includes/HttpFunctions.php

   1 <?php
   2 /**
   3  * Various HTTP related functions.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  * @ingroup HTTP
  22  */
  23
  24 /**
  25  * @defgroup HTTP HTTP
  26  */
  27
  28 /**
  29  * Various HTTP related functions
  30  * @ingroup HTTP
  31  */
  32 class Http {
  33         static $httpEngine = false;
  34
  35         /**
  36          * Perform an HTTP request
  37          *
  38          * @param string $method HTTP method. Usually GET/POST
  39          * @param string $url full URL to act on. If protocol-relative, will be expanded to an http:// URL
  40          * @param array $options options to pass to MWHttpRequest object.
  41          *      Possible keys for the array:
  42          *    - timeout             Timeout length in seconds
  43          *    - connectTimeout      Timeout for connection, in seconds (curl only)
  44          *    - postData            An array of key-value pairs or a url-encoded form data
  45          *    - proxy               The proxy to use.
  46          *                          Otherwise it will use $wgHTTPProxy (if set)
  47          *                          Otherwise it will use the environment variable "http_proxy" (if set)
  48          *    - noProxy             Don't use any proxy at all. Takes precedence over proxy value(s).
  49          *    - sslVerifyHost       Verify hostname against certificate
  50          *    - sslVerifyCert       Verify SSL certificate
  51          *    - caInfo              Provide CA information
  52          *    - maxRedirects        Maximum number of redirects to follow (defaults to 5)
  53          *    - followRedirects     Whether to follow redirects (defaults to false).
  54          *                                  Note: this should only be used when the target URL is trusted,
  55          *                                  to avoid attacks on intranet services accessible by HTTP.
  56          *    - userAgent           A user agent, if you want to override the default
  57          *                          MediaWiki/$wgVersion
  58          * @return Mixed: (bool)false on failure or a string on success
  59          */
  60         public static function request( $method, $url, $options = array() ) {
  61                 wfDebug( "HTTP: $method: $url\n" );
  62                 wfProfileIn( __METHOD__ . "-$method" );
  63
  64                 $options['method'] = strtoupper( $method );
  65
  66                 if ( !isset( $options['timeout'] ) ) {
  67                         $options['timeout'] = 'default';
  68                 }
  69                 if( !isset( $options['connectTimeout'] ) ) {
  70                         $options['connectTimeout'] = 'default';
  71                 }
  72
  73                 $req = MWHttpRequest::factory( $url, $options );
  74                 $status = $req->execute();
  75
  76                 $content = false;
  77                 if ( $status->isOK() ) {
  78                         $content = $req->getContent();
  79                 }
  80                 wfProfileOut( __METHOD__ . "-$method" );
  81                 return $content;
  82         }
  83
  84         /**
  85          * Simple wrapper for Http::request( 'GET' )
  86          * @see Http::request()
  87          *
  88          * @param $url
  89          * @param $timeout string
  90          * @param $options array
  91          * @return string
  92          */
  93         public static function get( $url, $timeout = 'default', $options = array() ) {
  94                 $options['timeout'] = $timeout;
  95                 return Http::request( 'GET', $url, $options );
  96         }
  97
  98         /**
  99          * Simple wrapper for Http::request( 'POST' )
 100          * @see Http::request()
 101          *
 102          * @param $url
 103          * @param $options array
 104          * @return string
 105          */
 106         public static function post( $url, $options = array() ) {
 107                 return Http::request( 'POST', $url, $options );
 108         }
 109
 110         /**
 111          * Check if the URL can be served by localhost
 112          *
 113          * @param string $url full url to check
 114          * @return Boolean
 115          */
 116         public static function isLocalURL( $url ) {
 117                 global $wgCommandLineMode, $wgConf;
 118
 119                 if ( $wgCommandLineMode ) {
 120                         return false;
 121                 }
 122
 123                 // Extract host part
 124                 $matches = array();
 125                 if ( preg_match( '!^http://([\w.-]+)[/:].*$!', $url, $matches ) ) {
 126                         $host = $matches[1];
 127                         // Split up dotwise
 128                         $domainParts = explode( '.', $host );
 129                         // Check if this domain or any superdomain is listed in $wgConf as a local virtual host
 130                         $domainParts = array_reverse( $domainParts );
 131
 132                         $domain = '';
 133                         for ( $i = 0; $i < count( $domainParts ); $i++ ) {
 134                                 $domainPart = $domainParts[$i];
 135                                 if ( $i == 0 ) {
 136                                         $domain = $domainPart;
 137                                 } else {
 138                                         $domain = $domainPart . '.' . $domain;
 139                                 }
 140
 141                                 if ( $wgConf->isLocalVHost( $domain ) ) {
 142                                         return true;
 143                                 }
 144                         }
 145                 }
 146
 147                 return false;
 148         }
 149
 150         /**
 151          * A standard user-agent we can use for external requests.
