diff options
| -rw-r--r-- | src/zope/publisher/browser.py | 4 | ||||
| -rw-r--r-- | src/zope/publisher/tests/test_browserrequest.py | 21 |
2 files changed, 23 insertions, 2 deletions
diff --git a/src/zope/publisher/browser.py b/src/zope/publisher/browser.py index 28d8666..b8f38ac 100644 --- a/src/zope/publisher/browser.py +++ b/src/zope/publisher/browser.py @@ -321,8 +321,8 @@ class BrowserRequest(HTTPRequest): env['REQUEST_METHOD'] = 'POST' forms, files = multipart.parse_form_data( env, charset='ISO-8859-1', memfile_limit=0) - items.extend(six.iteritems(forms)) - for key, item in six.iteritems(files): + items.extend(forms.iterallitems()) + for key, item in files.iterallitems(): # multipart puts fields in 'files' even if no upload was # made. We only consider fields to be file uploads if a # filename was passed in and data was uploaded. diff --git a/src/zope/publisher/tests/test_browserrequest.py b/src/zope/publisher/tests/test_browserrequest.py index 1926bb3..dfcf7c6 100644 --- a/src/zope/publisher/tests/test_browserrequest.py +++ b/src/zope/publisher/tests/test_browserrequest.py @@ -601,6 +601,27 @@ class BrowserTests(HTTPTests): publish(request) self.assertEqual(request.form, {u"a": u"b +/=&b:int"}) + def testFormMultipartDuplicateFieldNames(self): + extra = { + 'REQUEST_METHOD': 'POST', + 'CONTENT_TYPE': 'multipart/form_data; boundary=-123', + } + body = b'\n'.join([ + b'---123', + b'Content-Disposition: form-data; name="a"', + b'', + b'first', + b'---123', + b'Content-Disposition: form-data; name="a"', + b'', + b'second', + b'---123--', + b'', + ]) + request = self._createRequest(extra, body) + request.processInputs() + self.assertEqual(['first', 'second'], request.form['a']) + def testInterface(self): request = self._createRequest() verifyObject(IBrowserRequest, request) |