Framework: Input from PUT requests sent as multipart/form-data is unavailable

[slavicd]

$request->all() returns empty for HTTP PUT requests encoded as multipart/form-data. Since Laravel supports restfull controllers, I reckon it should address this PHP issue and provide a kind of wrapper fix for this.

[fernandobandeira]

+1 to this

This is actually an old issue, there's even a topic on laravel.io:
http://laravel.io/forum/02-13-2014-i-can-not-get-inputs-from-a-putpatch-request

"The problem looks like lies in Symfony it can't parse the data if it's multipart/form-data, as an alternative try using x-www-form-urlencoded content disposition." by tlgreg

[slavicd]

How is this closed? Any comments?

[ucheng]

I also want to know why this is closed.

[mnabialek]

You should send POST and set _method to PUT (same as sending forms) to make your files visible

[slavicd]

As far as I know method spoofing is there to address a limitation of the HTML markup, otherwise it would be meaningless.

[rny]

cant believe it is a two years old bug and never get fixed.

[schleumer]

I can relate to that, when sending PUT with multipart/form-data via AJAX with files i can't get the files on Laravel's Request. And i checked file_get_contents('php://input'), everything is on php://input, but this is not getting parsed by Laravel.

[gabrielalan]

I'm having this same issue. Any solution???

[jenalgit]

send with post and add _method:put on form-data like @mnabialek said., it save me for restful resource put method

and the result

this my route:

sorry for my bad english

[shyandsy]

so bug is still there even event though its May, 2017?

[shyandsy]

@jenalgit
how to do this in JQuery? failed when i try

[shyandsy]

@mnabialek
do u know how to to this by JQuery?
could you show some code?

[shaklev]

Will this issue ever gonna be fix ? I'm making a list "laravel/php acts weird" , should i put this in ? thanks in advance.

[mdaliyan]

I was struggling this problem with axios and laravel on patch method for 2 days. @mnabialek 's solution fixed my problem. Thanks.

For any one who has this problem... Don't forget to use FormData() object:

let Data = new FormData();

// for other types
Data.append( 'notmal_data', 'some data' );

// for files (in vuejs)
Data.append( 'your_file', this.$refs.input.files[0], this.$refs.input.files[0].name ); 

// for files (in jQuery)
Data.append( 'your_file', $('input').files[0], $('input').files[0].name ); 


// Send Patch request to laravel
Data.append('_method', 'PATCH');
axios.post('/url' , Data ). then( Response => { 
   // do stuff
});

[robbiemu]

the solution (actually, no, it's a workaround, it doesn't qualify as a solution) of using "_method: put" has a very significant problem for any non-trivial uses: You now are consuming your POST endpoint with what otherwise would be your PUT endpoint. In my case its not the end of the world: there is no POST endpoint yet for this URI, and so the only problem I have is CORS (I have to open POST for the PUT endpoint or else the preflight fails).

This needs to be reopened and resolved.

[libasoles]

Using Data.append('_method', 'PATCH'); or Data.append('_method', 'PUT');, and then using axios.post may not be the best solution. Because I'm working with an API, and already defining a "PUT" endpoint. If I want this to work I have to define a new endpoint, like:

Route::post('/sales/{id}', 'SaleController@update')->where('id', '[0-9]+'); <- workaround
Route::put('/sales/{id}', 'SaleController@update')->where('id', '[0-9]+'); <- original one

Anyway, it works.

[mdaliyan]

Well, somehow laravel sees the _method = PUT and matches the request to the PUT route even if it's a post request. You didn't need to change your routes at all. @robbiemu @lianguan
But you're right. It only works in laravel, I still have this problem in other frameworks.

[robbiemu]

Mdaliyan, it appears to be working because you are not securing your endpoints. If you disallow connections that you do not define, then the Post will be rejected in preflight before a browser will even try to send it,... So even though laravel will treat such a post as a put, the request will never happen because of preflight checks.

As has been noted by multiple people, not just me, this also conflicts with a true post endpoint. That does not appear to be a problem within laravel, I think you've got that right. It can't conflict. But it still could be a problem with audits and external means of network security

[vms82]

shameless bump, is it posible to proccess the request in different way somehow so we can use libs like axios and consume our endpoints without having to use method spoofing?

[defenestrator]

@vms82 yes. This might be what you're after https://github.com/axios/axios/issues/350#issuecomment-227270046

[hafezd]

When sending formData with null properties and formData.append('_method', 'PUT') validation fails (even with nullable rule).

http method | _method | $request->all() | validation
-------------- | ---------- | ---------------- | ---------
PUT | - | is empty | -
POST | post | null values are null | validation works fine
POST | put | null values are 'null' (string) | validation fails and ignores nullable validation rule and errors on null values

any solution?

[vms82]

@hafezdivandari you can manualy build the formdata and if the value is falsey false, 0, -0, "", null, undefined or NaN) append empty value
let formdata = new FormData()
!obj.value ? : formdata.set(obj.whatever, '') : formdata.set(obj.whatver, obj.value)
this way laravel will catch it in the middleware as empty and cast it to null etc.., dont forget it comes like string in the request from the formdata obj

[devmycloud]

This is a major embarrassment for API developers.
The RESTful standard defines PUT for a reason, and browsers are no excuse here.
What is worse is that our API client developers are forced to code this "magic" _method parameter with the POST verb into their code, meaning that the embarrassment is being propagated into client code. Even if the bug is fixed on the server side, we then have to go to N clients and tell them they need to change their code to work the way it should have from the beginning. In other words, API v2. Can anyone point to the place this is broken? We would like to fix it before N becomes a large number.

[slavicd]

@devmycloud this goes as deep as PHP itself. If I remember right - multipart/form-data is not visible in php://input if the method is PUT.

[devcircus]

I'm not sure why we keep flogging the Laravel issue board about this as it is a PHP issue. A bug report was filed here with PHP in 2011. There are issues reported on the Slim repo, the Symfony repo, and of course this issue with Laravel. There are reddit threads, blog posts, etc., etc.
If you want to read comments and theories from the past 10 years or more, click this google search.

[devmycloud]

@devcircus - Thank you!

There were comments with references to where this problem originates, and those references suggested the problem lies in Laravel, but you have clarified it. PHP simply does not process the incoming data for PUT or PATCH requests. However, the data is available via 'php://input' and using code developed to process that input, we have managed to properly implement PATCH methods with Laravel!

Here is a gist for our code that processes the input:
https://gist.github.com/devmycloud/df28012101fbc55d8de1737762b70348

We now have PATCH methods are RESTful with no 'POST/_method' magic required.

[devcircus]

I've been working on something similar recently. Thanks for the gist.

[t202wes]

I implemented @devmycloud's solution, and wrapped the fix in a middleware.

https://gist.github.com/devmycloud/df28012101fbc55d8de1737762b70348#gistcomment-2374843

[crhg]

I found a php extension pecl/apfd, which lets PHP's post handler parse multipart/form-data and application/x-www-form-urlencoded without regard to the request's request method.

It seems to work well in combination with Laravel.

[luizguilhermefr]

Is crazy, but this unexpected behavior still occurs. Yes, until now.

[yooouuri]

Im getting the same error (in VueJS)

let id = 13123123 // some id

const data = new FormData()
data.append('somedata', 'hey')

this.$http.put(`http://homestead.test/api/customers/${id}`, data).then(response => {
  console.log(response)
}, response => {
  console.log(response)
});

And in my PUT endpoint I return $request->all()

My console.log shows me an empty array [] No properties

[Delindel-ML]

PUT and POST work for me in terms of receiving data in my routes, however if we talk about file uploads, the story differs:

POST: Files are seen correctly using application/x-www-form-urlencoded.

PUT: File is simply nulled.

Some header processing is differing under the hood that we are simply not aware of.

[yooouuri]

@Delindel PATCH/PUT is working if I don't use FormData

let data = `name=Youri`

fetch('some_url', {
  method: 'PATCH',
  headers: {
    'Content-type': 'application/x-www-form-urlencoded'
  },
  body: data
})
  .then((response) => response.json())
  .then((response) => {
    console.log(response)
  });

Works but

let data = new FormData()
data.append('name', 'Youri')

fetch('some_url', {
  method: 'PATCH',
  headers: {
    'Content-type': 'application/x-www-form-urlencoded'
  },
  body: data
})
  .then((response) => response.json())
  .then((response) => {
    console.log(response)
  });

Does not

[skeeith]

it's May 26, 2018 and this freaking bug STILL EXISTS!!! WOW.