 152          * @return String
 153          */
 154         public static function userAgent() {
 155                 global $wgVersion;
 156                 return "MediaWiki/$wgVersion";
 157         }
 158
 159         /**
 160          * Checks that the given URI is a valid one. Hardcoding the
 161          * protocols, because we only want protocols that both cURL
 162          * and php support.
 163          *
 164          * file:// should not be allowed here for security purpose (r67684)
 165          *
 166          * @todo FIXME this is wildly inaccurate and fails to actually check most stuff
 167          *
 168          * @param $uri Mixed: URI to check for validity
 169          * @return Boolean
 170          */
 171         public static function isValidURI( $uri ) {
 172                 return preg_match(
 173                         '/^https?:\/\/[^\/\s]\S*$/D',
 174                         $uri
 175                 );
 176         }
 177 }
 178
 179 /**
 180  * This wrapper class will call out to curl (if available) or fallback
 181  * to regular PHP if necessary for handling internal HTTP requests.
 182  *
 183  * Renamed from HttpRequest to MWHttpRequest to avoid conflict with
 184  * PHP's HTTP extension.
 185  */
 186 class MWHttpRequest {
 187         const SUPPORTS_FILE_POSTS = false;
 188
 189         protected $content;
 190         protected $timeout = 'default';
 191         protected $headersOnly = null;
 192         protected $postData = null;
 193         protected $proxy = null;
 194         protected $noProxy = false;
 195         protected $sslVerifyHost = true;
 196         protected $sslVerifyCert = true;
 197         protected $caInfo = null;
 198         protected $method = "GET";
 199         protected $reqHeaders = array();
 200         protected $url;
 201         protected $parsedUrl;
 202         protected $callback;
 203         protected $maxRedirects = 5;
 204         protected $followRedirects = false;
 205
 206         /**
 207          * @var  CookieJar
 208          */
 209         protected $cookieJar;
 210
 211         protected $headerList = array();
 212         protected $respVersion = "0.9";
 213         protected $respStatus = "200 Ok";
 214         protected $respHeaders = array();
 215
 216         public $status;
 217
 218         /**
 219          * @param string $url url to use. If protocol-relative, will be expanded to an http:// URL
 220          * @param array $options (optional) extra params to pass (see Http::request())
 221          */
 222         protected function __construct( $url, $options = array() ) {
 223                 global $wgHTTPTimeout, $wgHTTPConnectTimeout;
 224
 225                 $this->url = wfExpandUrl( $url, PROTO_HTTP );
 226                 $this->parsedUrl = wfParseUrl( $this->url );
 227
 228                 if ( !$this->parsedUrl || !Http::isValidURI( $this->url ) ) {
 229                         $this->status = Status::newFatal( 'http-invalid-url' );
 230                 } else {
 231                         $this->status = Status::newGood( 100 ); // continue
 232                 }
 233
 234                 if ( isset( $options['timeout'] ) && $options['timeout'] != 'default' ) {
 235                         $this->timeout = $options['timeout'];
 236                 } else {
 237                         $this->timeout = $wgHTTPTimeout;
 238                 }
 239                 if ( isset( $options['connectTimeout'] ) && $options['connectTimeout'] != 'default' ) {
 240                         $this->connectTimeout = $options['connectTimeout'];
 241                 } else {
 242                         $this->connectTimeout = $wgHTTPConnectTimeout;
 243                 }
 244                 if ( isset( $options['userAgent'] ) ) {
 245                         $this->setUserAgent( $options['userAgent'] );
 246                 }
 247
 248                 $members = array( "postData", "proxy", "noProxy", "sslVerifyHost", "caInfo",
 249                                 "method", "followRedirects", "maxRedirects", "sslVerifyCert", "callback" );
 250
 251                 foreach ( $members as $o ) {
 252                         if ( isset( $options[$o] ) ) {
 253                                 // ensure that MWHttpRequest::method is always
 254                                 // uppercased. Bug 36137
 255                                 if ( $o == 'method' ) {
 256                                         $options[$o] = strtoupper( $options[$o] );
 257                                 }
 258                                 $this->$o = $options[$o];
 259                         }
