Skip to content

[5.4] Fix the way the request post parameters are set #17087

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from

Conversation

dan-har
Copy link
Contributor

@dan-har dan-har commented Jan 2, 2017

On request creation, the post parameters bag if filled with query parameters on any
request that is not json. This change fix that, and only json request content will be
parsed and added to the request post parameters.

 On request creation, the post parameters bag if filled with query parameters on any
 request that is not json. This change fix that, and only json request content will be
 parsed and added to the request post parameters.
@sisve
Copy link
Contributor

sisve commented Jan 3, 2017

Are you sure? getInputSource checks the http method; and the existing code should also handle the json case.

@GrahamCampbell GrahamCampbell changed the title Fix the way the request post parameters are set [5.4] Fix the way the request post parameters are set Jan 3, 2017
@taylorotwell
Copy link
Member

I don't really see a problem with the current behavior.

@dan-har
Copy link
Contributor Author

dan-har commented Jan 3, 2017

@sisve @taylorotwell

While I was working on integration of a legacy code project with illuminate http request, I've notice that request is sent without content but the $request->request parameters bag has values. That behvior was not expected so I've override the createFromBase function with the change in this commit to make it work as expected.

The current behavior creates a GET request object with empty content but override the $request->request with the query parameters. The problem is that the request object suggests that there is content on the request and that is a worng behavior.

The current behvior in code is:

$request->query->all() == $request->request->all()
$request->getContent() == ''

and I would expect

$request->request->all() == []
$request->getContent() == ''

Hope that explains it in better way.

taylorotwell pushed a commit that referenced this pull request Aug 9, 2021
…quired (#37921)

* Manually populate POST request body with JSON data only when required

This fixes a 6 year old bug introduced in #7026 where GET requests would have GET data populated in the POST body property leading to issues around Request::post() and $request->getParsedBody() returning GET values when called on GET requests.

This is a resubmit of #17087 & #36708, and fixes #22805. Credit to @dan-har for the initial solution and @mixlion for updating it for >=6.x.

The original PR was meant to support POST requests where their Content-type was set to application/json (instead of the typical application/x-www-form-urlencoded), but it introduced a subtle and dangerous bug because while $request->getInputSource() does return the JSON data for JSON requests, it also returns the GET data for GET requests. This commit solves the underlying issue without breaking compatibility with the original functionality.

* Add test for non-JSON GET requests

* Style fixes

* Extra space removal

* GitHub's editor needs some work
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants