SECURITY: API: Improve validation in chunked uploading

[lhc/web/wiklou.git] / includes / GlobalFunctions.php

diff --git a/includes/GlobalFunctions.php b/includes/GlobalFunctions.php
index c24aaec..4cc4f00 100644 (file)
--- a/includes/GlobalFunctions.php
+++ b/includes/GlobalFunctions.php
@@ -1233,7 +1233,7 @@ function wfLogWarning( $msg, $callerOffset = 1, $level = E_USER_WARNING ) {
  * @param string $file Filename
  * @param array $context Additional logging context data
  * @throws MWException
- * @deprecated since 1.25 Use MediaWiki\Logger\LegacyLogger::emit or UDPTransport
+ * @deprecated since 1.25 Use \\MediaWiki\\Logger\\LegacyLogger::emit or UDPTransport
  */
 function wfErrorLog( $text, $file, array $context = array() ) {
        wfDeprecated( __METHOD__, '1.25' );
@@ -1985,8 +1985,11 @@ function wfGetAllCallers( $limit = 3 ) {
  * @return string
  */
 function wfFormatStackFrame( $frame ) {
-       return isset( $frame['class'] ) ?
-               $frame['class'] . '::' . $frame['function'] :
+       if ( !isset( $frame['function'] ) ) {
+               return 'NO_FUNCTION_GIVEN';
+       }
+       return isset( $frame['class'] ) && isset( $frame['type'] ) ?
+               $frame['class'] . $frame['type'] . $frame['function'] :
                $frame['function'];
 }
 
@@ -2856,16 +2859,17 @@ function wfShellExec( $cmd, &$retval = null, $environ = array(),
        $status = false;
        $logMsg = false;
 
-       // According to the documentation, it is possible for stream_select()
-       // to fail due to EINTR. I haven't managed to induce this in testing
-       // despite sending various signals. If it did happen, the error
-       // message would take the form:
-       //
-       // stream_select(): unable to select [4]: Interrupted system call (max_fd=5)
-       //
-       // where [4] is the value of the macro EINTR and "Interrupted system
-       // call" is string which according to the Linux manual is "possibly"
-       // localised according to LC_MESSAGES.
+       /* According to the documentation, it is possible for stream_select()
+        * to fail due to EINTR. I haven't managed to induce this in testing
+        * despite sending various signals. If it did happen, the error
+        * message would take the form:
+        *
+        * stream_select(): unable to select [4]: Interrupted system call (max_fd=5)
+        *
+        * where [4] is the value of the macro EINTR and "Interrupted system
+        * call" is string which according to the Linux manual is "possibly"
+        * localised according to LC_MESSAGES.
+        */
        $eintr = defined( 'SOCKET_EINTR' ) ? SOCKET_EINTR : 4;
        $eintrMessage = "stream_select(): unable to select [$eintr]";
 
@@ -3737,16 +3741,16 @@ function wfScript( $script = 'index' ) {
  */
 function wfGetScriptUrl() {
        if ( isset( $_SERVER['SCRIPT_NAME'] ) ) {
-               #
-               # as it was called, minus the query string.
-               #
-               # Some sites use Apache rewrite rules to handle subdomains,
-               # and have PHP set up in a weird way that causes PHP_SELF
-               # to contain the rewritten URL instead of the one that the
-               # outside world sees.
-               #
-               # If in this mode, use SCRIPT_URL instead, which mod_rewrite
-               # provides containing the "before" URL.
+               /* as it was called, minus the query string.
+                *
+                * Some sites use Apache rewrite rules to handle subdomains,
+                * and have PHP set up in a weird way that causes PHP_SELF
+                * to contain the rewritten URL instead of the one that the
+                * outside world sees.
+                *
+                * If in this mode, use SCRIPT_URL instead, which mod_rewrite
+                * provides containing the "before" URL.
+                */
                return $_SERVER['SCRIPT_NAME'];
        } else {
                return $_SERVER['URL'];
@@ -3936,12 +3940,13 @@ function wfTransactionalTimeLimit() {
  * Converts shorthand byte notation to integer form
  *
  * @param string $string
+ * @param int $default Returned if $string is empty
  * @return int
  */
-function wfShorthandToInteger( $string = '' ) {
+function wfShorthandToInteger( $string = '', $default = -1 ) {
        $string = trim( $string );
        if ( $string === '' ) {
-               return -1;
+               return $default;
        }
        $last = $string[strlen( $string ) - 1];
        $val = intval( $string );