 260                 }
 261
 262                 if ( $this->noProxy ) {
 263                         $this->proxy = ''; // noProxy takes precedence
 264                 }
 265         }
 266
 267         /**
 268          * Simple function to test if we can make any sort of requests at all, using
 269          * cURL or fopen()
 270          * @return bool
 271          */
 272         public static function canMakeRequests() {
 273                 return function_exists( 'curl_init' ) || wfIniGetBool( 'allow_url_fopen' );
 274         }
 275
 276         /**
 277          * Generate a new request object
 278          * @param string $url url to use
 279          * @param array $options (optional) extra params to pass (see Http::request())
 280          * @throws MWException
 281          * @return CurlHttpRequest|PhpHttpRequest
 282          * @see MWHttpRequest::__construct
 283          */
 284         public static function factory( $url, $options = null ) {
 285                 if ( !Http::$httpEngine ) {
 286                         Http::$httpEngine = function_exists( 'curl_init' ) ? 'curl' : 'php';
 287                 } elseif ( Http::$httpEngine == 'curl' && !function_exists( 'curl_init' ) ) {
 288                         throw new MWException( __METHOD__ . ': curl (http://php.net/curl) is not installed, but' .
 289                                 ' Http::$httpEngine is set to "curl"' );
 290                 }
 291
 292                 switch ( Http::$httpEngine ) {
 293                         case 'curl':
 294                                 return new CurlHttpRequest( $url, $options );
 295                         case 'php':
 296                                 if ( !wfIniGetBool( 'allow_url_fopen' ) ) {
 297                                         throw new MWException( __METHOD__ . ': allow_url_fopen needs to be enabled for pure PHP' .
 298                                                 ' http requests to work. If possible, curl should be used instead. See http://php.net/curl.' );
 299                                 }
 300                                 return new PhpHttpRequest( $url, $options );
 301                         default:
 302                                 throw new MWException( __METHOD__ . ': The setting of Http::$httpEngine is not valid.' );
 303                 }
 304         }
 305
 306         /**
 307          * Get the body, or content, of the response to the request
 308          *
 309          * @return String
 310          */
 311         public function getContent() {
 312                 return $this->content;
 313         }
 314
 315         /**
 316          * Set the parameters of the request
 317          *
 318          * @param $args Array
 319          * @todo overload the args param
 320          */
 321         public function setData( $args ) {
 322                 $this->postData = $args;
 323         }
 324
 325         /**
 326          * Take care of setting up the proxy (do nothing if "noProxy" is set)
 327          *
 328          * @return void
 329          */
 330         public function proxySetup() {
 331                 global $wgHTTPProxy;
 332
 333                 // If there is an explicit proxy set and proxies are not disabled, then use it
 334                 if ( $this->proxy && !$this->noProxy ) {
 335                         return;
 336                 }
 337
 338                 // Otherwise, fallback to $wgHTTPProxy/http_proxy (when set) if this is not a machine
 339                 // local URL and proxies are not disabled
 340                 if ( Http::isLocalURL( $this->url ) || $this->noProxy ) {
 341                         $this->proxy = '';
 342                 } elseif ( $wgHTTPProxy ) {
 343                         $this->proxy = $wgHTTPProxy;
 344                 } elseif ( getenv( "http_proxy" ) ) {
 345                         $this->proxy = getenv( "http_proxy" );
 346                 }
 347         }
 348
 349         /**
 350          * Set the referrer header
 351          */
 352         public function setReferer( $url ) {
 353                 $this->setHeader( 'Referer', $url );
 354         }
 355
 356         /**
 357          * Set the user agent
 358          * @param $UA string
 359          */
 360         public function setUserAgent( $UA ) {
 361                 $this->setHeader( 'User-Agent', $UA );
 362         }
 363
 364         /**
 365          * Set an arbitrary header
 366          * @param $name
 367          * @param $value
 368          */
 369         public function setHeader( $name, $value ) {
 370                 // I feel like I should normalize the case here...
