suhosin removes empty fields from $_POST when used with PHP 5.6

[rot13]

In a fresh PLD chroot:

# rpm -qa | grep php
php-dirs-1.7-1.noarch
php56-common-5.6.24-1.x86_64
php56-cgi-5.6.24-1.x86_64
php56-suhosin-0.9.36-2.x86_64
php55-common-5.5.38-1.x86_64
php55-cgi-5.5.38-1.x86_64
php55-suhosin-0.9.36-2.x86_64

Notice the empty variable missing from $_POST on PHP 5.6:

# echo '<?php var_dump($_POST);' >/tmp/post_test.php && echo "test=test&empty=" | CONTENT_LENGTH=16 REQUEST_METHOD=POST CONTENT_TYPE=application/x-www-form-urlencoded REDIRECT_STATUS=1 SCRIPT_FILENAME=/tmp/post_test.php php56.cgi /tmp/post_test.php
Content-type: text/html; charset=UTF-8

array(1) {
  ["test"]=>
  string(4) "test"
}

PHP 5.5 works correctly:

# echo '<?php var_dump($_POST);' >/tmp/post_test.php && echo "test=test&empty=" | CONTENT_LENGTH=16 REQUEST_METHOD=POST CONTENT_TYPE=application/x-www-form-urlencoded REDIRECT_STATUS=1 SCRIPT_FILENAME=/tmp/post_test.php php55.cgi /tmp/post_test.php
Content-type: text/html

array(2) {
  ["test"]=>
  string(4) "test"
  ["empty"]=>
  string(0) ""
}

PHP 5.6 without loading suhosin (by uninstalling it or adding -n flag) also works correctly:

# echo '<?php var_dump($_POST);' >/tmp/post_test.php && echo "test=test&empty=" | CONTENT_LENGTH=16 REQUEST_METHOD=POST CONTENT_TYPE=application/x-www-form-urlencoded REDIRECT_STATUS=1 SCRIPT_FILENAME=/tmp/post_test.php php56.cgi -n /tmp/post_test.php
X-Powered-By: PHP/5.6.24
Content-type: text/html; charset=UTF-8

array(2) {
  ["test"]=>
  string(4) "test"
  ["empty"]=>
  string(0) ""
}

[rot13 (pp)]

Upstream release 0.9.38 seems to work properly. Opened pull request on github: https://github.com/pld-linux/php-suhosin/pull/1

[Elan Ruusamäe (glen666)]

will be solved with that PR#1