X-Git-Url: https://git.heureux-cyclage.org/?a=blobdiff_plain;f=img_auth.php;h=2e8f6240f718d02b8fec10e621dbc7c13a5377d7;hb=f9a14959a5f0bef794c482c8a7fffc83b4e5c19b;hp=6f6152eb1332c8c8801e10d129af560239a0c0ce;hpb=9411d91b49b50de73f878d7e677d5209030d751a;p=lhc%2Fweb%2Fwiklou.git
diff --git a/img_auth.php b/img_auth.php
index 6f6152eb13..2e8f6240f7 100644
--- a/img_auth.php
+++ b/img_auth.php
@@ -1,56 +1,89 @@
getNsText( NS_IMAGE ) . ":" . basename( $_SERVER['PATH_INFO'] );
+$realUpload = realpath( $wgUploadDirectory );
+wfDebugLog( 'img_auth', "\$path is {$path}" );
+wfDebugLog( 'img_auth', "\$filename is {$filename}" );
+
+// Basic directory traversal check
+if( substr( $filename, 0, strlen( $realUpload ) ) != $realUpload ) {
+ wfDebugLog( 'img_auth', 'Requested path not in upload directory' );
+ wfForbidden();
+}
-# Check if the filename is in the correct directory
-if ( substr( $filename, 0, strlen( $realUploadDirectory ) ) != $realUploadDirectory ) {
+// Extract the file name and chop off the size specifier
+// (e.g. 120px-Foo.png => Foo.png)
+$name = wfBaseName( $path );
+if( preg_match( '!\d+px-(.*)!i', $name, $m ) )
+ $name = $m[1];
+wfDebugLog( 'img_auth', "\$name is {$name}" );
+
+$title = Title::makeTitleSafe( NS_IMAGE, $name );
+if( !$title instanceof Title ) {
+ wfDebugLog( 'img_auth', "Unable to construct a valid Title from `{$name}`" );
wfForbidden();
}
+$title = $title->getPrefixedText();
-if ( is_array( $wgWhitelistRead ) && !in_array( $imageName, $wgWhitelistRead ) && !$wgUser->getID() ) {
+// Check the whitelist if needed
+if( !$wgUser->getId() && ( !is_array( $wgWhitelistRead ) || !in_array( $title, $wgWhitelistRead ) ) ) {
+ wfDebugLog( 'img_auth', "Not logged in and `{$title}` not in whitelist." );
wfForbidden();
}
if( !file_exists( $filename ) ) {
+ wfDebugLog( 'img_auth', "`{$filename}` does not exist" );
wfForbidden();
}
if( is_dir( $filename ) ) {
+ wfDebugLog( 'img_auth', "`{$filename}` is a directory" );
wfForbidden();
}
-# Write file
+// Stream the requested file
+wfDebugLog( 'img_auth', "Streaming `{$filename}`" );
wfStreamFile( $filename );
+wfLogProfilingData();
+/**
+ * Issue a standard HTTP 403 Forbidden header and a basic
+ * error message, then end the script
+ */
function wfForbidden() {
header( 'HTTP/1.0 403 Forbidden' );
- print
-"
-Access denied
-You need to log in to access files on this server
-";
- exit;
-}
-
-?>
+ header( 'Content-Type: text/html; charset=utf-8' );
+ echo <<
+
+Access Denied
+You need to log in to access files on this server.
+
+