2

I need to be able to send a multipart/form-data post request to the server via PHP and CURL.

I am able to get the correct content type as well as send usual variables, such as below.

------------------------------2f860b21c344
Content-Disposition: form-data; name="contactId"

8
------------------------------2f860b21c344
Content-Disposition: form-data; name="wt"

00:00:00
------------------------------2f860b21c344

The issue occurs in this section:

-----------------------------221901842288
Content-Disposition: form-data; name="attchmnt[0]"; filename=""
Content-Type: application/octet-stream


-----------------------------221901842288

The closest I have gotten is this:

------------------------------2f860b21c344
Content-Disposition: form-data; name="attchmnt[0]"

filename="";type=application/octet-stream
------------------------------2f860b21c344

I'm using an array for the POST data as the multipart header is required, so as far as the CURL code its working 100% it's just this array that isn't working. Following is the full DataArray:

<?PHP
$dataArray = array(
'tid' => '',
'parentId' => '',
'contactId' => '8',
'wt' => '00:00:00',
'ts' => 'OFF',
'smtl' => '',
'ctctCombo' => 'John Hawkins',
'contact' => '8',
'location' => '16',
'priority' => '-2',
'group' => '1',
'status' => '2',
'category' => '5',
'categoryOption' => '8',
'estimatedDate' => '',
'assignedTo' => '16',
'asset' => '',
'zenAsset' => '',
'cf_20_new' => '512',
'subject' => 'Subject',
'cc' => '',
'bc' => '',
'note' => 'Message',
'attchmnt[0]' => 'filename="";type=application/octet-stream',
'notifyTech' => 'on',
'_notifyTech' => '',
'_notifyUser' => ''
);
?>

So the question is, How do I get CURL to add 'filename="";type=application/octet-stream' on the same line as the name="attchmnt[0]"; ?

It would be simple if I could just upload a file, however I need to specify that it is a filestream just no file was uploaded.

0

1 Answer 1

3

There's no clean way of doing this, I'm afraid. You could use the @ syntax to upload an existing file (and then cURL specifies the octet-stream and also uses the file name you supplied in filename. But you can't specify an empty filename that way.

You can do this... a multiline injection attack against your own code. cURL doesn't seem to mind, but I don't know if it is by design, to allow you to do the dirty deed, or if it is by accident and might stop working in the next release:

$dataArray['attchmnt[0]"; filename=""'."\r\n".'Content-Type: octet-stream'] = '';

This translates to:

    0x0a30:  2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d  ----------------
    0x0a40:  2d2d 2d2d 2d2d 2d2d 2d2d 2d33 6331 3837  -----------3c187
    0x0a50:  3162 6630 3132 360d 0a43 6f6e 7465 6e74  1bf0126..Content
    0x0a60:  2d44 6973 706f 7369 7469 6f6e 3a20 666f  -Disposition:.fo
    0x0a70:  726d 2d64 6174 613b 206e 616d 653d 2261  rm-data;.name="a
    0x0a80:  7474 6368 6d6e 745b 305d 223b 2066 696c  ttchmnt[0]";.fil
    0x0a90:  656e 616d 653d 2222 0d0a 436f 6e74 656e  ename=""..Conten
    0x0aa0:  742d 5479 7065 3a20 6f63 7465 742d 7374  t-Type:.octet-st
    0x0ab0:  7265 616d 220d 0a0d 0a0d 0a2d 2d2d 2d2d  ream"......-----
    0x0ac0:  2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d 2d2d  ----------------
    0x0ad0:  2d2d 2d2d 2d2d 2d2d 2d33 6331 3837 3162  ---------3c1871b
    0x0ae0:  6630 3132 362d 2d0d 0a                   f0126--..

which should be what you're after.

Test

// $dataArray as defined by you

// Change the 'attchmnt[0]' entry
$dataArray['attchmnt[0]"; filename=""'."\r\n".'Content-Type: octet-stream'] = '';

$ch = curl_init();
curl_setopt($ch, CURLOPT_HEADER,         False);
curl_setopt($ch, CURLOPT_VERBOSE,        False);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, True);
curl_setopt($ch, CURLOPT_URL,            'http://127.0.0.1/');
curl_setopt($ch, CURLOPT_POST,           True);
curl_setopt($ch, CURLOPT_POSTFIELDS,     $dataArray);
curl_exec($ch);
6
  • I added that after the line declaring the $dataArray and it just appeneded to the array. I also tried replacing 'attchmnt[0]' => 'filename="";type=application/octet-stream', with 'attchmnt[0]"; filename=""'."\r\n".'Content-Type: octet-stream' >= '', and that didn't do anything to the array at all. Could you explain a little more? Oct 29, 2012 at 14:03
  • Attached test code. But I don't understand how changing an entry could have done "nothing to the array at all"... you do nothing else to that array before sending it to cURL, right?
    – LSerni
    Oct 29, 2012 at 15:04
  • Nice idea, this helped me with TwitterAPI's statuses/update_with_media. i wasn't able to upload contents of an image from memory until i used this trick. Thanks. Feb 19, 2014 at 15:43
  • How do you get rid of the extra double quotes it's adding after the end of octet-stream"
    – Tallboy
    Mar 6, 2014 at 15:45
  • This kludge keeps getting dirtier and dirtier. Have you tried appending another \r\n immediately after octet-stream? It looks like we should give up with cURL and use straight socket I/O.
    – LSerni
    Mar 6, 2014 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.