diff -x '*.o' -x '*.lo' -c -r php-4.4.4.original/main/rfc1867.c php-4.4.4/main/rfc1867.c
*** php-4.4.4.original/main/rfc1867.c 2006-01-01 11:47:00.000000000 -0200
--- php-4.4.4/main/rfc1867.c 2006-12-17 21:53:19.000000000 -0200
***************
*** 34,39 ****
--- 34,41 ----
#undef DEBUG_FILE_UPLOAD
+ PHPAPI int (*php_rfc1867_callback)(unsigned int event, void *event_data, void **extra TSRMLS_DC) = NULL;
+
#if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
#include "ext/mbstring/mbstring.h"
***************
*** 128,133 ****
--- 130,136 ----
#define UPLOAD_ERROR_D 4 /* No file uploaded */
#define UPLOAD_ERROR_E 6 /* Missing /tmp or similar directory */
#define UPLOAD_ERROR_F 7 /* Failed to write file to disk */
+ #define UPLOAD_ERROR_X 8 /* File upload stopped by extension */
void php_rfc1867_register_constants(TSRMLS_D)
{
***************
*** 138,143 ****
--- 141,147 ----
REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_NO_FILE", UPLOAD_ERROR_D, CONST_CS | CONST_PERSISTENT);
REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_NO_TMP_DIR", UPLOAD_ERROR_E, CONST_CS | CONST_PERSISTENT);
REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_CANT_WRITE", UPLOAD_ERROR_F, CONST_CS | CONST_PERSISTENT);
+ REGISTER_MAIN_LONG_CONSTANT("UPLOAD_ERR_EXTENSION", UPLOAD_ERROR_X, CONST_CS | CONST_PERSISTENT);
}
static void normalize_protected_variable(char *varname TSRMLS_DC)
***************
*** 749,755 ****
XXX: this is horrible memory-usage-wise, but we only expect
to do this on small pieces of form data.
*/
! static char *multipart_buffer_read_body(multipart_buffer *self TSRMLS_DC)
{
char buf[FILLUNIT], *out=NULL;
int total_bytes=0, read_bytes=0;
--- 753,759 ----
XXX: this is horrible memory-usage-wise, but we only expect
to do this on small pieces of form data.
*/
! static char *multipart_buffer_read_body(multipart_buffer *self, unsigned int *len TSRMLS_DC)
{
char buf[FILLUNIT], *out=NULL;
int total_bytes=0, read_bytes=0;
***************
*** 761,766 ****
--- 765,771 ----
}
if (out) out[total_bytes] = '\0';
+ *len = total_bytes;
return out;
}
***************
*** 786,797 ****
--- 791,805 ----
zval *array_ptr = (zval *) arg;
int fd=-1;
zend_llist header;
+ void *event_extra_data = NULL;
+ fprintf(stderr, "%s %ld %ld %ld\n", __FILE__, __LINE__, SG(request_info).content_length, SG(post_max_size));
if (SG(request_info).content_length > SG(post_max_size)) {
sapi_module.sapi_error(E_WARNING, "POST Content-Length of %ld bytes exceeds the limit of %ld bytes", SG(request_info).content_length, SG(post_max_size));
return;
}
+ fprintf(stderr, "%s %d\n", __FILE__, __LINE__);
/* Get the boundary */
boundary = strstr(content_type_dup, "boundary");
if (!boundary || !(boundary=strchr(boundary, '='))) {
***************
*** 802,807 ****
--- 810,816 ----
boundary++;
boundary_len = strlen(boundary);
+ fprintf(stderr, "%s %d\n", __FILE__, __LINE__);
if (boundary[0] == '"') {
boundary++;
boundary_end = strchr(boundary, '"');
***************
*** 818,823 ****
--- 827,833 ----
boundary_len = boundary_end-boundary;
}
+ fprintf(stderr, "%s %d\n", __FILE__, __LINE__);
/* Initialize the buffer */
if (!(mbuff = multipart_buffer_new(boundary, boundary_len))) {
sapi_module.sapi_error(E_WARNING, "Unable to initialize the input buffer");
***************
*** 844,859 ****
#endif
zend_llist_init(&header, sizeof(mime_header_entry), (llist_dtor_func_t) php_free_hdr_entry, 0);
while (!multipart_buffer_eof(mbuff TSRMLS_CC))
{
char buff[FILLUNIT];
char *cd=NULL,*param=NULL,*filename=NULL, *tmp=NULL;
! int blen=0, wlen=0;
zend_llist_clean(&header);
if (!multipart_buffer_headers(mbuff, &header TSRMLS_CC)) {
! SAFE_RETURN;
}
if ((cd = php_mime_get_hdr_value(header, "Content-Disposition"))) {
--- 854,881 ----
#endif
zend_llist_init(&header, sizeof(mime_header_entry), (llist_dtor_func_t) php_free_hdr_entry, 0);
+ fprintf(stderr, "%s %d\n", __FILE__, __LINE__);
+ if (php_rfc1867_callback != NULL) {
+ multipart_event_start event_start;
+ fprintf(stderr, "%s %d\n", __FILE__, __LINE__);
+
+ event_start.content_length = SG(request_info).content_length;
+ if (php_rfc1867_callback(MULTIPART_EVENT_START, &event_start, &event_extra_data TSRMLS_CC) == FAILURE) {
+ goto fileupload_done;
+ }
+ }
+
while (!multipart_buffer_eof(mbuff TSRMLS_CC))
{
char buff[FILLUNIT];
char *cd=NULL,*param=NULL,*filename=NULL, *tmp=NULL;
! size_t blen=0, wlen=0;
! off_t offset;
zend_llist_clean(&header);
if (!multipart_buffer_headers(mbuff, &header TSRMLS_CC)) {
! goto fileupload_done;
}
if ((cd = php_mime_get_hdr_value(header, "Content-Disposition"))) {
***************
*** 895,907 ****
/* Normal form variable, safe to read all data into memory */
if (!filename && param) {
!
