:
655: while (*strend && isspace(*strend)) {
656: ++strend;
657: }
658:
659: *line = strend;
660: return res;
661: }
662:
663: /*
664: * Search for a string in a fixed-length byte string.
665: * If partial is true, partial matches are allowed at the end of the buffer.
666: * Returns NULL if not found, or a pointer to the start of the first match.
667: */
668: static void *php_ap_memstr(char *haystack, int haystacklen, char *needle, int needlen, int partial)
669: {
670: int len = haystacklen;
671: char *ptr = haystack;
672:
673: /* iterate through first character matches */
674: while( (ptr = memchr(ptr, needle[0], len)) ) {
675:
676: /* calculate length after match */
677: len = haystacklen - (ptr - (char *)haystack);
678:
679: /* done if matches up to capacity of buffer */
680: if (memcmp(needle, ptr, needlen < len ? needlen : len) == 0 && (partial || len >= needlen)) {
681: break;
682: }
683:
684: /* next character */
685: ptr++; len--;
686: }
687:
688: return ptr;
689: }
690:
691: /* read until a boundary condition */
692: static int multipart_buffer_read(multipart_buffer *self, char *buf, int bytes, int *end TSRMLS_DC)
693: {
694: int len, max;
695: char *bound;
696:
697: /* fill buffer if needed */
698: if (bytes > self->bytes_in_buffer) {
699: fill_buffer(self TSRMLS_CC);
700: }
701:
702: /* look for a potential boundary match, only read data up to that point */
703: if ((bound = php_ap_memstr(self->buf_begin, self->bytes_in_buffer, self->boundary_next, self->boundary_next_len, 1))) {
704: max = bound - self->buf_begin;
705: if (end && php_ap_memstr(self->buf_begin, self->bytes_in_buffer, self->boundary_next, self->boundary_next_len, 0)) {
706: *end = 1;
707: }
708: } else {
709: max = self->bytes_in_buffer;
710: }
711:
712: /* maximum number of bytes we are reading */
713: len = max < bytes-1 ? max : bytes-1;
714:
715: /* if we read any data... */
716: if (len > 0) {
717:
718: /* copy the data */
719: memcpy(buf, self->buf_begin, len);
720: buf[len] = 0;
721:
722: if (bound && len > 0 && buf[len-1] == '\r') {
723: buf[--len] = 0;
724: }
725:
726: /* update the buffer */
727: self->bytes_in_buffer -= len;
728: self->buf_begin += len;
729: }
730:
731: return len;
732: }
733:
734: /*
735: XXX: this is horrible memory-usage-wise, but we only expect
736: to do this on small pieces of form data.
737: */
738: static char *multipart_buffer_read_body(multipart_buffer *self, unsigned int *len TSRMLS_DC)
739: {
740: char buf[FILLUNIT], *out=NULL;
741: int total_bytes=0, read_bytes=0;
742:
743: while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL TSRMLS_CC))) {
744: out = erealloc(out, total_bytes + read_bytes + 1);
745: memcpy(out + total_bytes, buf, read_bytes);
746: total_bytes += read_bytes;
747: }
748:
749: if (out) {
750: out[total_bytes] = '\0';
751: }
752: *len = total_bytes;
753:
754: return out;
755: }
756: /* }}} */
757:
758: /*
759: * The combined READER/HANDLER
760: *
761: */
762:
763: SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
764: {
765: char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL;
766: char *temp_filename = NULL, *lbuf = NULL, *abuf = NULL;
767: int boundary_len = 0, total_bytes = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0;
