img_auth.php

   1 <?php
   2 /**
   3  * Image download authorisation script
   4  *
   5  * To use, in LocalSettings.php set $wgUploadDirectory to point to a non-public
   6  * directory, and $wgUploadPath to point to this file. Also set $wgWhitelistRead
   7  * to an array of pages you want everyone to be able to access. Your server must
   8  * support PATH_INFO, CGI-based configurations generally don't.
   9  */
  10 define( 'MW_NO_OUTPUT_COMPRESSION', 1 );
  11 require_once( './includes/WebStart.php' );
  12 wfProfileIn( 'img_auth.php' );
  13 require_once( './includes/StreamFile.php' );
  14
  15 if( !isset( $_SERVER['PATH_INFO'] ) ) {
  16         wfDebugLog( 'img_auth', "missing PATH_INFO" );
  17         wfForbidden();
  18 }
  19
  20 # Get filenames/directories
  21 wfDebugLog( 'img_auth', "PATH_INFO is: " . $_SERVER['PATH_INFO'] );
  22 $filename = realpath( $wgUploadDirectory . $_SERVER['PATH_INFO'] );
  23 $realUploadDirectory = realpath( $wgUploadDirectory );
  24 $imageName = $wgContLang->getNsText( NS_IMAGE ) . ":" . wfBaseName( $_SERVER['PATH_INFO'] );
  25
  26 # Check if the filename is in the correct directory
  27 if ( substr( $filename, 0, strlen( $realUploadDirectory ) ) != $realUploadDirectory ) {
  28         wfDebugLog( 'img_auth', "requested path not in upload dir: $filename" );
  29         wfForbidden();
  30 }
  31
  32 if ( is_array( $wgWhitelistRead ) && !in_array( $imageName, $wgWhitelistRead ) && !$wgUser->getID() ) {
  33         wfDebugLog( 'img_auth', "not logged in and requested file not in whitelist: $imageName" );
  34         wfForbidden();
  35 }
  36
  37 if( !file_exists( $filename ) ) {
  38         wfDebugLog( 'img_auth', "requested file does not exist: $filename" );
  39         wfForbidden();
  40 }
  41 if( is_dir( $filename ) ) {
  42         wfDebugLog( 'img_auth', "requested file is a directory: $filename" );
  43         wfForbidden();
  44 }
  45
  46 # Write file
  47 wfDebugLog( 'img_auth', "streaming file: $filename" );
  48 wfStreamFile( $filename );
  49 wfLogProfilingData();
  50
  51 function wfForbidden() {
  52         header( 'HTTP/1.0 403 Forbidden' );
  53         header( 'Content-Type: text/html; charset=utf-8' );
  54         print
  55 "<html><body>
  56 <h1>Access denied</h1>
  57 <p>You need to log in to access files on this server</p>
  58 </body></html>";
  59         wfLogProfilingData();
  60         exit;
  61 }
  62
  63