How do I add a custom field to a POST?

[tmighty2]

I am uploading a file to my server using VB6 and Winsock.

POST /upload.php? HTTP/1.0
Host: somedomain.com
Content-Type: multipart/form-data, boundary=uzTxw5X5HVmtcWrFhatyjH2QGVcMlBj2
Content-Length: 127289
--uzTxw5X5HVmtcWrFhatyjH2QGVcMlBj2
Content-Disposition: form-data; name="file"; filename="C:/Program Files (x86)/Microsoft Visual Studio/VB98/dtctlsu.oca"; realpath="C:/Program Files (x86)/Microsoft Visual Studio/VB98/dtctlsu.oca"
Content-Type: application/octet-stream
--uzTxw5X5HVmtcWrFhatyjH2QGVcMlBj2--

The upload works fine.

On the server, I would like to know the file's path on the client pc (=> "C:/Program Files (x86)/Microsoft Visual Studio/VB98/dtctlsu.oca").
That is why I have tried to add a custom field named "realpath" (realpath="C:/Program Files (x86)/Microsoft Visual Studio/VB98/dtctlsu.oca")

I have tried to get this field in my php script, but it's empty.

<?php
    move_uploaded_file($_FILES["file"]["tmp_name"], "uploads/" . $_FILES["file"]["name"]);

    $path = "uploads/";
    $name = $_FILES["file"]["name"];
    
    $fullpath1 = $_FILES["file"]["realpath"];
    $fullpath2 = $_POST["realpath"];

    echo "fullpath: . $fullpath1";
    echo "fullpath: . $fullpath2";
?>

How could I pass a custom field with my POST?

Thank you!

ps: I don't have access to php 8.1 yet, so I can't use "full_path".

[wqweto]

Try var_dump($_POST) and var_dump($_FILES)

Note that $_FILES structure is fixed (outlined in POST method uploads) so you cannot add any custom "realpath" attribute like this.

cheers,
</wqw>

[tmighty2]

Thank you, but it does not reveal any more info:

array(0) {
}
array(1) {
  ["file"]=>
  array(5) {
    ["name"]=>
    string(13) "dtctlsu.oca"
    ["type"]=>
    string(0) ""
    ["tmp_name"]=>
    string(14) "/tmp/php8Q3TVc"
    ["error"]=>
    int(0)
    ["size"]=>
    int(149)
  }
}

[wqweto]

Thank you, but it does not reveal any more info:

I already told you it's not possible to extend $_FILES with custom attributes.

Try using a "normal" custom header instead so it can be dumped in $_POST like this:

Content-Disposition: form-data; name="file"; filename="C:/Program Files (x86)/Microsoft Visual Studio/VB98/dtctlsu.oca"
Content-Type: application/octet-stream
X-Real-Path: C:/Program Files (x86)/Microsoft Visual Studio/VB98/dtctlsu.oca

cheers,
</wqw>

[tmighty2]

Thank you.

echo var_dump($_POST);

returns:

array(0) {
}

[tmighty2]

Do you have any idea why echo var_dump($_POST); does not return the X-Real-Path?

[wqweto]

Do you have any idea why echo var_dump($_POST); does not return the X-Real-Path?

Probably a limitation of PHP multi-part request handling.

You can try moving it to main request header at the top (before first multi-part boundary).

cheers,
</wqw>

[tmighty2]

Thank you, but that didn't help either.

[wqweto]

Try var_dump($_SERVER) and/or getallheaders functions. (I'm not using PHP actively.)

cheers,
</wqw>

[tmighty2]

According to an answer on stackexchange, I have now tried the following:

POST /upload.php? HTTP/1.0
Host: myserver.com
Content-Type: multipart/form-data, boundary=004UCzhgJdCM8iqrgTkk0m7UVmLdOk03
Content-Length: 423
--004UCzhgJdCM8iqrgTkk0m7UVmLdOk03
Content-Disposition: form-data; name="param1"
Content-Type: text/plain
C:/Program Files (x86)/Microsoft Visual Studio/VB98/dtctlsu.oca
--004UCzhgJdCM8iqrgTkk0m7UVmLdOk03--
Content-Disposition: multipart/form-data; name="file"; filename="C:/Program Files (x86)/Microsoft Visual Studio/VB98/dtctlsu.oca"
Content-Type: application/octet-stream
--004UCzhgJdCM8iqrgTkk0m7UVmLdOk03--

Thank you!