includes/StreamFile.php

   1 <?php
   2 /**
   3  * Functions related to the output of file content
   4  *
   5  * @file
   6  */
   7 class StreamFile {
   8         /**
   9          * Stream a file to the browser, adding all the headings and fun stuff.
  10          * Headers sent include: Content-type, Content-Length, Last-Modified,
  11          * and Content-Disposition.
  12          *
  13          * @param $fname string Full name and path of the file to stream
  14          * @param $headers array Any additional headers to send
  15          * @param $sendErrors bool Send error messages if errors occur (like 404)
  16          * @return bool Success
  17          */
  18         public static function stream( $fname, $headers = array(), $sendErrors = true ) {
  19                 global $wgLanguageCode;
  20
  21                 wfSuppressWarnings();
  22                 $stat = stat( $fname );
  23                 wfRestoreWarnings();
  24                 if ( !$stat ) {
  25                         if ( $sendErrors ) {
  26                                 header( 'HTTP/1.0 404 Not Found' );
  27                                 header( 'Cache-Control: no-cache' );
  28                                 header( 'Content-Type: text/html; charset=utf-8' );
  29                                 $encFile = htmlspecialchars( $fname );
  30                                 $encScript = htmlspecialchars( $_SERVER['SCRIPT_NAME'] );
  31                                 echo "<html><body>
  32                                         <h1>File not found</h1>
  33                                         <p>Although this PHP script ($encScript) exists, the file requested for output
  34                                         ($encFile) does not.</p>
  35                                         </body></html>
  36                                         ";
  37                         }
  38                         return false;
  39                 }
  40
  41                 header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s', $stat['mtime'] ) . ' GMT' );
  42
  43                 // Cancel output buffering and gzipping if set
  44                 wfResetOutputBuffers();
  45
  46                 $type = self::getType( $fname );
  47                 if ( $type && $type != 'unknown/unknown' ) {
  48                         header( "Content-type: $type" );
  49                 } else {
  50                         header( 'Content-type: application/x-wiki' );
  51                 }
  52
  53                 // Don't stream it out as text/html if there was a PHP error
  54                 if ( headers_sent() ) {
  55                         echo "Headers already sent, terminating.\n";
  56                         return false;
  57                 }
  58
  59                 header( "Content-Disposition: inline;filename*=utf-8'$wgLanguageCode'" .
  60                         urlencode( basename( $fname ) ) );
  61
  62                 // Send additional headers
  63                 foreach ( $headers as $header ) {
  64                         header( $header );
  65                 }
  66
  67                 // Don't send if client has up to date cache
  68                 if ( !empty( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) ) {
  69                         $modsince = preg_replace( '/;.*$/', '', $_SERVER['HTTP_IF_MODIFIED_SINCE'] );
  70                         $sinceTime = strtotime( $modsince );
  71                         if ( $stat['mtime'] <= $sinceTime ) {
  72                                 ini_set( 'zlib.output_compression', 0 );
  73                                 header( "HTTP/1.0 304 Not Modified" );
  74                                 return true; // ok
  75                         }
  76                 }
  77
  78                 header( 'Content-Length: ' . $stat['size'] );
  79
  80                 return readfile( $fname );
  81         }
  82
  83         /**
  84          * Determine the filetype we're dealing with
  85          * @param $filename string
  86          * @param $safe bool
  87          * @return null|string
  88          */
  89         private static function getType( $filename, $safe = true ) {
  90                 global $wgTrivialMimeDetection;
  91
  92                 $ext = strrchr( $filename, '.' );
  93                 $ext = $ext === false ? '' : strtolower( substr( $ext, 1 ) );
  94
  95                 # trivial detection by file extension,
  96                 # used for thumbnails (thumb.php)
  97                 if ( $wgTrivialMimeDetection ) {
  98                         switch ( $ext ) {
  99                                 case 'gif': return 'image/gif';
 100                                 case 'png': return 'image/png';
 101                                 case 'jpg': return 'image/jpeg';
 102                                 case 'jpeg': return 'image/jpeg';
 103                         }
 104
 105                         return 'unknown/unknown';
 106                 }
 107
 108                 $magic = MimeMagic::singleton();
 109                 // Use the extension only, rather than magic numbers, to avoid opening
 110                 // up vulnerabilities due to uploads of files with allowed extensions
 111                 // but disallowed types.
 112                 $type = $magic->guessTypesForExtension( $ext );
 113
 114                 /**
 115                  * Double-check some security settings that were done on upload but might
 116                  * have changed since.
 117                  */
 118                 if ( $safe ) {
 119                         global $wgFileBlacklist, $wgCheckFileExtensions, $wgStrictFileExtensions,
 120                                 $wgFileExtensions, $wgVerifyMimeType, $wgMimeTypeBlacklist;
 121                         list( , $extList ) = UploadBase::splitExtensions( $filename );
 122                         if ( UploadBase::checkFileExtensionList( $extList, $wgFileBlacklist ) ) {
 123                                 return 'unknown/unknown';
 124                         }
 125                         if ( $wgCheckFileExtensions && $wgStrictFileExtensions
 126                                 && !UploadBase::checkFileExtensionList( $extList, $wgFileExtensions ) )
 127                         {
 128                                 return 'unknown/unknown';
 129                         }
 130                         if ( $wgVerifyMimeType && in_array( strtolower( $type ), $wgMimeTypeBlacklist ) ) {
 131                                 return 'unknown/unknown';
 132                         }
 133                 }
 134                 return $type;
 135         }
 136 }