 371                 $this->reqHeaders[$name] = $value;
 372         }
 373
 374         /**
 375          * Get an array of the headers
 376          * @return array
 377          */
 378         public function getHeaderList() {
 379                 $list = array();
 380
 381                 if ( $this->cookieJar ) {
 382                         $this->reqHeaders['Cookie'] =
 383                                 $this->cookieJar->serializeToHttpRequest(
 384                                         $this->parsedUrl['path'],
 385                                         $this->parsedUrl['host']
 386                                 );
 387                 }
 388
 389                 foreach ( $this->reqHeaders as $name => $value ) {
 390                         $list[] = "$name: $value";
 391                 }
 392
 393                 return $list;
 394         }
 395
 396         /**
 397          * Set a read callback to accept data read from the HTTP request.
 398          * By default, data is appended to an internal buffer which can be
 399          * retrieved through $req->getContent().
 400          *
 401          * To handle data as it comes in -- especially for large files that
 402          * would not fit in memory -- you can instead set your own callback,
 403          * in the form function($resource, $buffer) where the first parameter
 404          * is the low-level resource being read (implementation specific),
 405          * and the second parameter is the data buffer.
 406          *
 407          * You MUST return the number of bytes handled in the buffer; if fewer
 408          * bytes are reported handled than were passed to you, the HTTP fetch
 409          * will be aborted.
 410          *
 411          * @param $callback Callback
 412          * @throws MWException
 413          */
 414         public function setCallback( $callback ) {
 415                 if ( !is_callable( $callback ) ) {
 416                         throw new MWException( 'Invalid MwHttpRequest callback' );
 417                 }
 418                 $this->callback = $callback;
 419         }
 420
 421         /**
 422          * A generic callback to read the body of the response from a remote
 423          * server.
 424          *
 425          * @param $fh handle
 426          * @param $content String
 427          * @return int
 428          */
 429         public function read( $fh, $content ) {
 430                 $this->content .= $content;
 431                 return strlen( $content );
 432         }
 433
 434         /**
 435          * Take care of whatever is necessary to perform the URI request.
 436          *
 437          * @return Status
 438          */
 439         public function execute() {
 440                 global $wgTitle;
 441
 442                 wfProfileIn( __METHOD__ );
 443
 444                 $this->content = "";
 445
 446                 if ( strtoupper( $this->method ) == "HEAD" ) {
 447                         $this->headersOnly = true;
 448                 }
 449
 450                 if ( is_object( $wgTitle ) && !isset( $this->reqHeaders['Referer'] ) ) {
 451                         $this->setReferer( wfExpandUrl( $wgTitle->getFullURL(), PROTO_CURRENT ) );
 452                 }
 453
 454                 $this->proxySetup(); // set up any proxy as needed
 455
 456                 if ( !$this->callback ) {
 457                         $this->setCallback( array( $this, 'read' ) );
 458                 }
 459
 460                 if ( !isset( $this->reqHeaders['User-Agent'] ) ) {
 461                         $this->setUserAgent( Http::userAgent() );
 462                 }
 463
 464                 wfProfileOut( __METHOD__ );
 465         }
 466
 467         /**
 468          * Parses the headers, including the HTTP status code and any
 469          * Set-Cookie headers.  This function expects the headers to be
 470          * found in an array in the member variable headerList.
 471          */
 472         protected function parseHeader() {
 473                 wfProfileIn( __METHOD__ );
 474
 475                 $lastname = "";
 476
 477                 foreach ( $this->headerList as $header ) {
 478                         if ( preg_match( "#^HTTP/([0-9.]+) (.*)#", $header, $match ) ) {
 479                                 $this->respVersion = $match[1];
 480                                 $this->respStatus = $match[2];
 481                         } elseif ( preg_match( "#^[ \t]#", $header ) ) {
 482                                 $last = count( $this->respHeaders[$lastname] ) - 1;
 483                                 $this->respHeaders[$lastname][$last] .= "\r\n$header";
 484                         } elseif ( preg_match( "#^([^:]*):[\t ]*(.*)#", $header, $match ) ) {
 485                                 $this->respHeaders[strtolower( $match[1] )][] = $match[2];
 486                                 $lastname = strtolower( $match[1] );
 487                         }
 488                 }
 489
 490                 $this->parseCookies();
 491
 492                 wfProfileOut( __METHOD__ );
 493         }
 494
 495         /**
 496          * Sets HTTPRequest status member to a fatal value with the error
 497          * message if the returned integer value of the status code was
 498          * not successful (< 300) or a redirect (>=300 and < 400).  (see
 499          * RFC2616, section 10,
 500          * http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html for a
 501          * list of status codes.)
