GitHub PushEvent at 2014-03-10 14:42:19
Repository: symfony
Actor: Chekote
Payload: {"shas":[["3a4a3cbe303cfe71f40c1d3425882e1426a6bcfc","3cd3cf90331ddea4e60d5d36a1beba6fefc0c31a@palantir.net","10158 get vary multiple","Beth Binkovitz",true],["b6a6791f97271fc31ddfff9266db97aced65d4eb","d4f8dcd89cfe40276c0fbf336903f4a05ab082c9@gmail.com","bug #10382 10158 get vary multiple (bbinkovitz)\n\nThis PR was squashed before being merged into the 2.3 branch (closes #10382).\n\nDiscussion\n----------\n\n10158 get vary multiple\n\n| Q                     | A\n| -------------       | ---\n| Bug fix?           | yes\n| New feature?   | no\n| BC breaks?      |  no\n| Deprecations? | no\n| Tests pass?     | yes\n| Fixed tickets    | [#10158]\n| License            | MIT\n| Doc PR            | none\n\nCommits\n-------\n\n3a4a3cb 10158 get vary multiple","Fabien Potencier",true],["1017d83260c0750ab63875fcf55458c30b72b8db","d4f8dcd89cfe40276c0fbf336903f4a05ab082c9@gmail.com","[HttpFoundation] added some unit tests","Fabien Potencier",true],["dc1279b2e4c0e9cbcb5b7d578891c31dd878b43b","f194f03500e44702ad4ecf63398567096cf9c021@gmail.com","Implement multipart/form-data for PUT, DELETE and PATCH requests.\n\nPHP, and by extension, Symfony does not support multipart/form-data requests when using any request method other than POST. This limits the ability to implement RESTful architectures using Symfony. This is a follow up to Pull Request #849 I made a few years ago, and  addresses concerns brought up by Saldaek at the time.\n\nI have implemented this functionality by manually decoding the php://input stream when the request type is PUT, DELETE or PATCH and the Content-Type header is mutlipart/form-data. The implementation is based on an example by [netcoder at stackoverflow](http://stackoverflow.com/a/9469615).\n\nThis is necessary due to an underlying limitation of PHP, as discussed here: https://bugs.php.net/bug.php?id=55815.\n\nThis fixes https://github.com/symfony/symfony/issues/9226.\n\n__Security Concerns__\n\nThe main concern I had while implementing this feature, was working with PHP's assumptions as to what constituted an uploaded file. Since the files that this commit creates are not done so through PHP's usual uploaded file mechanisms, none of the uploaded file functions (such as is_uploaded_file, move_uploaded_file) will work with them. As such, I had to implement a mechanism for recording the uploaded files as they were created, so that Symfony's UploadedFile class could be sure that it was not moving non-uploaded files.\n\nTo achieve this, I added a static array to the UploadedFile class called $files. Any uploaded files that are created outside of PHP's normal mechanism can be recorded here. UploadedFile can then check this list to ensure that if is_uploaded_file returns false, that the file being moved is in fact an uploaded file. This results in two changes to UploadedFile: Firstly, the is_uploaded_file check had to be expanded to also check if the file was recorded in UploadedFile::$files. Secondly, the move_uploaded_file needed to be changed to rename.\n\nThe change of move_uploaded_file to rename might raise a few red flags, but I do not believe this is a problem. Before rename is called, UploadedFile calls isValid, which checks that the file either is_uploaded_file, or is a member of UploadedFile::$files. Therefore the use of move_uploaded_file is an unnecessary double check (even without these changes).\n\nFix #9226.\n\nConflicts:\n\tsrc/Symfony/Component/HttpFoundation/Tests/RequestTest.php","Chekote",true]],"size":4,"ref":"refs/heads/multipart_formdata","head":"dc1279b2e4c0e9cbcb5b7d578891c31dd878b43b"}