768: int max_file_size = 0, skip_upload = 0, anonindex = 0, is_anonymous;
769: zval *http_post_files = NULL;
770: HashTable *uploaded_files = NULL;
771: #if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
772: int str_len = 0, num_vars = 0, num_vars_max = 2*10, *len_list = NULL;
773: char **val_list = NULL;
774: #endif
775: multipart_buffer *mbuff;
776: zval *array_ptr = (zval *) arg;
777: int fd = -1;
778: zend_llist header;
779: void *event_extra_data = NULL;
780: int llen = 0;
781: int upload_cnt = INI_INT("max_file_uploads");
782:
783: if (SG(post_max_size) > 0 && SG(request_info).content_length > SG(post_max_size)) {
784: sapi_module.sapi_error(E_WARNING, "POST Content-Length of %ld bytes exceeds the limit of %ld bytes", SG(request_info).content_length, SG(post_max_size));
785: return;
786: }
787:
788: /* Get the boundary */
789: boundary = strstr(content_type_dup, "boundary");
790: if (!boundary) {
791: int content_type_len = strlen(content_type_dup);
792: char *content_type_lcase = estrndup(content_type_dup, content_type_len);
793:
794: php_strtolower(content_type_lcase, content_type_len);
795: boundary = strstr(content_type_lcase, "boundary");
796: if (boundary) {
797: boundary = content_type_dup + (boundary - content_type_lcase);
798: }
799: efree(content_type_lcase);
800: }
801:
802: if (!boundary || !(boundary = strchr(boundary, '='))) {
803: sapi_module.sapi_error(E_WARNING, "Missing boundary in multipart/form-data POST data");
804: return;
805: }
806:
807: boundary++;
808: boundary_len = strlen(boundary);
809:
810: if (boundary[0] == '"') {
811: boundary++;
812: boundary_end = strchr(boundary, '"');
813: if (!boundary_end) {
814: sapi_module.sapi_error(E_WARNING, "Invalid boundary in multipart/form-data POST data");
815: return;
816: }
817: } else {
818: /* search for the end of the boundary */
819: boundary_end = strpbrk(boundary, ",;");
820: }
821: if (boundary_end) {
822: boundary_end[0] = '\0';
823: boundary_len = boundary_end-boundary;
824: }
825:
826: /* Initialize the buffer */
827: if (!(mbuff = multipart_buffer_new(boundary, boundary_len))) {
828: sapi_module.sapi_error(E_WARNING, "Unable to initialize the input buffer");
829: return;
830: }
831:
832: /* Initialize $_FILES[] */
833: zend_hash_init(&PG(rfc1867_protected_variables), 5, NULL, NULL, 0);
834:
835: ALLOC_HASHTABLE(uploaded_files);
836: zend_hash_init(uploaded_files, 5, NULL, (dtor_func_t) free_estring, 0);
837: SG(rfc1867_uploaded_files) = uploaded_files;
838:
839: ALLOC_ZVAL(http_post_files);
840: array_init(http_post_files);
841: INIT_PZVAL(http_post_files);
842: PG(http_globals)[TRACK_VARS_FILES] = http_post_files;
843:
844: #if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
845: if (php_mb_encoding_translation(TSRMLS_C)) {
846: val_list = (char **)ecalloc(num_vars_max+2, sizeof(char *));
847: len_list = (int *)ecalloc(num_vars_max+2, sizeof(int));
848: }
849: #endif
850: zend_llist_init(&header, sizeof(mime_header_entry), (llist_dtor_func_t) php_free_hdr_entry, 0);
851:
852: if (php_rfc1867_callback != NULL) {
853: multipart_event_start event_start;
854:
855: event_start.content_length = SG(request_info).content_length;