! char *value = multipart_buffer_read_body(mbuff TSRMLS_CC);
if (!value) {
value = estrdup("");
}
#if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
if (php_mb_encoding_translation(TSRMLS_C)) {
php_mb_gpc_stack_variable(param, value, &val_list, &len_list,
--- 917,941 ----
/* Normal form variable, safe to read all data into memory */
if (!filename && param) {
! unsigned int value_len;
! char *value = multipart_buffer_read_body(mbuff, &value_len TSRMLS_CC);
! unsigned int new_val_len; /* Dummy variable */
if (!value) {
value = estrdup("");
}
+ if (php_rfc1867_callback != NULL) {
+ multipart_event_formdata event_formdata;
+
+ event_formdata.post_bytes_processed = SG(read_post_bytes);
+ event_formdata.name = param;
+ event_formdata.value = &value;
+ event_formdata.length = value_len;
+ event_formdata.newlength = NULL;
+ php_rfc1867_callback(MULTIPART_EVENT_FORMDATA, &event_formdata, &event_extra_data TSRMLS_CC);
+ }
+
#if HAVE_MBSTRING && !defined(COMPILE_DL_MBSTRING)
if (php_mb_encoding_translation(TSRMLS_C)) {
php_mb_gpc_stack_variable(param, value, &val_list, &len_list,
***************
*** 923,944 ****
/* If file_uploads=off, skip the file part */
if (!PG(file_uploads)) {
! if (filename) {
! efree(filename);
! }
! if (param) {
! efree(param);
! }
! continue;
}
/* Return with an error if the posted data is garbled */
! if (!param) {
sapi_module.sapi_error(E_WARNING, "File Upload Mime headers garbled");
! if (filename) {
! efree(filename);
! }
! SAFE_RETURN;
}
/* New Rule: never repair potential malicious user input */
--- 957,969 ----
/* If file_uploads=off, skip the file part */
if (!PG(file_uploads)) {
! skip_upload = 1;
}
/* Return with an error if the posted data is garbled */
! if (!param && !filename) {
sapi_module.sapi_error(E_WARNING, "File Upload Mime headers garbled");
! goto fileupload_done;
}
/* New Rule: never repair potential malicious user input */
***************
*** 974,979 ****
--- 999,1027 ----
cancel_upload = UPLOAD_ERROR_E;
}
}
+
+ if (!skip_upload && php_rfc1867_callback != NULL) {
+ multipart_event_file_start event_file_start;
+
+ event_file_start.post_bytes_processed = SG(read_post_bytes);
+ event_file_start.name = param;
+ event_file_start.filename = &filename;
+ if (php_rfc1867_callback(MULTIPART_EVENT_FILE_START, &event_file_start, &event_extra_data TSRMLS_CC) == FAILURE) {
+ if (temp_filename) {
+ if (cancel_upload != UPLOAD_ERROR_E) { /* file creation failed */
+ close(fd);
+ unlink(temp_filename);
+ }
+ efree(temp_filename);
+ }
+ temp_filename="";
+ efree(param);
+ efree(filename);
+ continue;
+ }
+ }
+
+
if (skip_upload) {
efree(param);
efree(filename);
***************
*** 987,995 ****
--- 1035,1059 ----
cancel_upload = UPLOAD_ERROR_D;
}
+ offset = 0;
end = 0;
while (!cancel_upload && (blen = multipart_buffer_read(mbuff, buff, sizeof(buff), &end TSRMLS_CC)))
{
+ if (php_rfc1867_callback != NULL) {
+ multipart_event_file_data event_file_data;
+
+ event_file_data.post_bytes_processed = SG(read_post_bytes);
+ event_file_data.offset = offset;
+ event_file_data.data = buff;
+ event_file_data.length = blen;
+ event_file_data.newlength = &blen;
+ if (php_rfc1867_callback(MULTIPART_EVENT_FILE_DATA, &event_file_data, &event_extra_data TSRMLS_CC) == FAILURE) {
+ cancel_upload = UPLOAD_ERROR_X;
+ continue;
+ }
+ }
+
+
if (PG(upload_max_filesize) > 0 && total_bytes > PG(upload_max_filesize)) {
sapi_module.sapi_error(E_WARNING, "upload_max_filesize of %ld bytes exceeded - file [%s=%s] not saved", PG(upload_max_filesize), param, filename);
cancel_upload = UPLOAD_ERROR_A;
***************
*** 1005,1010 ****
--- 1069,1076 ----
} else {
total_bytes += wlen;
}
+
+ offset += wlen;
}
}
if (fd!=-1) {
***************
*** 1025,1030 ****
--- 1091,1107 ----
}
#endif
+ if (php_rfc1867_callback != NULL) {
+ multipart_event_file_end event_file_end;
+
+ event_file_end.post_bytes_processed = SG(read_post_bytes);
+ event_file_end.temp_filename = temp_filename;
+ event_file_end.cancel_upload = cancel_upload;
+ if (php_rfc1867_callback(MULTIPART_EVENT_FILE_END, &event_file_end, &event_extra_data TSRMLS_CC) == FAILURE) {
+ cancel_upload = UPLOAD_ERROR_X;
+ }
+ }
+
if (cancel_upload) {
if (temp_filename) {
if (cancel_upload != UPLOAD_ERROR_E) { /* file creation failed */
***************
*** 1216,1222 ****
efree(param);
}
}
!