 502          */
 503         protected function setStatus() {
 504                 if ( !$this->respHeaders ) {
 505                         $this->parseHeader();
 506                 }
 507
 508                 if ( (int)$this->respStatus > 399 ) {
 509                         list( $code, $message ) = explode( " ", $this->respStatus, 2 );
 510                         $this->status->fatal( "http-bad-status", $code, $message );
 511                 }
 512         }
 513
 514         /**
 515          * Get the integer value of the HTTP status code (e.g. 200 for "200 Ok")
 516          * (see RFC2616, section 10, http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
 517          * for a list of status codes.)
 518          *
 519          * @return Integer
 520          */
 521         public function getStatus() {
 522                 if ( !$this->respHeaders ) {
 523                         $this->parseHeader();
 524                 }
 525
 526                 return (int)$this->respStatus;
 527         }
 528
 529         /**
 530          * Returns true if the last status code was a redirect.
 531          *
 532          * @return Boolean
 533          */
 534         public function isRedirect() {
 535                 if ( !$this->respHeaders ) {
 536                         $this->parseHeader();
 537                 }
 538
 539                 $status = (int)$this->respStatus;
 540
 541                 if ( $status >= 300 && $status <= 303 ) {
 542                         return true;
 543                 }
 544
 545                 return false;
 546         }
 547
 548         /**
 549          * Returns an associative array of response headers after the
 550          * request has been executed.  Because some headers
 551          * (e.g. Set-Cookie) can appear more than once the, each value of
 552          * the associative array is an array of the values given.
 553          *
 554          * @return Array
 555          */
 556         public function getResponseHeaders() {
 557                 if ( !$this->respHeaders ) {
 558                         $this->parseHeader();
 559                 }
 560
 561                 return $this->respHeaders;
 562         }
 563
 564         /**
 565          * Returns the value of the given response header.
 566          *
 567          * @param $header String
 568          * @return String
 569          */
 570         public function getResponseHeader( $header ) {
 571                 if ( !$this->respHeaders ) {
 572                         $this->parseHeader();
 573                 }
 574
 575                 if ( isset( $this->respHeaders[strtolower( $header )] ) ) {
 576                         $v = $this->respHeaders[strtolower( $header )];
 577                         return $v[count( $v ) - 1];
 578                 }
 579
 580                 return null;
 581         }
 582
 583         /**
 584          * Tells the MWHttpRequest object to use this pre-loaded CookieJar.
 585          *
 586          * @param $jar CookieJar
 587          */
 588         public function setCookieJar( $jar ) {
 589                 $this->cookieJar = $jar;
 590         }
 591
 592         /**
 593          * Returns the cookie jar in use.
 594          *
 595          * @return CookieJar
 596          */
 597         public function getCookieJar() {
 598                 if ( !$this->respHeaders ) {
 599                         $this->parseHeader();
 600                 }
 601
 602                 return $this->cookieJar;
 603         }
 604
 605         /**
 606          * Sets a cookie. Used before a request to set up any individual
 607          * cookies. Used internally after a request to parse the
 608          * Set-Cookie headers.
 609          * @see Cookie::set
 610          * @param $name
 611          * @param $value null
 612          * @param $attr null
 613          */
 614         public function setCookie( $name, $value = null, $attr = null ) {
 615                 if ( !$this->cookieJar ) {
 616                         $this->cookieJar = new CookieJar;
 617                 }
 618
 619                 $this->cookieJar->setCookie( $name, $value, $attr );
 620         }
 621
 622         /**
 623          * Parse the cookies in the response headers and store them in the cookie jar.
 624          */
 625         protected function parseCookies() {
 626                 wfProfileIn( __METHOD__ );
 627
 628                 if ( !$this->cookieJar ) {
 629                         $this->cookieJar = new CookieJar;
 630                 }
 631
 632                 if ( isset( $this->respHeaders['set-cookie'] ) ) {
 633                         $url = parse_url( $this->getFinalUrl() );
 634                         foreach ( $this->respHeaders['set-cookie'] as $cookie ) {
 635                                 $this->cookieJar->parseCookieResponseHeader( $cookie, $url['host'] );
 636                         }
 637                 }
 638
 639                 wfProfileOut( __METHOD__ );
 640         }
 641
 642         /**
 643          * Returns the final URL after all redirections.
 644          *
 645          * Relative values of the "Location" header are incorrect as stated in RFC, however they do happen and modern browsers support them.