856: if (php_rfc1867_callback(MULTIPART_EVENT_START, &event_start, &event_extra_data TSRMLS_CC) == FAILURE) {
857: goto fileupload_done;
858: }
859: }
860:
861: while (!multipart_buffer_eof(mbuff TSRMLS_CC))
862: {
863: char buff[FILLUNIT];
864: char *cd = NULL, *param = NULL, *filename = NULL, *tmp = NULL;
865: size_t blen = 0, wlen = 0;
866: off_t offset;
867:
868: zend_llist_clean(&header);
869:
870: if (!multipart_buffer_headers(mbuff, &header TSRMLS_CC)) {
871: goto fileupload_done;
872: }
873:
874: if ((cd = php_mime_get_hdr_value(header, "Content-Disposition"))) {
875: char *pair = NULL;
876: int end = 0;
877:
878: while (isspace(*cd)) {
879: ++cd;
880: }
881:
882: while (*cd && (pair = php_ap_getword(&cd, ';')))
883: {
884: char *key = NULL, *word = pair;
885:
886: while (isspace(*cd)) {
887: ++cd;
888: }
889:
890: if (strchr(pair, '=')) {
891: key = php_ap_getword(&pair, '=');
892:
893: if (!strcasecmp(key, "name")) {
894: if (param) {
895: efree(param);
896: }
897: param = php_ap_getword_conf(&pair TSRMLS_CC);
898: } else if (!strcasecmp(key, "filename")) {
899: if (filename) {
900: efree(filename);
901: }
902: filename = php_ap_getword_conf(&pair TSRMLS_CC);
903: }
904: }
905: if (key) {
906: efree(key);
907: }
908: efree(word);
909: }
910:
911: /* Normal form variable, safe to read all data into memory */
912: if (!filename && param) {
913: unsigned int value_len;
914: char *value = multipart_buffer_read_body(mbuff, &value_len TSRMLS_CC);
915: unsigned int new_val_len; /* Dummy variable */
916:
917: if (!value) {
918: value = estrdup("");
919: }
920:
921: if (sapi_module.input_filter(PARSE_POST, param, &value, value_len, &new_val_len TSRMLS_CC)) {
922: if (php_rfc1867_callback != NULL) {
923: multipart_event_formdata event_formdata;
924: size_t newlength = new_val_len;
925:
926: event_formdata.post_bytes_processed = SG(read_post_bytes);
927: event_formdata.name = param;
928: event_formdata.value = &value;
929: event_formdata.length = new_val_len;
930: event_formdata.newlength = &newlength;
931: if (php_rfc1867_callback(MULTIPART_EVENT_FORMDATA, &event_formdata, &event_extra_data TSRMLS_CC) == FAILURE) {
932: efree(param);
933: efree(value);
934: continue;
935: }
936: new_val_len = newlength;
937: }
938:
939: #if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
940: if (php_mb_encoding_translation(TSRMLS_C)) {
941: php_mb_gpc_stack_variable(param, value, &val_list, &len_list, &num_vars, &num_vars_max TSRMLS_CC);
942: } else {
943: safe_php_register_variable(param, value, new_val_len, array_ptr, 0 TSRMLS_CC);
944: }
945: #else
946: safe_php_register_variable(param, value, new_val_len, array_ptr, 0 TSRMLS_CC);
947: #endif
948: } else if (php_rfc1867_callback != NULL) {
949: multipart_event_formdata event_formdata;
950:
951: event_formdata.post_bytes_processed = SG(read_post_bytes);
952: event_formdata.name = param;
953: event_formdata.value = &value;
954: event_formdata.length = value_len;
955: event_formdata.newlength = NULL;
956: php_rfc1867_callback(MULTIPART_EVENT_FORMDATA, &event_formdata, &event_extra_data TSRMLS_CC);
957: }
958:
959: if (!strcasecmp(param, "MAX_FILE_SIZE")) {
960: max_file_size = atol(value);
961: }
962:
963: efree(param);