SAFE_RETURN;
}
--- 1293,1306 ----
efree(param);
}
}
! fileupload_done:
! if (php_rfc1867_callback != NULL) {
! multipart_event_end event_end;
!
! event_end.post_bytes_processed = SG(read_post_bytes);
! php_rfc1867_callback(MULTIPART_EVENT_END, &event_end, &event_extra_data TSRMLS_CC);
! }
!
SAFE_RETURN;
}
diff -x '*.o' -x '*.lo' -c -r php-4.4.4.original/main/rfc1867.h php-4.4.4/main/rfc1867.h
*** php-4.4.4.original/main/rfc1867.h 2002-07-11 22:49:58.000000000 -0300
--- php-4.4.4/main/rfc1867.h 2006-12-17 21:51:56.000000000 -0200
***************
*** 1,13 ****
--- 1,76 ----
+ /*
+ +----------------------------------------------------------------------+
+ | PHP Version 5 |
+ +----------------------------------------------------------------------+
+ | Copyright (c) 1997-2006 The PHP Group |
+ +----------------------------------------------------------------------+
+ | This source file is subject to version 3.01 of the PHP license, |
+ | that is bundled with this package in the file LICENSE, and is |
+ | available through the world-wide-web at the following url: |
+ | http://www.php.net/license/3_01.txt |
+ | If you did not receive a copy of the PHP license and are unable to |
+ | obtain it through the world-wide-web, please send a note to |
+ | license@php.net so we can mail you a copy immediately. |
+ +----------------------------------------------------------------------+
+ | Author: |
+ +----------------------------------------------------------------------+
+ */
+
+ /* $Id: rfc1867.h,v 1.13.2.1.2.2 2006/07/26 13:22:06 tony2001 Exp $ */
+
#ifndef RFC1867_H
#define RFC1867_H
#include "SAPI.h"
#define MULTIPART_CONTENT_TYPE "multipart/form-data"
+ #define MULTIPART_EVENT_START 0
+ #define MULTIPART_EVENT_FORMDATA 1
+ #define MULTIPART_EVENT_FILE_START 2
+ #define MULTIPART_EVENT_FILE_DATA 3
+ #define MULTIPART_EVENT_FILE_END 4
+ #define MULTIPART_EVENT_END 5
+
+ typedef struct _multipart_event_start {
+ size_t content_length;
+ } multipart_event_start;
+
+ typedef struct _multipart_event_formdata {
+ size_t post_bytes_processed;
+ char *name;
+ char **value;
+ size_t length;
+ size_t *newlength;
+ } multipart_event_formdata;
+
+ typedef struct _multipart_event_file_start {
+ size_t post_bytes_processed;
+ char *name;
+ char **filename;
+ } multipart_event_file_start;
+
+ typedef struct _multipart_event_file_data {
+ size_t post_bytes_processed;
+ off_t offset;
+ char *data;
+ size_t length;
+ size_t *newlength;
+ } multipart_event_file_data;
+
+ typedef struct _multipart_event_file_end {
+ size_t post_bytes_processed;
+ char *temp_filename;
+ int cancel_upload;
+ } multipart_event_file_end;
+
+ typedef struct _multipart_event_end {
+ size_t post_bytes_processed;
+ } multipart_event_end;
SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler);
void destroy_uploaded_files_hash(TSRMLS_D);
void php_rfc1867_register_constants(TSRMLS_D);
+ extern PHPAPI int (*php_rfc1867_callback)(unsigned int event, void *event_data, void **extra TSRMLS_DC);
#endif /* RFC1867_H */
|
Download