I just tested this. Laravel request->all() can't parse any of the form data.

[slavicd]

How much research, other than looking at the calendar, have you done, before posting this, skeith? The bug is not in Laravel. Please see the thread and pertaining links for an in depth view.

[lksnmnn]

I had this issue with POST and multipart/form-data from an Angular 4 client.

Calling

$request->replace($request->all()); 

"fixed" this for me for now. All parts where accessible then.

[skeeith]

@lksnmnn my issue was I was sending PUT/PATCH Request instead of POST with a data of _method.
because Laravel doesn't recognize PUT or PATCH but only GET or POST with a field name of _method that has a value of PUT or PATCH.

[joleenshook]

This was a ridiculously hard bug to track down. Mostly because I couldn't believe that something this dumb could actually be the problem. But I just ran into it, so still an issue in PHP 7. Glad I'm working in Laravel, at least this workaround fixed it. I feel for anyone with a different framework.

[spmsupun]

@taylorotwell

[Stunext]

I created a middleware for this:
https://gist.github.com/Stunext/9171b7a8f3633b0b601a0feb8088dca1

Just add this middleware in "AppHttpKernel" file in the middleware api group.

Some methods like "isValid()" maybe not work since the files that this middleware creates are not done so through PHP's usual uploaded file mechanisms.

[Conrekatsu]

@devcircus - Thank you!

There were comments with references to where this problem originates, and those references suggested the problem lies in Laravel, but you have clarified it. PHP simply does not process the incoming data for PUT or PATCH requests. However, the data is available via 'php://input' and using code developed to process that input, we have managed to properly implement PATCH methods with Laravel!

Here is a gist for our code that processes the input:
https://gist.github.com/devmycloud/df28012101fbc55d8de1737762b70348

We now have PATCH methods are RESTful with no 'POST/_method' magic required.

This fixed my problem thank you very much!

[vickymessii]

still bug has not resolved 2018, :-1:
a working example with Laravel 5.7 & Vue JS

`
       let xhttp = new XMLHttpRequest();
        let formData = new FormData();
        let file = document.getElementById('legal_reg_number');
        formData.append('_method', 'PATCH');
        formData.append('legal_reg_number', file.files[0]);
        xhttp.open("POST", "http://localhost/tur/api/v1/submit_from", true);
        xhttp.send(formData)

Route::any('submit_from','UserController@StoreUserForm')->name('submit_from');`

[fauzipadlaw]

I created a middleware for this:
https://gist.github.com/Stunext/9171b7a8f3633b0b601a0feb8088dca1

Just add this middleware in "AppHttpKernel" file in the middleware api group.

Some methods like "isValid()" maybe not work since the files that this middleware creates are not done so through PHP's usual uploaded file mechanisms.

Thanks! :heart: :beer:

[jaasaria]

Waiting for 2020 for the clean solution. Btw thanks @Stunext for the middleware.

[Chekote]

Apologies if what I'm about to say has already been commented above, I didn't have time to read everything and just want to make sure people are aware:

This is not a problem with Laravel or Symfony, it is a problem with PHP. It does not parse multi part form data unless the request method is POST:

https://bugs.php.net/bug.php?id=55815

The bug was reported against Symfony 5 years ago:

https://github.com/symfony/symfony/issues/9226

I submitted a patch to allow Symfony to overcome the limitation of PHP, but it was rejected:

https://github.com/symfony/symfony/pull/10381

[skeeith]

@Chekote seriously it was rejected? lol so every time we post using axios or other libs we need to include the _method POST so it will be processed? cause thats what I'm doing right now so PHP it process it.

[zanechua]

@skeeith I didn't read the entire issue thread but I did read the last comment on the symfony PR and I do agree with the maintainer that this "bug" should be implemented in core PHP instead so perhaps we should be bugging the core PHP maintainers to add this.

[driesvints]

Please use the laravel/ideas repo if you want to propose a new approach.