964: efree(value);
965: continue;
966: }
967:
968: /* If file_uploads=off, skip the file part */
969: if (!PG(file_uploads)) {
970: skip_upload = 1;
971: } else if (upload_cnt <= 0) {
972: skip_upload = 1;
973: sapi_module.sapi_error(E_WARNING, "Maximum number of allowable file uploads has been exceeded");
974: }
975:
976: /* Return with an error if the posted data is garbled */
977: if (!param && !filename) {
978: sapi_module.sapi_error(E_WARNING, "File Upload Mime headers garbled");
979: goto fileupload_done;
980: }
981:
982: if (!param) {
983: is_anonymous = 1;
984: param = emalloc(MAX_SIZE_ANONNAME);
985: snprintf(param, MAX_SIZE_ANONNAME, "%u", anonindex++);
986: } else {
987: is_anonymous = 0;
988: }
989:
990: /* New Rule: never repair potential malicious user input */
991: if (!skip_upload) {
992: long c = 0;
993: tmp = param;
994:
995: while (*tmp) {
996: if (*tmp == '[') {
997: c++;
998: } else if (*tmp == ']') {
999: c--;
1000: if (tmp[1] && tmp[1] != '[') {
1001: skip_upload = 1;
1002: break;
1003: }
1004: }
1005: if (c < 0) {
1006: skip_upload = 1;
1007: break;
1008: }
1009: tmp++;
1010: }
1011: }
1012:
1013: total_bytes = cancel_upload = 0;
1014: temp_filename = NULL;
1015: fd = -1;
1016:
1017: if (!skip_upload && php_rfc1867_callback != NULL) {
1018: multipart_event_file_start event_file_start;
1019:
1020: event_file_start.post_bytes_processed = SG(read_post_bytes);
1021: event_file_start.name = param;
1022: event_file_start.filename = &filename;
1023: if (php_rfc1867_callback(MULTIPART_EVENT_FILE_START, &event_file_start, &event_extra_data TSRMLS_CC) == FAILURE) {
1024: temp_filename = "";
1025: efree(param);
1026: efree(filename);
1027: continue;
1028: }
1029: }
1030:
1031: if (skip_upload) {
1032: efree(param);
1033: efree(filename);
1034: continue;
1035: }
1036:
1037: if (strlen(filename) == 0) {
1038: #if DEBUG_FILE_UPLOAD
1039: sapi_module.sapi_error(E_NOTICE, "No file uploaded");
1040: #endif
1041: cancel_upload = UPLOAD_ERROR_D;
1042: }
1043:
1044: offset = 0;
1045: end = 0;
1046:
1047: if (!cancel_upload) {
1048: /* only bother to open temp file if we have data */
1049: blen = multipart_buffer_read(mbuff, buff, sizeof(buff), &end TSRMLS_CC);
1050: #if DEBUG_FILE_UPLOAD
1051: if (blen > 0) {
1052: #else
1053: /* in non-debug mode we have no problem with 0-length files */
1054: {
1055: #endif
1056: fd = php_open_temporary_fd_ex(PG(upload_tmp_dir), "php", &temp_filename, 1 TSRMLS_CC);
1057: upload_cnt--;
1058: if (fd == -1) {
1059: sapi_module.sapi_error(E_WARNING, "File upload error - unable to create a temporary file");
1060: cancel_upload = UPLOAD_ERROR_E;
1061: }
1062: }
1063: }
1064:
1065: while (!cancel_upload && (blen > 0))
1066: {
1067: if (php_rfc1867_callback != NULL) {
1068: multipart_event_file_data event_file_data;
1069:
1070: event_file_data.post_bytes_processed = SG(read_post_bytes);
1071: event_file_data.offset = offset;
1072: event_file_data.data = buff;
1073: event_file_data.length = blen;
1074: event_file_data.newlength = &blen;
1075: if (php_rfc1867_callback(MULTIPART_EVENT_FILE_DATA, &event_file_data, &event_extra_data TSRMLS_CC) == FAILURE) {
1076: cancel_upload = UPLOAD_ERROR_X;
1077: continue;
1078: }
1079: }
1080:
1081: if (PG(upload_max_filesize) > 0 && (total_bytes+blen) > PG(upload_max_filesize)) {
1082: #if DEBUG_FILE_UPLOAD
1083: sapi_module.sapi_error(E_NOTICE, "upload_max_filesize of %ld bytes exceeded - file [%s=%s] not saved", PG(upload_max_filesize), param, filename);
1084: #endif
1085: cancel_upload = UPLOAD_ERROR_A;
1086: } else if (max_file_size && ((total_bytes+blen) > max_file_size)) {
1087: #if DEBUG_FILE_UPLOAD
1088: sapi_module.sapi_error(E_NOTICE, "MAX_FILE_SIZE of %ld bytes exceeded - file [%s=%s] not saved", max_file_size, param, filename);
1089: #endif
1090: cancel_upload = UPLOAD_ERROR_B;
1091: } else if (blen > 0) {
1092: wlen = write(fd, buff, blen);
1093:
1094: if (wlen == -1) {
1095: /* write failed */
1096: #if DEBUG_FILE_UPLOAD
1097: sapi_module.sapi_error(E_NOTICE, "write() failed - %s", strerror(errno));
1098: #endif
1099: cancel_upload = UPLOAD_ERROR_F;
1100: } else if (wlen < blen) {
1101: #if DEBUG_FILE_UPLOAD
1102: sapi_module.sapi_error(E_NOTICE, "Only %d bytes were written, expected to write %d", wlen, blen);
1103: #endif
1104: cancel_upload = UPLOAD_ERROR_F;
1105: } else {
1106: total_bytes += wlen;
1107: }
1108: offset += wlen;
1109: }
1110:
1111: /* read data for next iteration */
1112: blen = multipart_buffer_read(mbuff, buff, sizeof(buff), &end TSRMLS_CC);
1113: }
1114:
1115: if (fd != -1) { /* may not be initialized if file could not be created */
1116: close(fd);
1117: }
1118:
1119: if (!cancel_upload && !end) {
1120: #if DEBUG_FILE_UPLOAD
1121: sapi_module.sapi_error(E_NOTICE, "Missing mime boundary at the end of the data for file %s", strlen(filename) > 0 ? filename : "");
1122: #endif
1123: cancel_upload = UPLOAD_ERROR_C;
1124: }
1125: #if DEBUG_FILE_UPLOAD
1126: if (strlen(filename) > 0 && total_bytes == 0 && !cancel_upload) {
1127: sapi_module.sapi_error(E_WARNING, "Uploaded file size 0 - file [%s=%s] not saved", param, filename);
1128: cancel_upload = 5;
1129: }
1130: #endif
1131: if (php_rfc1867_callback != NULL) {
1132: multipart_event_file_end event_file_end;
1133:
1134: event_file_end.post_bytes_processed = SG(read_post_bytes);
1135: event_file_end.temp_filename = temp_filename;
1136: event_file_end.cancel_upload = cancel_upload;
1137: if (php_rfc1867_callback(MULTIPART_EVENT_FILE_END, &event_file_end, &event_extra_data TSRMLS_CC) == FAILURE) {
1138: cancel_upload = UPLOAD_ERROR_X;
1139: }
1140: }
1141:
1142: if (cancel_upload) {
1143: if (temp_filename) {
1144: if (cancel_upload != UPLOAD_ERROR_E) { /* file creation failed */
1145: unlink(temp_filename);
1146: }
1147: efree(temp_filename);
1148: }
1149: temp_filename = "";
1150: } else {
1151: zend_hash_add(SG(rfc1867_uploaded_files), temp_filename, strlen(temp_filename) + 1, &temp_filename, sizeof(char *), NULL);
1152: }
1153:
1154: /* is_arr_upload is true when name of file upload field
1155: * ends in [.*]
1156: * start_arr is set to point to 1st [ */
1157: is_arr_upload = (start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');
1158:
1159: if (is_arr_upload) {
1160: array_len = strlen(start_arr);
1161: if (array_index) {
1162: efree(array_index);
1163: }
1164: array_index = estrndup(start_arr + 1, array_len - 2);
1165: }
1166:
1167: /* Add $foo_name */
