Unexpected post format when sending a post with file upload using Zend\Http\Client

[weierophinney]

This issue has been moved from the zendframework repository as part of the bug migration program as outlined here - http://framework.zend.com/blog/2016-04-11-issue-closures.html

---

Original Issue: https://api.github.com/repos/zendframework/zendframework/issues/7449
User: @dranzd
Created On: 2015-04-15T00:19:30Z
Updated At: 2015-11-06T21:20:08Z
Body
PHP version: 5.5.3-1ubuntu2.6
Zend framework version: 2.3.4

With the code below, when sending a POST request with a file upload using Zend\Http\Client, I get a different format of the posted data. Not sure if the current result is intentional or if it's a bug.

<?php

// sample controller for http://localhost/
class IndexController extends AbstractActionController
{
    public function indexAction()
    {
        if ($this->getRequest()->isPost()) {
            var_dump($_POST, $_FILES);

            die();
        }

        $sl = $this->getServiceLocator();

        $client = new \Zend\Http\Client('http://localhost/');

        $client->setMethod('POST');

        // Uncomment the line below and you'll get a different format for the posted
        // data.  Format would be the expected one.
        $client->setFileUpload('/path/to/any/upload-file.jpg', 'name-of-upload');

        $client->setParameterPost([
            'my-posts' => [
                'string-index' => 'value',
                [
                    'key1' => 'value 1',
                    'key2' => 'value 1',
                ],
                [
                    'key1' => 'value 2',
                    'key2' => 'value 2',
                ],
            ],
        ]);

        $response = $client->send();

        echo $response->getBody();
    }
}

Expected POST and FILES should be:

// $_POST
array (size=1)
  'my-posts' => 
    array (size=3)
      'string-index' => string 'value' (length=5)
      0 => 
        array (size=2)
          'key1' => string 'value 1' (length=7)
          'key2' => string 'value 1' (length=7)
      1 => 
        array (size=2)
          'key1' => string 'value 2' (length=7)
          'key2' => string 'value 2' (length=7)
// $_FILES
array (size=1)
  'name-of-upload' => 
    array (size=5)
      'name' => string 'upload-file.jpg' (length=16)
      'type' => string 'image/jpeg' (length=10)
      'tmp_name' => string '/tmp/phpYqX3jM' (length=14)
      'error' => int 0
      'size' => int 1234

But the actual result is:

// $_POST
array (size=1)
  'my-posts' => 
    array (size=5)
      'string-index' => string 'value' (length=5)
      0 => 
        array (size=1)
          'key1' => string 'value 1' (length=7)
      1 => 
        array (size=1)
          'key2' => string 'value 1' (length=7)
      2 => 
        array (size=1)
          'key1' => string 'value 2' (length=7)
      3 => 
        array (size=1)
          'key2' => string 'value 2' (length=7)
// $_FILES
array (size=1)
  'name-of-upload' => 
    array (size=5)
      'name' => string 'upload-file.jpg' (length=16)
      'type' => string 'image/jpeg' (length=10)
      'tmp_name' => string '/tmp/phprFNTsR' (length=14)
      'error' => int 0
      'size' => int 1234

Looking at Zend\Http\Client class's flattenParametersArray method, if the lines

            // Calculate array key
            if ($prefix) {
                if (is_int($name)) {
                    $key = $prefix . '[]';      // this line will change
                } else {
                    $key = $prefix . "[$name]";
                }
            } else {
                $key = $name;
            }

are replaced with

            // Calculate array key
            if ($prefix) {
                if (is_int($name)) {
                    $key = $prefix . "[$name]"; // to this one
                } else {
                    $key = $prefix . "[$name]";
                }
            } else {
                $key = $name;
            }

then the result would the expected one.

Without the update, the body of the request would be:

-----ZENDHTTPCLIENT-556380ca854251ed536ed8e936213c44
Content-Disposition: form-data; name="my-posts[string-index]"

value
-----ZENDHTTPCLIENT-556380ca854251ed536ed8e936213c44
Content-Disposition: form-data; name="my-posts[][key1]"

value 1
-----ZENDHTTPCLIENT-556380ca854251ed536ed8e936213c44
Content-Disposition: form-data; name="my-posts[][key2]"

value 1
-----ZENDHTTPCLIENT-556380ca854251ed536ed8e936213c44
Content-Disposition: form-data; name="my-posts[][key1]"

value 2
-----ZENDHTTPCLIENT-556380ca854251ed536ed8e936213c44
Content-Disposition: form-data; name="my-posts[][key2]"

value 2
-----ZENDHTTPCLIENT-556380ca854251ed536ed8e936213c44
Content-Disposition: form-data; name="name-of-upload"; filename="upload-file.jpg"
Content-Type: image/jpeg; charset=binary

With the update, the body of the request is:

-----ZENDHTTPCLIENT-2c8da0ee60176aac7c8bee807ab68512
Content-Disposition: form-data; name="my-posts[string-index]"

value
-----ZENDHTTPCLIENT-2c8da0ee60176aac7c8bee807ab68512
Content-Disposition: form-data; name="my-posts[0][key1]"

value 1
-----ZENDHTTPCLIENT-2c8da0ee60176aac7c8bee807ab68512
Content-Disposition: form-data; name="my-posts[0][key2]"

value 1
-----ZENDHTTPCLIENT-2c8da0ee60176aac7c8bee807ab68512
Content-Disposition: form-data; name="my-posts[1][key1]"

value 2
-----ZENDHTTPCLIENT-2c8da0ee60176aac7c8bee807ab68512
Content-Disposition: form-data; name="my-posts[1][key2]"

value 2
-----ZENDHTTPCLIENT-2c8da0ee60176aac7c8bee807ab68512
Content-Disposition: form-data; name="name-of-upload"; filename="upload-file.jpg"
Content-Type: image/jpeg; charset=binary

---

Comment

User: @malukenho
Created On: 2015-04-16T22:01:52Z
Updated At: 2015-04-16T22:01:52Z
Body
@dranzd can you send it as a unit test please?

---

---

Originally posted by @GeeH at zendframework/zend-http#70

[weierophinney]

This package is considered feature-complete, and is now in security-only maintenance mode, following a decision by the Technical Steering Committee.
If you have a security issue, please follow our security reporting guidelines.
If you wish to take on the role of maintainer, please nominate yourself

You can continue using laminas/laminas-http safely.
Its successor will be PSR-7 in a later revision of laminas/laminas-mvc.