Fix multipart form parsing in FieldStorage.

Prepend the Content-Type header (with boundary) before parsing multipart
POST bodies so admin membership forms and other file-upload pages actually
receive their submitted fields.

Author: jaredmauch

Mailman/Utils.py

@@ -142,12 +142,15 @@ def _parse_urlencoded_post(self):
     def _parse_multipart_post(self):
         """Parse multipart/form-data POST data."""
         content_length = int(self.environ.get('CONTENT_LENGTH', 0))
-        if content_length > 0:
+        content_type = self.environ.get('CONTENT_TYPE', '')
+        if content_length > 0 and content_type:
             post_data = sys.stdin.buffer.read(content_length)
-            
-            # Parse the multipart message
+
+            # The email parser needs the Content-Type header (with boundary);
+            # the raw POST body from the web server contains only the parts.
             parser = BytesParser(policy=HTTP)
-            msg = parser.parsebytes(post_data)
+            header = ('Content-Type: %s\r\n\r\n' % content_type).encode('latin-1')
+            msg = parser.parsebytes(header + post_data)
 
             for part in msg.walk():
                 if part.get_content_maintype() == 'multipart':

tests/test_fieldstorage.py

@@ -0,0 +1,69 @@
+# Copyright (C) 2001-2018 by the Free Software Foundation, Inc.
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+# USA.
+
+"""Unit tests for Mailman.Utils.FieldStorage multipart parsing."""
+
+import io
+import os
+import sys
+import unittest
+
+try:
+    from Mailman import __init__
+except ImportError:
+    import paths
+
+from Mailman.Utils import FieldStorage
+
+
+def _multipart_body(boundary, fields):
+    parts = []
+    for name, value in fields:
+        parts.append(
+            '--%s\r\nContent-Disposition: form-data; name="%s"\r\n\r\n%s\r\n'
+            % (boundary, name, value))
+    parts.append('--%s--\r\n' % boundary)
+    return ''.join(parts).encode()
+
+
+class TestFieldStorageMultipart(unittest.TestCase):
+    def _parse(self, fields):
+        boundary = '----TestBoundary'
+        body = _multipart_body(boundary, fields)
+        environ = {
+            'REQUEST_METHOD': 'POST',
+            'CONTENT_TYPE': 'multipart/form-data; boundary=%s' % boundary,
+            'CONTENT_LENGTH': str(len(body)),
+        }
+        sys.stdin = io.BytesIO(body)
+        return FieldStorage(keep_blank_values=1, environ=environ)
+
+    def test_member_unsub_fields(self):
+        cgidata = self._parse([
+            ('jackplimpton%40gmail.com_unsub', 'off'),
+            ('user', 'jackplimpton%40gmail.com'),
+            ('setmemberopts_btn', 'Submit Your Changes'),
+        ])
+        self.assertIn('setmemberopts_btn', cgidata)
+        self.assertIn('user', cgidata)
+        self.assertIn('jackplimpton%40gmail.com_unsub', cgidata)
+        self.assertEqual(
+            cgidata.getfirst('jackplimpton%40gmail.com_unsub'), 'off')
+
+
+if __name__ == '__main__':
+    unittest.main()