3 * Functions related to the output of file content
9 * Stream a file to the browser, adding all the headings and fun stuff.
10 * Headers sent include: Content-type, Content-Length, Last-Modified,
11 * and Content-Disposition.
13 * @param $fname string Full name and path of the file to stream
14 * @param $headers array Any additional headers to send
15 * @param $sendErrors bool Send error messages if errors occur (like 404)
16 * @return bool Success
18 public static function stream( $fname, $headers = array(), $sendErrors = true ) {
19 global $wgLanguageCode;
22 $stat = stat( $fname );
26 header( 'HTTP/1.0 404 Not Found' );
27 header( 'Cache-Control: no-cache' );
28 header( 'Content-Type: text/html; charset=utf-8' );
29 $encFile = htmlspecialchars( $fname );
30 $encScript = htmlspecialchars( $_SERVER['SCRIPT_NAME'] );
32 <h1>File not found</h1>
33 <p>Although this PHP script ($encScript) exists, the file requested for output
34 ($encFile) does not.</p>
41 header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s', $stat['mtime'] ) . ' GMT' );
43 // Cancel output buffering and gzipping if set
44 wfResetOutputBuffers();
46 $type = self
::getType( $fname );
47 if ( $type && $type != 'unknown/unknown' ) {
48 header( "Content-type: $type" );
50 header( 'Content-type: application/x-wiki' );
53 // Don't stream it out as text/html if there was a PHP error
54 if ( headers_sent() ) {
55 echo "Headers already sent, terminating.\n";
59 header( "Content-Disposition: inline;filename*=utf-8'$wgLanguageCode'" .
60 urlencode( basename( $fname ) ) );
62 // Send additional headers
63 foreach ( $headers as $header ) {
67 // Don't send if client has up to date cache
68 if ( !empty( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) ) {
69 $modsince = preg_replace( '/;.*$/', '', $_SERVER['HTTP_IF_MODIFIED_SINCE'] );
70 $sinceTime = strtotime( $modsince );
71 if ( $stat['mtime'] <= $sinceTime ) {
72 ini_set( 'zlib.output_compression', 0 );
73 header( "HTTP/1.0 304 Not Modified" );
78 header( 'Content-Length: ' . $stat['size'] );
80 return readfile( $fname );
84 * Determine the filetype we're dealing with
85 * @param $filename string
89 private static function getType( $filename, $safe = true ) {
90 global $wgTrivialMimeDetection;
92 $ext = strrchr( $filename, '.' );
93 $ext = $ext === false ?
'' : strtolower( substr( $ext, 1 ) );
95 # trivial detection by file extension,
96 # used for thumbnails (thumb.php)
97 if ( $wgTrivialMimeDetection ) {
99 case 'gif': return 'image/gif';
100 case 'png': return 'image/png';
101 case 'jpg': return 'image/jpeg';
102 case 'jpeg': return 'image/jpeg';
105 return 'unknown/unknown';
108 $magic = MimeMagic
::singleton();
109 // Use the extension only, rather than magic numbers, to avoid opening
110 // up vulnerabilities due to uploads of files with allowed extensions
111 // but disallowed types.
112 $type = $magic->guessTypesForExtension( $ext );
115 * Double-check some security settings that were done on upload but might
116 * have changed since.
119 global $wgFileBlacklist, $wgCheckFileExtensions, $wgStrictFileExtensions,
120 $wgFileExtensions, $wgVerifyMimeType, $wgMimeTypeBlacklist;
121 list( , $extList ) = UploadBase
::splitExtensions( $filename );
122 if ( UploadBase
::checkFileExtensionList( $extList, $wgFileBlacklist ) ) {
123 return 'unknown/unknown';
125 if ( $wgCheckFileExtensions && $wgStrictFileExtensions
126 && !UploadBase
::checkFileExtensionList( $extList, $wgFileExtensions ) )
128 return 'unknown/unknown';
130 if ( $wgVerifyMimeType && in_array( strtolower( $type ), $wgMimeTypeBlacklist ) ) {
131 return 'unknown/unknown';