X-Git-Url: https://git.heureux-cyclage.org/?a=blobdiff_plain;f=img_auth.php;h=11684b375e5531d443524153d2d1653391057cda;hb=0eacc92ef5126b28fd7bbd701faee30a0c90b59c;hp=fb58ba2823353d1f02528a3d6d7975e03fdda063;hpb=266d41f165fe23e85f70f90891f951b0b0bcda7a;p=lhc%2Fweb%2Fwiklou.git
diff --git a/img_auth.php b/img_auth.php
index fb58ba2823..11684b375e 100644
--- a/img_auth.php
+++ b/img_auth.php
@@ -7,54 +7,56 @@
* to an array of pages you want everyone to be able to access. Your server must
* support PATH_INFO, CGI-based configurations generally don't.
*/
-# Valid web server entry point, enable includes
-define( 'MEDIAWIKI', true );
-
-if ( isset( $_REQUEST['GLOBALS'] ) ) {
- echo '$GLOBALS overwrite vulnerability';
- die( -1 );
-}
-
-require_once( 'includes/Defines.php' );
-require_once( './LocalSettings.php' );
-require_once( 'includes/Setup.php' );
-require_once( 'includes/StreamFile.php' );
+define( 'MW_NO_OUTPUT_COMPRESSION', 1 );
+require_once( './includes/WebStart.php' );
+wfProfileIn( 'img_auth.php' );
+require_once( './includes/StreamFile.php' );
if( !isset( $_SERVER['PATH_INFO'] ) ) {
+ wfDebugLog( 'img_auth', "missing PATH_INFO" );
wfForbidden();
}
# Get filenames/directories
+wfDebugLog( 'img_auth', "PATH_INFO is: " . $_SERVER['PATH_INFO'] );
$filename = realpath( $wgUploadDirectory . $_SERVER['PATH_INFO'] );
$realUploadDirectory = realpath( $wgUploadDirectory );
-$imageName = $wgLang->getNsText( NS_IMAGE ) . ":" . basename( $_SERVER['PATH_INFO'] );
+$imageName = $wgContLang->getNsText( NS_IMAGE ) . ":" . wfBaseName( $_SERVER['PATH_INFO'] );
# Check if the filename is in the correct directory
if ( substr( $filename, 0, strlen( $realUploadDirectory ) ) != $realUploadDirectory ) {
+ wfDebugLog( 'img_auth', "requested path not in upload dir: $filename" );
wfForbidden();
}
if ( is_array( $wgWhitelistRead ) && !in_array( $imageName, $wgWhitelistRead ) && !$wgUser->getID() ) {
+ wfDebugLog( 'img_auth', "not logged in and requested file not in whitelist: $imageName" );
wfForbidden();
}
if( !file_exists( $filename ) ) {
+ wfDebugLog( 'img_auth', "requested file does not exist: $filename" );
wfForbidden();
}
if( is_dir( $filename ) ) {
+ wfDebugLog( 'img_auth', "requested file is a directory: $filename" );
wfForbidden();
}
# Write file
+wfDebugLog( 'img_auth', "streaming file: $filename" );
wfStreamFile( $filename );
+wfLogProfilingData();
function wfForbidden() {
header( 'HTTP/1.0 403 Forbidden' );
+ header( 'Content-Type: text/html; charset=utf-8' );
print
"
Access denied
You need to log in to access files on this server
";
+ wfLogProfilingData();
exit;
}