/**
* Image authorisation script
*
- * To use this, see http://www.mediawiki.org/wiki/Manual:Image_Authorization
+ * To use this, see https://www.mediawiki.org/wiki/Manual:Image_Authorization
*
* - Set $wgUploadDirectory to a non-public directory (not web accessible)
* - Set $wgUploadPath to point to this file
wfLogProfilingData();
function wfImageAuthMain() {
- global $wgImgAuthPublicTest, $wgRequest;
+ global $wgImgAuthPublicTest, $wgImgAuthUrlPathMap, $wgRequest;
// See if this is a public Wiki (no protections).
if ( $wgImgAuthPublicTest
// Check for bug 28235: QUERY_STRING overriding the correct extension
$whitelist = array();
- $dotPos = strrpos( $path, '.' );
- if ( $dotPos !== false ) {
- $whitelist[] = substr( $path, $dotPos + 1 );
+ $extension = FileBackend::extensionFromPath( $path );
+ if ( $extension != '' ) {
+ $whitelist[] = $extension;
}
if ( !$wgRequest->checkUrlExtension( $whitelist ) ) {
return;
}
+ // Various extensions may have their own backends that need access.
+ // Check if there is a special backend and storage base path for this file.
+ foreach ( $wgImgAuthUrlPathMap as $prefix => $storageDir ) {
+ $prefix = rtrim( $prefix, '/' ) . '/'; // implicit trailing slash
+ if ( strpos( $path, $prefix ) === 0 ) {
+ $be = FileBackendGroup::singleton()->backendFromPath( $storageDir );
+ $filename = $storageDir . substr( $path, strlen( $prefix ) ); // strip prefix
+ // Check basic user authorization
+ if ( !RequestContext::getMain()->getUser()->isAllowed( 'read' ) ) {
+ wfForbidden( 'img-auth-accessdenied', 'img-auth-noread', $path );
+ return;
+ }
+ if ( $be->fileExists( array( 'src' => $filename ) ) ) {
+ wfDebugLog( 'img_auth', "Streaming `" . $filename . "`." );
+ $be->streamFile( array( 'src' => $filename ),
+ array( 'Cache-Control: private', 'Vary: Cookie' ) );
+ } else {
+ wfForbidden( 'img-auth-accessdenied', 'img-auth-nofile', $path );
+ }
+ return;
+ }
+ }
+
// Get the local file repository
$repo = RepoGroup::singleton()->getRepo( 'local' );
return;
}
+ if ( $wgRequest->getCheck( 'download' ) ) {
+ header( 'Content-Disposition: attachment' );
+ }
+
// Stream the requested file
wfDebugLog( 'img_auth', "Streaming `" . $filename . "`." );
$repo->streamFile( $filename, array( 'Cache-Control: private', 'Vary: Cookie' ) );
* Issue a standard HTTP 403 Forbidden header ($msg1-a message index, not a message) and an
* error message ($msg2, also a message index), (both required) then end the script
* subsequent arguments to $msg2 will be passed as parameters only for replacing in $msg2
- * @param $msg1
- * @param $msg2
+ * @param string $msg1
+ * @param string $msg2
*/
function wfForbidden( $msg1, $msg2 ) {
global $wgImgAuthDetails;
$args = func_get_args();
array_shift( $args );
array_shift( $args );
+ $args = ( isset( $args[0] ) && is_array( $args[0] ) ) ? $args[0] : $args;
$msgHdr = wfMessage( $msg1 )->escaped();
$detailMsgKey = $wgImgAuthDetails ? $msg2 : 'badaccess-group0';