proxmox-mirrors/pve-http-server
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-http-server synced 2025-04-30 15:57:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix multipart upload: ignore additional headers

Browse Source 
Reported in the forum:
https://forum.proxmox.com/threads/image-upload-fails-after-upgrading-from-7-1-to-7-3.119051/#post-516517

When additional headers existed in the request body, the upload failed.
With this patch, all additional headers get ignored.

Example: The following upload would fail because no headers were
expected after Content-Disposition.

```
--EPIHyQJFC5ftgoXHMe8-Jc6E7FqA4oMb0QBfOTz
Content-Disposition: form-data; name="content"
Content-Type: text/plain; charset=ISO-8859-1

iso
```
would fail. These headers now also get ignored, as we don't use them.

Also, upload now works when the Content-Disposition header isn't the
first, i.e.:
```
--XVH95dt1-A3J8mWiLCmHCW4roSC7-gBntjATBy--
Content-Type: text/plain; charset=ISO-8859-1
Content-Disposition: form-data; name="content"
```

Fixed upload was tested using
* Curl
* GUI
* Apache HttpClient 5

Signed-off-by: Matthias Heiserer <m.heiserer@proxmox.com>
Reviewed-by: Daniel Tschlatscher <d.tschlatscher@proxmox.com>
Tested-by:  Daniel Tschlatscher <d.tschlatscher@proxmox.com>
This commit is contained in:
Matthias Heiserer 2022-12-12 16:07:55 +01:00 committed by Thomas Lamprecht
parent 26ea294acd
commit e3295acc78
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/PVE/APIServer/AnyEvent.pm
View File

@ -1201,11 +1201,19 @@ sub file_upload_multipart {
$rstate->{phase} = 1;
}
my $remove_until_data = sub {
my ($hdl) = @_;
# remove any remaining multipart "headers" like Content-Type
$hdl->{rbuf} =~ s/^.*?${newline_re}{2}//s;
};
my $extract_form_disposition = sub {
my ($name) = @_;
if ($hdl->{rbuf} =~ s/^${delim_re}Content-Disposition: (.*?); name="$name"(.*?)($delim_re)/$3/s) {
if ($hdl->{rbuf} =~ s/^${delim_re}.*?Content-Disposition: (.*?); name="$name"(.*?${delim_re})/$2/s) {
assert_form_disposition($1);
$rstate->{params}->{$name} = trim($2);
$remove_until_data->($hdl);
$hdl->{rbuf} =~ s/^(.*?)(${delim_re})/$2/s;
$rstate->{params}->{$name} = trim($1);
}
};