Package: php5-fpm Version: 5.6.9+dfsg-0+deb8u1 Severity: normal The php5 package in Debian carries a patch to add the getallheaders function to FastCGI (fpm) build. This function is not supported for this build upstream at all. See debian/patches/0046-getallheaders-for-php-fpm-62596.patch
This patch works for "normal" headers which are translated to HTTP_XXX environment variables by PHP, but it does not work for the Content-Type and Content-Length headers. There is code in the patch that is supposed to cover this case, but it does not work. The two headers are missing from the array returned by getallheaders. Here is sample code to demonstrate the issue. # cat getallheaders.php <?php var_dump(getallheaders()); var_dump($_SERVER); ?> $ POST -U -H "X-DUMMY: my test header" -c text/xml http://myserver/getallheaders.php Please enter content (text/xml) to be POSTed: adsflkj öalksjdf ölkjasdf POST https://ubol.ch/getallheaders.php User-Agent: lwp-request/6.09 libwww-perl/6.13 Content-Length: 28 Content-Type: text/xml X-DUMMY: my test header array(5) { ["Te"]=> string(18) "deflate,gzip;q=0.3" ["Connection"]=> string(9) "TE, close" ["Host"]=> string(7) "myserver" ["User-Agent"]=> string(33) "lwp-request/6.09 libwww-perl/6.13" ["X-Dummy"]=> string(14) "my test header" } array(37) { [...] ["FCGI_ROLE"]=> string(9) "RESPONDER" ["SCRIPT_URL"]=> string(18) "/getallheaders.php" ["SCRIPT_URI"]=> string(33) "http://myserver/getallheaders.php"; ["HTTP_TE"]=> string(18) "deflate,gzip;q=0.3" ["HTTP_CONNECTION"]=> string(9) "TE, close" ["HTTP_HOST"]=> string(7) "ubol.ch" ["HTTP_USER_AGENT"]=> string(33) "lwp-request/6.09 libwww-perl/6.13" ["CONTENT_LENGTH"]=> string(2) "28" ["CONTENT_TYPE"]=> string(8) "text/xml" ["HTTP_X_DUMMY"]=> string(14) "my test header" [...] } As you can see, the Content-Type and Content-Length headers are being sent and also end up in the $_SERVER array, but they are not returned by getallheaders. To be honest I'm not sure if it's a good idea to carry a patch which changes upstream behavior like this. While it solves the issue for code that unconditionally calls getallheaders it breaks code (like in my case) which checks for getallheaders and only uses the function if it exists. My code was then broken because the getallheaders implementation was not the same as when running as an Apache module. I found and investigated this buug on a jessie system, but the patch in question is the same in the current unstable version of PHP. Gaudenz
