img_auth.php

   1 <?php
   2 /**
   3  * Image download authorisation script
   4  *
   5  * To use, in LocalSettings.php set $wgUploadDirectory to point to a non-public
   6  * directory, and $wgUploadPath to point to this file. Also set $wgWhitelistRead
   7  * to an array of pages you want everyone to be able to access. Your server must
   8  * support PATH_INFO, CGI-based configurations generally don't.
   9  */
  10 # Valid web server entry point, enable includes
  11 define( 'MEDIAWIKI', true );
  12
  13 if ( isset( $_REQUEST['GLOBALS'] ) ) {
  14         echo '<a href="http://www.hardened-php.net/index.76.html">$GLOBALS overwrite vulnerability</a>';
  15         die( -1 );
  16 }
  17
  18 require_once( 'includes/Defines.php' );
  19 require_once( './LocalSettings.php' );
  20 require_once( 'includes/Setup.php' );
  21 require_once( 'includes/StreamFile.php' );
  22
  23 if( !isset( $_SERVER['PATH_INFO'] ) ) {
  24         wfForbidden();
  25 }
  26
  27 # Get filenames/directories
  28 $filename = realpath( $wgUploadDirectory . $_SERVER['PATH_INFO'] );
  29 $realUploadDirectory = realpath( $wgUploadDirectory );
  30 $imageName = $wgLang->getNsText( NS_IMAGE ) . ":" . basename( $_SERVER['PATH_INFO'] );
  31
  32 # Check if the filename is in the correct directory
  33 if ( substr( $filename, 0, strlen( $realUploadDirectory ) ) != $realUploadDirectory ) {
  34         wfForbidden();
  35 }
  36
  37 if ( is_array( $wgWhitelistRead ) && !in_array( $imageName, $wgWhitelistRead ) && !$wgUser->getID() ) {
  38         wfForbidden();
  39 }
  40
  41 if( !file_exists( $filename ) ) {
  42         wfForbidden();
  43 }
  44 if( is_dir( $filename ) ) {
  45         wfForbidden();
  46 }
  47
  48 # Write file
  49 wfStreamFile( $filename );
  50
  51 function wfForbidden() {
  52         header( 'HTTP/1.0 403 Forbidden' );
  53         print
  54 "<html><body>
  55 <h1>Access denied</h1>
  56 <p>You need to log in to access files on this server</p>
  57 </body></html>";
  58         exit;
  59 }
  60
  61 ?>