 646          * This function loops backwards through all locations in order to build the proper absolute URI - Marooned at wikia-inc.com
 647          *
 648          * Note that the multiple Location: headers are an artifact of CURL -- they
 649          * shouldn't actually get returned this way. Rewrite this when bug 29232 is
 650          * taken care of (high-level redirect handling rewrite).
 651          *
 652          * @return string
 653          */
 654         public function getFinalUrl() {
 655                 $headers = $this->getResponseHeaders();
 656
 657                 //return full url (fix for incorrect but handled relative location)
 658                 if ( isset( $headers['location'] ) ) {
 659                         $locations = $headers['location'];
 660                         $domain = '';
 661                         $foundRelativeURI = false;
 662                         $countLocations = count( $locations );
 663
 664                         for ( $i = $countLocations - 1; $i >= 0; $i-- ) {
 665                                 $url = parse_url( $locations[$i] );
 666
 667                                 if ( isset( $url['host'] ) ) {
 668                                         $domain = $url['scheme'] . '://' . $url['host'];
 669                                         break; //found correct URI (with host)
 670                                 } else {
 671                                         $foundRelativeURI = true;
 672                                 }
 673                         }
 674
 675                         if ( $foundRelativeURI ) {
 676                                 if ( $domain ) {
 677                                         return $domain . $locations[$countLocations - 1];
 678                                 } else {
 679                                         $url = parse_url( $this->url );
 680                                         if ( isset( $url['host'] ) ) {
 681                                                 return $url['scheme'] . '://' . $url['host'] . $locations[$countLocations - 1];
 682                                         }
 683                                 }
 684                         } else {
 685                                 return $locations[$countLocations - 1];
 686                         }
 687                 }
 688
 689                 return $this->url;
 690         }
 691
 692         /**
 693          * Returns true if the backend can follow redirects. Overridden by the
 694          * child classes.
 695          * @return bool
 696          */
 697         public function canFollowRedirects() {
 698                 return true;
 699         }
 700 }
 701
 702 /**
 703  * MWHttpRequest implemented using internal curl compiled into PHP
 704  */
 705 class CurlHttpRequest extends MWHttpRequest {
 706         const SUPPORTS_FILE_POSTS = true;
 707
 708         protected $curlOptions = array();
 709         protected $headerText = "";
 710
 711         /**
 712          * @param $fh
 713          * @param $content
 714          * @return int
 715          */
 716         protected function readHeader( $fh, $content ) {
 717                 $this->headerText .= $content;
 718                 return strlen( $content );
 719         }
 720
 721         public function execute() {
 722                 wfProfileIn( __METHOD__ );
 723
 724                 parent::execute();
 725
 726                 if ( !$this->status->isOK() ) {
 727                         wfProfileOut( __METHOD__ );
 728                         return $this->status;
 729                 }
 730
 731                 $this->curlOptions[CURLOPT_PROXY] = $this->proxy;
 732                 $this->curlOptions[CURLOPT_TIMEOUT] = $this->timeout;
 733                 $this->curlOptions[CURLOPT_CONNECTTIMEOUT_MS] = $this->connectTimeout * 1000;
 734                 $this->curlOptions[CURLOPT_HTTP_VERSION] = CURL_HTTP_VERSION_1_0;
 735                 $this->curlOptions[CURLOPT_WRITEFUNCTION] = $this->callback;
 736                 $this->curlOptions[CURLOPT_HEADERFUNCTION] = array( $this, "readHeader" );
 737                 $this->curlOptions[CURLOPT_MAXREDIRS] = $this->maxRedirects;
 738                 $this->curlOptions[CURLOPT_ENCODING] = ""; # Enable compression
 739
 740                 /* not sure these two are actually necessary */
 741                 if ( isset( $this->reqHeaders['Referer'] ) ) {
 742                         $this->curlOptions[CURLOPT_REFERER] = $this->reqHeaders['Referer'];
 743                 }
 744                 $this->curlOptions[CURLOPT_USERAGENT] = $this->reqHeaders['User-Agent'];
 745
 746                 $this->curlOptions[CURLOPT_SSL_VERIFYHOST] = $this->sslVerifyHost ? 2 : 0;
 747                 $this->curlOptions[CURLOPT_SSL_VERIFYPEER] = $this->sslVerifyCert;
 748
 749                 if ( $this->caInfo ) {
 750                         $this->curlOptions[CURLOPT_CAINFO] = $this->caInfo;
 751                 }
 752
 753                 if ( $this->headersOnly ) {
 754                         $this->curlOptions[CURLOPT_NOBODY] = true;
 755                         $this->curlOptions[CURLOPT_HEADER] = true;
 756                 } elseif ( $this->method == 'POST' ) {
 757                         $this->curlOptions[CURLOPT_POST] = true;
 758                         $this->curlOptions[CURLOPT_POSTFIELDS] = $this->postData;
 759                         // Suppress 'Expect: 100-continue' header, as some servers
