Fix #18313: Fix multipart form data parse with double quotes

framework/CHANGELOG.md

@@ -10,7 +10,7 @@ Yii Framework 2 Change Log
 - Bug #18303: Fix creating migration issue for column methods used after defaultValues (wsaid)
 - Bug #18287: Fix for OUTPUT INSERTED and computed columns. Added flag to computed values in table schema (darkdef)
 - Bug #18308: Fixed `\yii\base\Model::getErrorSummary()` reverse order (DrDeath72)
-
+- Bug #18313: Fix multipart form data parse with double quotes (wsaid)
 
 2.0.38 September 14, 2020
 -------------------------

framework/web/MultipartFormDataParser.php

@@ -141,10 +141,11 @@ class MultipartFormDataParser extends BaseObject implements RequestParserInterfa
             return [];
         }
 
-        if (!preg_match('/boundary=(.*)$/is', $contentType, $matches)) {
+        if (!preg_match('/boundary="?(.*)"?$/is', $contentType, $matches)) {
             return [];
         }
-        $boundary = $matches[1];
+
+        $boundary = trim($matches[1], '"');
 
         $bodyParts = preg_split('/\\R?-+' . preg_quote($boundary, '/') . '/s', $rawBody);
         array_pop($bodyParts); // last block always has no data, contains boundary ending like `--`