SECURITY: API: Improve validation in chunked uploading

[lhc/web/wiklou.git] / includes / Setup.php

diff --git a/includes/Setup.php b/includes/Setup.php
index 479ce8c..fbfef1f 100644 (file)
--- a/includes/Setup.php
+++ b/includes/Setup.php
@@ -48,10 +48,10 @@ if ( !isset( $wgVersion ) ) {
 $ps_default = Profiler::instance()->scopedProfileIn( $fname . '-defaults' );
 
 if ( $wgScript === false ) {
-       $wgScript = "$wgScriptPath/index$wgScriptExtension";
+       $wgScript = "$wgScriptPath/index.php";
 }
 if ( $wgLoadScript === false ) {
-       $wgLoadScript = "$wgScriptPath/load$wgScriptExtension";
+       $wgLoadScript = "$wgScriptPath/load.php";
 }
 
 if ( $wgArticlePath === false ) {
@@ -186,7 +186,7 @@ if ( !$wgLocalFileRepo ) {
                'name' => 'local',
                'directory' => $wgUploadDirectory,
                'scriptDirUrl' => $wgScriptPath,
-               'scriptExtension' => $wgScriptExtension,
+               'scriptExtension' => '.php',
                'url' => $wgUploadBaseUrl ? $wgUploadBaseUrl . $wgUploadPath : $wgUploadPath,
                'hashLevels' => $wgHashedUploadDirectory ? 2 : 0,
                'thumbScriptUrl' => $wgThumbnailScriptPath,
@@ -373,6 +373,15 @@ if ( $wgResourceLoaderMaxQueryLength === false ) {
        unset( $suhosinMaxValueLength );
 }
 
+// Ensure the minimum chunk size is less than PHP upload limits or the maximum
+// upload size.
+$wgMinUploadChunkSize = min(
+       $wgMinUploadChunkSize,
+       $wgMaxUploadSize,
+       wfShorthandToInteger( ini_get( 'upload_max_filesize' ), 1e100 ),
+       wfShorthandToInteger( ini_get( 'post_max_size' ), 1e100 ) - 1024 # Leave room for other parameters
+);
+
 /**
  * Definitions of the NS_ constants are in Defines.php
  * @private
@@ -503,10 +512,6 @@ require_once "$IP/includes/compat/normal/UtfNormalUtil.php";
 
 $ps_default2 = Profiler::instance()->scopedProfileIn( $fname . '-defaults2' );
 
-if ( $wgScriptExtension !== '.php' || defined( 'MW_ENTRY_PHP5' ) ) {
-       wfWarn( 'Script extensions other than ".php" are deprecated.' );
-}
-
 if ( $wgCanonicalServer === false ) {
        $wgCanonicalServer = wfExpandUrl( $wgServer, PROTO_HTTP );
 }
@@ -681,12 +686,6 @@ if ( !is_object( $wgAuth ) ) {
  */
 $wgTitle = null;
 
-/**
- * @deprecated since 1.24 Use DeferredUpdates::addUpdate instead
- * @var array
- */
-$wgDeferredUpdateList = array();
-
 Profiler::instance()->scopedProfileOut( $ps_globals );
 $ps_extensions = Profiler::instance()->scopedProfileIn( $fname . '-extensions' );