 760                         // will reject it with a 417 and Curl won't auto retry
 761                         // with HTTP 1.0 fallback
 762                         $this->reqHeaders['Expect'] = '';
 763                 } else {
 764                         $this->curlOptions[CURLOPT_CUSTOMREQUEST] = $this->method;
 765                 }
 766
 767                 $this->curlOptions[CURLOPT_HTTPHEADER] = $this->getHeaderList();
 768
 769                 $curlHandle = curl_init( $this->url );
 770
 771                 if ( !curl_setopt_array( $curlHandle, $this->curlOptions ) ) {
 772                         wfProfileOut( __METHOD__ );
 773                         throw new MWException( "Error setting curl options." );
 774                 }
 775
 776                 if ( $this->followRedirects && $this->canFollowRedirects() ) {
 777                         wfSuppressWarnings();
 778                         if ( ! curl_setopt( $curlHandle, CURLOPT_FOLLOWLOCATION, true ) ) {
 779                                 wfDebug( __METHOD__ . ": Couldn't set CURLOPT_FOLLOWLOCATION. " .
 780                                         "Probably safe_mode or open_basedir is set.\n" );
 781                                 // Continue the processing. If it were in curl_setopt_array,
 782                                 // processing would have halted on its entry
 783                         }
 784                         wfRestoreWarnings();
 785                 }
 786
 787                 $curlRes = curl_exec( $curlHandle );
 788                 if ( curl_errno( $curlHandle ) == CURLE_OPERATION_TIMEOUTED ) {
 789                         $this->status->fatal( 'http-timed-out', $this->url );
 790                 } elseif ( $curlRes === false ) {
 791                         $this->status->fatal( 'http-curl-error', curl_error( $curlHandle ) );
 792                 } else {
 793                         $this->headerList = explode( "\r\n", $this->headerText );
 794                 }
 795
 796                 curl_close( $curlHandle );
 797
 798                 $this->parseHeader();
 799                 $this->setStatus();
 800
 801                 wfProfileOut( __METHOD__ );
 802
 803                 return $this->status;
 804         }
 805
 806         /**
 807          * @return bool
 808          */
 809         public function canFollowRedirects() {
 810                 if ( strval( ini_get( 'open_basedir' ) ) !== '' || wfIniGetBool( 'safe_mode' ) ) {
 811                         wfDebug( "Cannot follow redirects in safe mode\n" );
 812                         return false;
 813                 }
 814
 815                 if ( !defined( 'CURLOPT_REDIR_PROTOCOLS' ) ) {
 816                         wfDebug( "Cannot follow redirects with libcurl < 7.19.4 due to CVE-2009-0037\n" );
 817                         return false;
 818                 }
 819
 820                 return true;
 821         }
 822 }
 823
 824 class PhpHttpRequest extends MWHttpRequest {
 825
 826         /**
 827          * @param $url string
 828          * @return string
 829          */
 830         protected function urlToTcp( $url ) {
 831                 $parsedUrl = parse_url( $url );
 832
 833                 return 'tcp://' . $parsedUrl['host'] . ':' . $parsedUrl['port'];
 834         }
 835
 836         public function execute() {
 837                 wfProfileIn( __METHOD__ );
 838
 839                 parent::execute();
 840
 841                 if ( is_array( $this->postData ) ) {
 842                         $this->postData = wfArrayToCgi( $this->postData );
 843                 }
 844
 845                 if ( $this->parsedUrl['scheme'] != 'http' &&
 846                          $this->parsedUrl['scheme'] != 'https' ) {
 847                         $this->status->fatal( 'http-invalid-scheme', $this->parsedUrl['scheme'] );
 848                 }
 849
 850                 $this->reqHeaders['Accept'] = "*/*";
 851                 if ( $this->method == 'POST' ) {
 852                         // Required for HTTP 1.0 POSTs
 853                         $this->reqHeaders['Content-Length'] = strlen( $this->postData );
 854                         if ( !isset( $this->reqHeaders['Content-Type'] ) ) {
 855                                 $this->reqHeaders['Content-Type'] = "application/x-www-form-urlencoded";
 856                         }
 857                 }
 858
 859                 $options = array();
 860                 if ( $this->proxy ) {
 861                         $options['proxy'] = $this->urlToTCP( $this->proxy );
 862                         $options['request_fulluri'] = true;
 863                 }
 864
 865                 if ( !$this->followRedirects ) {
 866                         $options['max_redirects'] = 0;
 867                 } else {
 868                         $options['max_redirects'] = $this->maxRedirects;
 869                 }
 870
 871                 $options['method'] = $this->method;
 872                 $options['header'] = implode( "\r\n", $this->getHeaderList() );
 873                 // Note that at some future point we may want to support
 874                 // HTTP/1.1, but we'd have to write support for chunking
 875                 // in version of PHP < 5.3.1
 876                 $options['protocol_version'] = "1.0";
 877
 878                 // This is how we tell PHP we want to deal with 404s (for example) ourselves.
