curl CLI与php curl

Question

I have worked with php Curl for a while now, I recently stumbled upon a piece of curl CLI which I can't get to work in PHP curl.

The CLI curl looks as followed:

curl -qgsSkH "Content-Type: multipart/form-data"
--no-progress-bar
--header "X-Api-Token: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-F "filename=@c/tmp/test.txt"
-F "options={\"application\":\"2\",\"timeout\":\"500\",\"priority\":\"0\"}"
https://xxxaddrxxx:443/API/vers1.0/sub

I use the following PHP curl code to mimic the above CLI curl:

$file = new CURLFile($fileEntry->getStoragePath());
$file->setMimeType($fileEntry->mime);
$file->setPostFilename($fileEntry->original_filename);

$data = array();
$data['options'] = json_encode($postData);
$data['filename'] = $file;

$headers = array();
$headers[] = "Content-Type: multipart/form-data";
$headers[] = 'X-FeApi-Token: '.$this->authToken;

$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $url);
curl_setopt($curl, CURLOPT_HEADER, TRUE);
curl_setopt($curl, CURLOPT_HTTPHEADER, $headers);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($curl, CURLOPT_POST, 1);
curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($curl, CURLINFO_HEADER_OUT, true);
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, 0);

$curl_response = curl_exec($curl);

When I output the $data array it will give the following:

array:2 [
  "options" => "{"application":"2","priority":"0","timeout":"5000"}"
  "filename" => CURLFile {
    +name: "/etc/tmp/5645db226dbddINVOICE-722.doc"
    +mime: "application/msword"
    +postname: "INVOICE-722.doc"
  }
]

Which is all the correct data corresponding to what I provide in the code.

Never the less the server where I try to push the file and meta data too respond with an error that the options array or filename is not given in or uploaded. This error is only given when I try to push it through PHP when I run the raw curl command on a Linux server it works just fine.

Do I make a mistake regarding the double -F option? Or do I missed something in the new CURLFile method of posting, because in all previous post on Stack Overlow the deprecated method using '@' is used?

The header part of the curl cli command and php curl seems to be identical when debugging. The payload itself can't easily be verified due to the ssl encryption (https, which can't be turned off on the receiving server).

Thank you in advance.

G.

Answer 1

This issue is fixed. The CURL works perfectly it was the Vendors API integration which was not acting as expected.

It asks for a JSON options variable but what was not documented is that the ORDER is of importance which is just totally unacceptable if you request a JSON.

The vendor is informed and will patch this issue because when doing detailed investigation it turned out there way of parsing the JSON can have some security consequences.