1168: if (llen < strlen(param) + MAX_SIZE_OF_INDEX + 1) {
1169: llen = strlen(param);
1170: lbuf = (char *) safe_erealloc(lbuf, llen, 1, MAX_SIZE_OF_INDEX + 1);
1171: llen += MAX_SIZE_OF_INDEX + 1;
1172: }
1173:
1174: if (is_arr_upload) {
1175: if (abuf) efree(abuf);
1176: abuf = estrndup(param, strlen(param)-array_len);
1177: snprintf(lbuf, llen, "%s_name[%s]", abuf, array_index);
1178: } else {
1179: snprintf(lbuf, llen, "%s_name", param);
1180: }
1181:
1182: #if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
1183: if (php_mb_encoding_translation(TSRMLS_C)) {
1184: if (num_vars >= num_vars_max) {
1185: php_mb_gpc_realloc_buffer(&val_list, &len_list, &num_vars_max, 1 TSRMLS_CC);
1186: }
1187: val_list[num_vars] = filename;
1188: len_list[num_vars] = strlen(filename);
1189: num_vars++;
1190: if (php_mb_gpc_encoding_detector(val_list, len_list, num_vars, NULL TSRMLS_CC) == SUCCESS) {
1191: str_len = strlen(filename);
1192: php_mb_gpc_encoding_converter(&filename, &str_len, 1, NULL, NULL TSRMLS_CC);
1193: }
1194: s = php_mb_strrchr(filename, '\\' TSRMLS_CC);
1195: if ((tmp = php_mb_strrchr(filename, '/' TSRMLS_CC)) > s) {
1196: s = tmp;
1197: }
1198: num_vars--;
1199: goto filedone;
1200: }
1201: #endif
1202: /* The \ check should technically be needed for win32 systems only where
1203: * it is a valid path separator. However, IE in all it's wisdom always sends
1204: * the full path of the file on the user's filesystem, which means that unless
1205: * the user does basename() they get a bogus file name. Until IE's user base drops
1206: * to nill or problem is fixed this code must remain enabled for all systems. */
1207: s = strrchr(filename, '\\');
1208: if ((tmp = strrchr(filename, '/')) > s) {
1209: s = tmp;
1210: }
1211: #ifdef PHP_WIN32
1212: if (PG(magic_quotes_gpc)) {
1213: if ((tmp = strrchr(s ? s : filename, '\'')) > s) {
1214: s = tmp;
1215: }
1216: if ((tmp = strrchr(s ? s : filename, '"')) > s) {
1217: s = tmp;
1218: }
1219: }
1220: #endif
1221:
1222: #if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
1223: filedone:
1224: #endif
1225:
1226: if (!is_anonymous) {
1227: if (s && s >= filename) {
1228: safe_php_register_variable(lbuf, s+1, strlen(s+1), NULL, 0 TSRMLS_CC);
1229: } else {
1230: safe_php_register_variable(lbuf, filename, strlen(filename), NULL, 0 TSRMLS_CC);
1231: }
1232: }
1233:
1234: /* Add $foo[name] */
1235: if (is_arr_upload) {
1236: snprintf(lbuf, llen, "%s[name][%s]", abuf, array_index);
1237: } else {
1238: snprintf(lbuf, llen, "%s[name]", param);
1239: }
1240: if (s && s >= filename) {
1241: register_http_post_files_variable(lbuf, s+1, http_post_files, 0 TSRMLS_CC);
1242: } else {
1243: register_http_post_files_variable(lbuf, filename, http_post_files, 0 TSRMLS_CC);
1244: }
1245: efree(filename);
1246: s = NULL;
1247:
1248: /* Possible Content-Type: */
1249: if (cancel_upload || !(cd = php_mime_get_hdr_value(header, "Content-Type"))) {
1250: cd = "";
1251: } else {
1252: /* fix for Opera 6.01 */
1253: s = strchr(cd, ';');
1254: if (s != NULL) {
1255: *s = '\0';
1256: }
1257: }
1258:
1259: /* Add $foo_type */
1260: if (is_arr_upload) {
1261: snprintf(lbuf, llen, "%s_type[%s]", abuf, array_index);
