includes/StreamFile.php

   1 <?php
   2 /**
   3  * Functions related to the output of file content.
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  */
  22
  23 /**
  24  * Functions related to the output of file content
  25  */
  26 class StreamFile {
  27         // Do not send any HTTP headers unless requested by caller (e.g. body only)
  28         const STREAM_HEADLESS = HTTPFileStreamer::STREAM_HEADLESS;
  29         // Do not try to tear down any PHP output buffers
  30         const STREAM_ALLOW_OB = HTTPFileStreamer::STREAM_ALLOW_OB;
  31
  32         /**
  33          * Stream a file to the browser, adding all the headings and fun stuff.
  34          * Headers sent include: Content-type, Content-Length, Last-Modified,
  35          * and Content-Disposition.
  36          *
  37          * @param string $fname Full name and path of the file to stream
  38          * @param array $headers Any additional headers to send if the file exists
  39          * @param bool $sendErrors Send error messages if errors occur (like 404)
  40          * @param array $optHeaders HTTP request header map (e.g. "range") (use lowercase keys)
  41          * @param int $flags Bitfield of STREAM_* constants
  42          * @throws MWException
  43          * @return bool Success
  44          */
  45         public static function stream(
  46                 $fname, $headers = [], $sendErrors = true, $optHeaders = [], $flags = 0
  47         ) {
  48                 if ( FileBackend::isStoragePath( $fname ) ) { // sanity
  49                         throw new InvalidArgumentException( __FUNCTION__ . " given storage path '$fname'." );
  50                 }
  51
  52                 $streamer = new HTTPFileStreamer(
  53                         $fname,
  54                         [
  55                                 'obResetFunc' => 'wfResetOutputBuffers',
  56                                 'streamMimeFunc' => [ __CLASS__, 'contentTypeFromPath' ]
  57                         ]
  58                 );
  59
  60                 return $streamer->stream( $headers, $sendErrors, $optHeaders, $flags );
  61         }
  62
  63         /**
  64          * Send out a standard 404 message for a file
  65          *
  66          * @param string $fname Full name and path of the file to stream
  67          * @param int $flags Bitfield of STREAM_* constants
  68          * @since 1.24
  69          */
  70         public static function send404Message( $fname, $flags = 0 ) {
  71                 HTTPFileStreamer::send404Message( $fname, $flags );
  72         }
  73
  74         /**
  75          * Convert a Range header value to an absolute (start, end) range tuple
  76          *
  77          * @param string $range Range header value
  78          * @param int $size File size
  79          * @return array|string Returns error string on failure (start, end, length)
  80          * @since 1.24
  81          */
  82         public static function parseRange( $range, $size ) {
  83                 return HTTPFileStreamer::parseRange( $range, $size );
  84         }
  85
  86         /**
  87          * Determine the file type of a file based on the path
  88          *
  89          * @param string $filename Storage path or file system path
  90          * @param bool $safe Whether to do retroactive upload blacklist checks
  91          * @return null|string
  92          */
  93         public static function contentTypeFromPath( $filename, $safe = true ) {
  94                 global $wgTrivialMimeDetection;
  95
  96                 $ext = strrchr( $filename, '.' );
  97                 $ext = $ext === false ? '' : strtolower( substr( $ext, 1 ) );
  98
  99                 # trivial detection by file extension,
 100                 # used for thumbnails (thumb.php)
 101                 if ( $wgTrivialMimeDetection ) {
 102                         switch ( $ext ) {
 103                                 case 'gif':
 104                                         return 'image/gif';
 105                                 case 'png':
 106                                         return 'image/png';
 107                                 case 'jpg':
 108                                         return 'image/jpeg';
 109                                 case 'jpeg':
 110                                         return 'image/jpeg';
 111                         }
 112
 113                         return 'unknown/unknown';
 114                 }
 115
 116                 $magic = MediaWiki\MediaWikiServices::getInstance()->getMimeAnalyzer();
 117                 // Use the extension only, rather than magic numbers, to avoid opening
 118                 // up vulnerabilities due to uploads of files with allowed extensions
 119                 // but disallowed types.
 120                 $type = $magic->guessTypesForExtension( $ext );
 121
 122                 /**
 123                  * Double-check some security settings that were done on upload but might
 124                  * have changed since.
 125                  */
 126                 if ( $safe ) {
 127                         global $wgFileBlacklist, $wgCheckFileExtensions, $wgStrictFileExtensions,
 128                                 $wgFileExtensions, $wgVerifyMimeType, $wgMimeTypeBlacklist;
 129                         list( , $extList ) = UploadBase::splitExtensions( $filename );
 130                         if ( UploadBase::checkFileExtensionList( $extList, $wgFileBlacklist ) ) {
 131                                 return 'unknown/unknown';
 132                         }
 133                         if ( $wgCheckFileExtensions && $wgStrictFileExtensions
 134                                 && !UploadBase::checkFileExtensionList( $extList, $wgFileExtensions )
 135                         ) {
 136                                 return 'unknown/unknown';
 137                         }
 138                         if ( $wgVerifyMimeType && in_array( strtolower( $type ), $wgMimeTypeBlacklist ) ) {
 139                                 return 'unknown/unknown';
 140                         }
 141                 }
 142                 return $type;
 143         }
 144 }