 879                 // Only works on 5.2.10+
 880                 $options['ignore_errors'] = true;
 881
 882                 if ( $this->postData ) {
 883                         $options['content'] = $this->postData;
 884                 }
 885
 886                 $options['timeout'] = $this->timeout;
 887
 888                 if ( $this->sslVerifyHost ) {
 889                         $options['CN_match'] = $this->parsedUrl['host'];
 890                 }
 891                 if ( $this->sslVerifyCert ) {
 892                         $options['verify_peer'] = true;
 893                 }
 894
 895                 if ( is_dir( $this->caInfo ) ) {
 896                         $options['capath'] = $this->caInfo;
 897                 } elseif ( is_file( $this->caInfo ) ) {
 898                         $options['cafile'] = $this->caInfo;
 899                 } elseif ( $this->caInfo ) {
 900                         throw new MWException( "Invalid CA info passed: {$this->caInfo}" );
 901                 }
 902
 903                 $scheme = $this->parsedUrl['scheme'];
 904                 $context = stream_context_create( array( "$scheme" => $options ) );
 905
 906                 $this->headerList = array();
 907                 $reqCount = 0;
 908                 $url = $this->url;
 909
 910                 $result = array();
 911
 912                 do {
 913                         $reqCount++;
 914                         wfSuppressWarnings();
 915                         $fh = fopen( $url, "r", false, $context );
 916                         wfRestoreWarnings();
 917
 918                         if ( !$fh ) {
 919                                 break;
 920                         }
 921
 922                         $result = stream_get_meta_data( $fh );
 923                         $this->headerList = $result['wrapper_data'];
 924                         $this->parseHeader();
 925
 926                         if ( !$this->followRedirects ) {
 927                                 break;
 928                         }
 929
 930                         # Handle manual redirection
 931                         if ( !$this->isRedirect() || $reqCount > $this->maxRedirects ) {
 932                                 break;
 933                         }
 934                         # Check security of URL
 935                         $url = $this->getResponseHeader( "Location" );
 936
 937                         if ( !Http::isValidURI( $url ) ) {
 938                                 wfDebug( __METHOD__ . ": insecure redirection\n" );
 939                                 break;
 940                         }
 941                 } while ( true );
 942
 943                 $this->setStatus();
 944
 945                 if ( $fh === false ) {
 946                         $this->status->fatal( 'http-request-error' );
 947                         wfProfileOut( __METHOD__ );
 948                         return $this->status;
 949                 }
 950
 951                 if ( $result['timed_out'] ) {
 952                         $this->status->fatal( 'http-timed-out', $this->url );
 953                         wfProfileOut( __METHOD__ );
 954                         return $this->status;
 955                 }
 956
 957                 // If everything went OK, or we received some error code
 958                 // get the response body content.
 959                 if ( $this->status->isOK() || (int)$this->respStatus >= 300 ) {
 960                         while ( !feof( $fh ) ) {
 961                                 $buf = fread( $fh, 8192 );
 962
 963                                 if ( $buf === false ) {
 964                                         $this->status->fatal( 'http-read-error' );
 965                                         break;
 966                                 }
 967
 968                                 if ( strlen( $buf ) ) {
 969                                         call_user_func( $this->callback, $fh, $buf );
 970                                 }
 971                         }
 972                 }
 973                 fclose( $fh );
 974
 975                 wfProfileOut( __METHOD__ );
 976
 977                 return $this->status;
 978         }
 979 }