Hi all!Please correct me if I am wrong but I think that Apache should not pass requests to modules such as PHP if full Content-Length was not received.
Here is my test. I am sending a POST request with specified Content-Length and Content-Type: multipart/form-data but with missing last part and final boundary:
POST /test.php HTTP/1.0 Connection: close Content-Length: 10000 Content-Type: multipart/form-data; boundary=ABCDEF --ABCDEF Content-Disposition: form-data; name="a" A --ABCDEF The PHP script is: <?php print_r($_REQUEST); ?>Apache waits for about 10 seconds for the rest of my request (but I don't send anything) and then returns this response:
HTTP/1.1 200 OK
Date: Wed, 27 Nov 2013 19:42:20 GMT
Server: Apache/2.2.22 (Debian)
X-Powered-By: PHP/5.4.4-14+deb7u3
Vary: Accept-Encoding
Content-Length: 23
Connection: close
Content-Type: text/html
Array
(
[a] => A
)
Is it correct behavior? Maybe there is a special config option for
enforcing Content-Length validation?
Thanks. -- Best regards, Sergey. --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|