diff --git a/NEWS b/NEWS index a17ef6f231d..af51ee0d2d7 100644 --- a/NEWS +++ b/NEWS @@ -253,6 +253,7 @@ PHP NEWS prop of wrapped object). (robin_fernandes at uk dot ibm dot com, Arnaud) - Fixed bug #45571 (ReflectionClass::export() shows superclasses' private static methods). (robin_fernandes at uk dot ibm dot com) +- Fixed bug #45540 (stream_context_create creates bad http request). (Arnaud) - Fixed bug #45430 (windows implementation of crypt is not thread safe). (Pierre) - Fixed bug #45345 (SPLFileInfo::getPathInfo() returning dir info instead of diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c index a228dceaf9a..56ce9117cdf 100644 --- a/ext/standard/http_fopen_wrapper.c +++ b/ext/standard/http_fopen_wrapper.c @@ -252,10 +252,17 @@ php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper, char *path, if (context && php_stream_context_get_option(context, "http", "method", &tmpzval) == SUCCESS) { if (Z_TYPE_PP(tmpzval) == IS_STRING && Z_STRLEN_PP(tmpzval) > 0) { - scratch_len = strlen(path) + 29 + Z_STRLEN_PP(tmpzval); - scratch = emalloc(scratch_len); - strlcpy(scratch, Z_STRVAL_PP(tmpzval), Z_STRLEN_PP(tmpzval) + 1); - strcat(scratch, " "); + /* As per the RFC, automatically redirected requests MUST NOT use other methods than + * GET and HEAD unless it can be confirmed by the user */ + if (redirect_max == PHP_URL_REDIRECT_MAX + || (Z_STRLEN_PP(tmpzval) == 3 && memcmp("GET", Z_STRVAL_PP(tmpzval), 3) == 0) + || (Z_STRLEN_PP(tmpzval) == 4 && memcmp("HEAD",Z_STRVAL_PP(tmpzval), 4) == 0) + ) { + scratch_len = strlen(path) + 29 + Z_STRLEN_PP(tmpzval); + scratch = emalloc(scratch_len); + strlcpy(scratch, Z_STRVAL_PP(tmpzval), Z_STRLEN_PP(tmpzval) + 1); + strcat(scratch, " "); + } } }