[php-maint] Bug#795572: getallheaders for php-fpm patch ignores Content-Type and Content-Length headers

[Gaudenz Steinlin]

Package: php5-fpm
Version: 5.6.9+dfsg-0+deb8u1
Severity: normal

The php5 package in Debian carries a patch to add the getallheaders
function to FastCGI (fpm) build. This function is not supported for this
build upstream at all. See
debian/patches/0046-getallheaders-for-php-fpm-62596.patch

This patch works for "normal" headers which are translated to HTTP_XXX
environment variables by PHP, but it does not work for the Content-Type
and Content-Length headers. There is code in the patch that is supposed
to cover this case, but it does not work. The two headers are missing
from the array returned by getallheaders.

Here is sample code to demonstrate the issue.

# cat getallheaders.php
<?php 

var_dump(getallheaders());

var_dump($_SERVER);

?>

$ POST -U -H "X-DUMMY: my test header" -c text/xml http://myserver/getallheaders.php
Please enter content (text/xml) to be POSTed:
adsflkj öalksjdf ölkjasdf
POST https://ubol.ch/getallheaders.php
User-Agent: lwp-request/6.09 libwww-perl/6.13
Content-Length: 28
Content-Type: text/xml
X-DUMMY: my test header

array(5) {
  ["Te"]=>
  string(18) "deflate,gzip;q=0.3"
  ["Connection"]=>
  string(9) "TE, close"
  ["Host"]=>
  string(7) "myserver"
  ["User-Agent"]=>
  string(33) "lwp-request/6.09 libwww-perl/6.13"
  ["X-Dummy"]=>
  string(14) "my test header"
}
array(37) {
[...]
  ["FCGI_ROLE"]=>
  string(9) "RESPONDER"
  ["SCRIPT_URL"]=>
  string(18) "/getallheaders.php"
  ["SCRIPT_URI"]=>
  string(33) "http://myserver/getallheaders.php"
  ["HTTP_TE"]=>
  string(18) "deflate,gzip;q=0.3"
  ["HTTP_CONNECTION"]=>
  string(9) "TE, close"
  ["HTTP_HOST"]=>
  string(7) "ubol.ch"
  ["HTTP_USER_AGENT"]=>
  string(33) "lwp-request/6.09 libwww-perl/6.13"
  ["CONTENT_LENGTH"]=>
  string(2) "28"
  ["CONTENT_TYPE"]=>
  string(8) "text/xml"
  ["HTTP_X_DUMMY"]=>
  string(14) "my test header"
[...]
}

As you can see, the Content-Type and Content-Length headers are being sent and
also end up in the $_SERVER array, but they are not returned by getallheaders.

To be honest I'm not sure if it's a good idea to carry a patch which
changes upstream behavior like this. While it solves the issue for code
that unconditionally calls getallheaders it breaks code (like in my
case) which checks for getallheaders and only uses the function if it
exists. My code was then broken because the getallheaders implementation
was not the same as when running as an Apache module.

I found and investigated this buug on a jessie system, but the patch in
question is the same in the current unstable version of PHP.

Gaudenz