[pve-devel] [PATCH v2 http-server 1/2] fix #4344: http-server: ignore unused multipart headers

[John Hollowell <jhollowe@johnhollowell.com>]

Signed-off-by: John Hollowell <jhollowe@johnhollowell.com>
---
 src/PVE/APIServer/AnyEvent.pm | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/PVE/APIServer/AnyEvent.pm b/src/PVE/APIServer/AnyEvent.pm
index f397a8c..d958642 100644
--- a/src/PVE/APIServer/AnyEvent.pm
+++ b/src/PVE/APIServer/AnyEvent.pm
@@ -1215,15 +1215,15 @@ sub file_upload_multipart {
 	    $extract_form_disposition->('checksum');

 	    if ($hdl->{rbuf} =~
-		s/^${delim_re}
-		Content-Disposition:\ (.*?);\ name="(.*?)";\ filename="([^"]+)"${newline_re}
-		Content-Type:\ \S*\s+
-		//sxx
+		s/^${delim_re}Content-Disposition:\ (.*?);\ name="(.*?)";\ filename="([^"]+)"//sxx
 	    ) {
 		assert_form_disposition($1);
 		die "wrong field name '$2' for file upload, expected 'filename'" if $2 ne "filename";
 		$rstate->{phase} = 2;
 		$rstate->{params}->{filename} = trim($3);
+
+		# remove any remaining multipart "headers" like Content-Type
+		$hdl->{rbuf} =~ s/^.*?${newline_re}{2}//s
 	    }
 	}

--
2.30.2