1262: } else {
1263: snprintf(lbuf, llen, "%s_type", param);
1264: }
1265: if (!is_anonymous) {
1266: safe_php_register_variable(lbuf, cd, strlen(cd), NULL, 0 TSRMLS_CC);
1267: }
1268:
1269: /* Add $foo[type] */
1270: if (is_arr_upload) {
1271: snprintf(lbuf, llen, "%s[type][%s]", abuf, array_index);
1272: } else {
1273: snprintf(lbuf, llen, "%s[type]", param);
1274: }
1275: register_http_post_files_variable(lbuf, cd, http_post_files, 0 TSRMLS_CC);
1276:
1277: /* Restore Content-Type Header */
1278: if (s != NULL) {
1279: *s = ';';
1280: }
1281: s = "";
1282:
1283: {
1284: /* store temp_filename as-is (without magic_quotes_gpc-ing it, in case upload_tmp_dir
1285: * contains escapeable characters. escape only the variable name.) */
1286: zval zfilename;
1287:
1288: /* Initialize variables */
1289: add_protected_variable(param TSRMLS_CC);
1290:
1291: /* if param is of form xxx[.*] this will cut it to xxx */
1292: if (!is_anonymous) {
1293: ZVAL_STRING(&zfilename, temp_filename, 1);
1294: safe_php_register_variable_ex(param, &zfilename, NULL, 1 TSRMLS_CC);
1295: }
1296:
1297: /* Add $foo[tmp_name] */
1298: if (is_arr_upload) {
1299: snprintf(lbuf, llen, "%s[tmp_name][%s]", abuf, array_index);
1300: } else {
1301: snprintf(lbuf, llen, "%s[tmp_name]", param);
1302: }
1303: add_protected_variable(lbuf TSRMLS_CC);
1304: ZVAL_STRING(&zfilename, temp_filename, 1);
1305: register_http_post_files_variable_ex(lbuf, &zfilename, http_post_files, 1 TSRMLS_CC);
1306: }
1307:
1308: {
1309: zval file_size, error_type;
1310:
1311: error_type.value.lval = cancel_upload;
1312: error_type.type = IS_LONG;
1313:
1314: /* Add $foo[error] */
1315: if (cancel_upload) {
1316: file_size.value.lval = 0;
1317: file_size.type = IS_LONG;
1318: } else {
1319: file_size.value.lval = total_bytes;
1320: file_size.type = IS_LONG;
1321: }
1322:
1323: if (is_arr_upload) {
1324: snprintf(lbuf, llen, "%s[error][%s]", abuf, array_index);
1325: } else {
1326: snprintf(lbuf, llen, "%s[error]", param);
1327: }
1328: register_http_post_files_variable_ex(lbuf, &error_type, http_post_files, 0 TSRMLS_CC);
1329:
1330: /* Add $foo_size */
1331: if (is_arr_upload) {
1332: snprintf(lbuf, llen, "%s_size[%s]", abuf, array_index);
1333: } else {
1334: snprintf(lbuf, llen, "%s_size", param);
1335: }
1336: if (!is_anonymous) {
1337: safe_php_register_variable_ex(lbuf, &file_size, NULL, 0 TSRMLS_CC);
1338: }
1339:
1340: /* Add $foo[size] */
1341: if (is_arr_upload) {
1342: snprintf(lbuf, llen, "%s[size][%s]", abuf, array_index);
1343: } else {
1344: snprintf(lbuf, llen, "%s[size]", param);
1345: }
1346: register_http_post_files_variable_ex(lbuf, &file_size, http_post_files, 0 TSRMLS_CC);
1347: }
1348: efree(param);
1349: }
1350: }
1351:
1352: fileupload_done:
1353: if (php_rfc1867_callback != NULL) {
1354: multipart_event_end event_end;
1355:
1356: event_end.post_bytes_processed = SG(read_post_bytes);
1357: php_rfc1867_callback(MULTIPART_EVENT_END, &event_end, &event_extra_data TSRMLS_CC);
1358: }
1359:
1360: SAFE_RETURN;
1361: }
1362: /* }}} */
1363:
1364: /*
1365: * Local variables:
1366: * tab-width: 4
1367: * c-basic-offset: 4
1368: * End:
1369: * vim600: sw=4 ts=4 fdm=marker
1370: * vim<600: sw=4 ts=4
1371: */