Patch by Jim Fulton, who writes:

"""
The FieldStorage constructor calls the read_multi method.  The read_multi
method creates new FieldStorage objects, re-invoking the constructor
(on the new objects).  The problem is that the 'environ', 'keep_blank_values',
and 'strict_parsing' arguments originally passed to the constructor are not
propigated to the new object constructors.  This causes os.environ to be used,
leading to a miss-handling of the parts.

I fixed this by passing these arguments to read_multi and then on to the
constructor.  See the context diff below.
"""

1 files changed, 6 insertions, 4 deletions

diff --git a/Lib/cgi.py b/Lib/cgi.py
index 3a4e235..aaaded5 100755
--- a/Lib/cgi.py
+++ b/Lib/cgi.py
@@ -852,7 +852,7 @@ class FieldStorage:
         if ctype == 'application/x-www-form-urlencoded':
             self.read_urlencoded()
         elif ctype[:10] == 'multipart/':
-            self.read_multi()
+            self.read_multi(environ, keep_blank_values, strict_parsing)
         else:
             self.read_single()
 
@@ -919,14 +919,16 @@ class FieldStorage:
                 self.list.append(MiniFieldStorage(key, value))
         self.skip_lines()
 
-    def read_multi(self):
+    def read_multi(self, environ, keep_blank_values, strict_parsing):
         """Internal: read a part that is itself multipart."""
         self.list = []
-        part = self.__class__(self.fp, {}, self.innerboundary)
+        part = self.__class__(self.fp, {}, self.innerboundary,
+                              environ, keep_blank_values, strict_parsing)
         # Throw first part away
         while not part.done:
             headers = rfc822.Message(self.fp)
-            part = self.__class__(self.fp, headers, self.innerboundary)
+            part = self.__class__(self.fp, headers, self.innerboundary,
+                                  environ, keep_blank_values, strict_parsing)
             self.list.append(part)
         self.skip_lines()