includes/http/CurlHttpRequest.php

   1 <?php
   2 /**
   3  * This program is free software; you can redistribute it and/or modify
   4  * it under the terms of the GNU General Public License as published by
   5  * the Free Software Foundation; either version 2 of the License, or
   6  * (at your option) any later version.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public License along
  14  * with this program; if not, write to the Free Software Foundation, Inc.,
  15  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  16  * http://www.gnu.org/copyleft/gpl.html
  17  *
  18  * @file
  19  */
  20
  21 /**
  22  * MWHttpRequest implemented using internal curl compiled into PHP
  23  */
  24 class CurlHttpRequest extends MWHttpRequest {
  25         const SUPPORTS_FILE_POSTS = true;
  26
  27         protected $curlOptions = [];
  28         protected $headerText = "";
  29
  30         /**
  31          * @param resource $fh
  32          * @param string $content
  33          * @return int
  34          */
  35         protected function readHeader( $fh, $content ) {
  36                 $this->headerText .= $content;
  37                 return strlen( $content );
  38         }
  39
  40         /**
  41          * @see MWHttpRequest::execute
  42          *
  43          * @throws MWException
  44          * @return Status
  45          */
  46         public function execute() {
  47                 $this->prepare();
  48
  49                 if ( !$this->status->isOK() ) {
  50                         return Status::wrap( $this->status ); // TODO B/C; move this to callers
  51                 }
  52
  53                 $this->curlOptions[CURLOPT_PROXY] = $this->proxy;
  54                 $this->curlOptions[CURLOPT_TIMEOUT] = $this->timeout;
  55
  56                 // Only supported in curl >= 7.16.2
  57                 if ( defined( 'CURLOPT_CONNECTTIMEOUT_MS' ) ) {
  58                         $this->curlOptions[CURLOPT_CONNECTTIMEOUT_MS] = $this->connectTimeout * 1000;
  59                 }
  60
  61                 $this->curlOptions[CURLOPT_HTTP_VERSION] = CURL_HTTP_VERSION_1_0;
  62                 $this->curlOptions[CURLOPT_WRITEFUNCTION] = $this->callback;
  63                 $this->curlOptions[CURLOPT_HEADERFUNCTION] = [ $this, "readHeader" ];
  64                 $this->curlOptions[CURLOPT_MAXREDIRS] = $this->maxRedirects;
  65                 $this->curlOptions[CURLOPT_ENCODING] = ""; # Enable compression
  66
  67                 $this->curlOptions[CURLOPT_USERAGENT] = $this->reqHeaders['User-Agent'];
  68
  69                 $this->curlOptions[CURLOPT_SSL_VERIFYHOST] = $this->sslVerifyHost ? 2 : 0;
  70                 $this->curlOptions[CURLOPT_SSL_VERIFYPEER] = $this->sslVerifyCert;
  71
  72                 if ( $this->caInfo ) {
  73                         $this->curlOptions[CURLOPT_CAINFO] = $this->caInfo;
  74                 }
  75
  76                 if ( $this->headersOnly ) {
  77                         $this->curlOptions[CURLOPT_NOBODY] = true;
  78                         $this->curlOptions[CURLOPT_HEADER] = true;
  79                 } elseif ( $this->method == 'POST' ) {
  80                         $this->curlOptions[CURLOPT_POST] = true;
  81                         $postData = $this->postData;
  82                         // Don't interpret POST parameters starting with '@' as file uploads, because this
  83                         // makes it impossible to POST plain values starting with '@' (and causes security
  84                         // issues potentially exposing the contents of local files).
  85                         // The PHP manual says this option was introduced in PHP 5.5 defaults to true in PHP 5.6,
  86                         // but we support lower versions, and the option doesn't exist in HHVM 5.6.99.
  87                         if ( defined( 'CURLOPT_SAFE_UPLOAD' ) ) {
  88                                 $this->curlOptions[CURLOPT_SAFE_UPLOAD] = true;
  89                         } elseif ( is_array( $postData ) ) {
  90                                 // In PHP 5.2 and later, '@' is interpreted as a file upload if POSTFIELDS
  91                                 // is an array, but not if it's a string. So convert $req['body'] to a string
  92                                 // for safety.
  93                                 $postData = wfArrayToCgi( $postData );
  94                         }
  95                         $this->curlOptions[CURLOPT_POSTFIELDS] = $postData;
  96
  97                         // Suppress 'Expect: 100-continue' header, as some servers
  98                         // will reject it with a 417 and Curl won't auto retry
  99                         // with HTTP 1.0 fallback
 100                         $this->reqHeaders['Expect'] = '';
 101                 } else {
 102                         $this->curlOptions[CURLOPT_CUSTOMREQUEST] = $this->method;
 103                 }
 104
 105                 $this->curlOptions[CURLOPT_HTTPHEADER] = $this->getHeaderList();
 106
 107                 $curlHandle = curl_init( $this->url );
 108
 109                 if ( !curl_setopt_array( $curlHandle, $this->curlOptions ) ) {
 110                         throw new InvalidArgumentException( "Error setting curl options." );
 111                 }
 112
 113                 if ( $this->followRedirects && $this->canFollowRedirects() ) {
 114                         Wikimedia\suppressWarnings();
 115                         if ( !curl_setopt( $curlHandle, CURLOPT_FOLLOWLOCATION, true ) ) {
 116                                 $this->logger->debug( __METHOD__ . ": Couldn't set CURLOPT_FOLLOWLOCATION. " .
 117                                         "Probably open_basedir is set.\n" );
 118                                 // Continue the processing. If it were in curl_setopt_array,
 119                                 // processing would have halted on its entry
 120                         }
 121                         Wikimedia\restoreWarnings();
 122                 }
 123
 124                 if ( $this->profiler ) {
 125                         $profileSection = $this->profiler->scopedProfileIn(
 126                                 __METHOD__ . '-' . $this->profileName
 127                         );
 128                 }
 129
 130                 $curlRes = curl_exec( $curlHandle );
 131                 if ( curl_errno( $curlHandle ) == CURLE_OPERATION_TIMEOUTED ) {
 132                         $this->status->fatal( 'http-timed-out', $this->url );
 133                 } elseif ( $curlRes === false ) {
 134                         $this->status->fatal( 'http-curl-error', curl_error( $curlHandle ) );
 135                 } else {
 136                         $this->headerList = explode( "\r\n", $this->headerText );
 137                 }
 138
 139                 curl_close( $curlHandle );
 140
 141                 if ( $this->profiler ) {
 142                         $this->profiler->scopedProfileOut( $profileSection );
 143                 }
 144
 145                 $this->parseHeader();
 146                 $this->setStatus();
 147
 148                 return Status::wrap( $this->status ); // TODO B/C; move this to callers
 149         }
 150
 151         /**
 152          * @return bool
 153          */
 154         public function canFollowRedirects() {
 155                 $curlVersionInfo = curl_version();
 156                 if ( $curlVersionInfo['version_number'] < 0x071304 ) {
 157                         $this->logger->debug( "Cannot follow redirects with libcurl < 7.19.4 due to CVE-2009-0037\n" );
 158                         return false;
 159                 }
 160
 161                 if ( version_compare( PHP_VERSION, '5.6.0', '<' ) ) {
 162                         if ( strval( ini_get( 'open_basedir' ) ) !== '' ) {
 163                                 $this->logger->debug( "Cannot follow redirects when open_basedir is set\n" );
 164                                 return false;
 165                         }
 166                 }
 167
 168                 return true;
 169         }
 170 }