Fix resource path check when ResourceBasePath is an empty string

If you have MediaWiki installed in the root of the domain, then
$wgScriptPath and $wgResourceBasePath is an empty string. In HHVM and
PHP, passing an empty string as the second parameter of strpos() causes
a warning and returns false, which will cause the condition to fail, as
if the path were not within the base path.

So, normalize such paths. Using substr() instead of strpos() for a
"starts with" check would have worked except that RelPath also fails
when given an empty string.

Bug: T127652
Change-Id: If7e94ae638d6834f7cc0f31f67a5fe6a2f74771c

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index 2570cfb..5d1d5d0 100644 (file)
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -3870,13 +3870,20 @@ class OutputPage extends ContextSource {
         */
        public static function transformResourcePath( Config $config, $path ) {
                global $IP;
-               $remotePath = $config->get( 'ResourceBasePath' );
+               $remotePathPrefix = $config->get( 'ResourceBasePath' );
+               if ( $remotePathPrefix === '' ) {
+                       // The configured base path is required to be empty string for
+                       // wikis in the domain root
+                       $remotePath = '/';
+               } else {
+                       $remotePath = $remotePathPrefix;
+               }
                if ( strpos( $path, $remotePath ) !== 0 ) {
                        // Path is outside wgResourceBasePath, ignore.
                        return $path;
                }
                $path = RelPath\getRelativePath( $path, $remotePath );
-               return self::transformFilePath( $remotePath, $IP, $path );
+               return self::transformFilePath( $remotePathPrefix, $IP, $path );
        }
 
        /**
@@ -3885,18 +3892,18 @@ class OutputPage extends ContextSource {
         * Caller is responsible for ensuring the file exists. Emits a PHP warning otherwise.
         *
         * @since 1.27
-        * @param string $remotePath URL path that points to $localPath
+        * @param string $remotePath URL path prefix that points to $localPath
         * @param string $localPath File directory exposed at $remotePath
         * @param string $file Path to target file relative to $localPath
         * @return string URL
         */
-       public static function transformFilePath( $remotePath, $localPath, $file ) {
+       public static function transformFilePath( $remotePathPrefix, $localPath, $file ) {
                $hash = md5_file( "$localPath/$file" );
                if ( $hash === false ) {
                        wfLogWarning( __METHOD__ . ": Failed to hash $localPath/$file" );
                        $hash = '';
                }
-               return "$remotePath/$file?" . substr( $hash, 0, 5 );
+               return "$remotePathPrefix/$file?" . substr( $hash, 0, 5 );
        }
 
        /**