img_auth.php

   1 <?php
   2
   3 /**
   4  * Image authorisation script
   5  *
   6  * To use this:
   7  *
   8  * - Set $wgUploadDirectory to a non-public directory (not web accessible)
   9  * - Set $wgUploadPath to point to this file
  10  *
  11  * Your server needs to support PATH_INFO; CGI-based configurations
  12  * usually don't.
  13  *
  14  * @file
  15  */
  16
  17 define( 'MW_NO_OUTPUT_COMPRESSION', 1 );
  18 require_once( dirname( __FILE__ ) . '/includes/WebStart.php' );
  19 wfProfileIn( 'img_auth.php' );
  20 require_once( dirname( __FILE__ ) . '/includes/StreamFile.php' );
  21
  22 $perms = User::getGroupPermissions( array( '*' ) );
  23 if ( in_array( 'read', $perms, true ) ) {
  24         wfDebugLog( 'img_auth', 'Public wiki' );
  25         wfPublicError();
  26 }
  27
  28 // Extract path and image information
  29 if( !isset( $_SERVER['PATH_INFO'] ) ) {
  30         wfDebugLog( 'img_auth', 'Missing PATH_INFO' );
  31         wfForbidden();
  32 }
  33
  34 $path = $_SERVER['PATH_INFO'];
  35 $filename = realpath( $wgUploadDirectory . $_SERVER['PATH_INFO'] );
  36 $realUpload = realpath( $wgUploadDirectory );
  37 wfDebugLog( 'img_auth', "\$path is {$path}" );
  38 wfDebugLog( 'img_auth', "\$filename is {$filename}" );
  39
  40 // Basic directory traversal check
  41 if( substr( $filename, 0, strlen( $realUpload ) ) != $realUpload ) {
  42         wfDebugLog( 'img_auth', 'Requested path not in upload directory' );
  43         wfForbidden();
  44 }
  45
  46 // Extract the file name and chop off the size specifier
  47 // (e.g. 120px-Foo.png => Foo.png)
  48 $name = wfBaseName( $path );
  49 if( preg_match( '!\d+px-(.*)!i', $name, $m ) )
  50         $name = $m[1];
  51 wfDebugLog( 'img_auth', "\$name is {$name}" );
  52
  53 $title = Title::makeTitleSafe( NS_FILE, $name );
  54 if( !$title instanceof Title ) {
  55         wfDebugLog( 'img_auth', "Unable to construct a valid Title from `{$name}`" );
  56         wfForbidden();
  57 }
  58 if( !$title->userCanRead() ) {
  59         wfDebugLog( 'img_auth', "User does not have access to read `{$name}`" );
  60         wfForbidden();
  61 }
  62 $title = $title->getPrefixedText();
  63
  64 // Check the whitelist if needed
  65 if( !$wgUser->getId() && ( !is_array( $wgWhitelistRead ) || !in_array( $title, $wgWhitelistRead ) ) ) {
  66         wfDebugLog( 'img_auth', "Not logged in and `{$title}` not in whitelist." );
  67         wfForbidden();
  68 }
  69
  70 if( !file_exists( $filename ) ) {
  71         wfDebugLog( 'img_auth', "`{$filename}` does not exist" );
  72         wfForbidden();
  73 }
  74 if( is_dir( $filename ) ) {
  75         wfDebugLog( 'img_auth', "`{$filename}` is a directory" );
  76         wfForbidden();
  77 }
  78
  79 // Stream the requested file
  80 wfDebugLog( 'img_auth', "Streaming `{$filename}`" );
  81 wfStreamFile( $filename, array( 'Cache-Control: private', 'Vary: Cookie' ) );
  82 wfLogProfilingData();
  83
  84 /**
  85  * Issue a standard HTTP 403 Forbidden header and a basic
  86  * error message, then end the script
  87  */
  88 function wfForbidden() {
  89         header( 'HTTP/1.0 403 Forbidden' );
  90         header( 'Vary: Cookie' );
  91         header( 'Content-Type: text/html; charset=utf-8' );
  92         echo <<<ENDS
  93 <html>
  94 <body>
  95 <h1>Access Denied</h1>
  96 <p>You need to log in to access files on this server.</p>
  97 </body>
  98 </html>
  99 ENDS;
 100         wfLogProfilingData();
 101         exit();
 102 }
 103
 104 /**
 105  * Show a 403 error for use when the wiki is public
 106  */
 107 function wfPublicError() {
 108         header( 'HTTP/1.0 403 Forbidden' );
 109         header( 'Content-Type: text/html; charset=utf-8' );
 110         echo <<<ENDS
 111 <html>
 112 <body>
 113 <h1>Access Denied</h1>
 114 <p>The function of img_auth.php is to output files from a private wiki. This wiki
 115 is configured as a public wiki. For optimal security, img_auth.php is disabled in
 116 this case.
 117 </p>
 118 </body>
 119 </html>
 120 ENDS;
 121         wfLogProfilingData();
 122         exit;
 123 }
 124