includes/http/CurlHttpRequest.php

   1 <?php
   2 /**
   3  * This program is free software; you can redistribute it and/or modify
   4  * it under the terms of the GNU General Public License as published by
   5  * the Free Software Foundation; either version 2 of the License, or
   6  * (at your option) any later version.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public License along
  14  * with this program; if not, write to the Free Software Foundation, Inc.,
  15  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  16  * http://www.gnu.org/copyleft/gpl.html
  17  *
  18  * @file
  19  */
  20
  21 /**
  22  * MWHttpRequest implemented using internal curl compiled into PHP
  23  */
  24 class CurlHttpRequest extends MWHttpRequest {
  25         const SUPPORTS_FILE_POSTS = true;
  26
  27         protected $curlOptions = [];
  28         protected $headerText = "";
  29
  30         /**
  31          * @param resource $fh
  32          * @param string $content
  33          * @return int
  34          */
  35         protected function readHeader( $fh, $content ) {
  36                 $this->headerText .= $content;
  37                 return strlen( $content );
  38         }
  39
  40         public function execute() {
  41                 $this->prepare();
  42
  43                 if ( !$this->status->isOK() ) {
  44                         return Status::wrap( $this->status ); // TODO B/C; move this to callers
  45                 }
  46
  47                 $this->curlOptions[CURLOPT_PROXY] = $this->proxy;
  48                 $this->curlOptions[CURLOPT_TIMEOUT] = $this->timeout;
  49
  50                 // Only supported in curl >= 7.16.2
  51                 if ( defined( 'CURLOPT_CONNECTTIMEOUT_MS' ) ) {
  52                         $this->curlOptions[CURLOPT_CONNECTTIMEOUT_MS] = $this->connectTimeout * 1000;
  53                 }
  54
  55                 $this->curlOptions[CURLOPT_HTTP_VERSION] = CURL_HTTP_VERSION_1_0;
  56                 $this->curlOptions[CURLOPT_WRITEFUNCTION] = $this->callback;
  57                 $this->curlOptions[CURLOPT_HEADERFUNCTION] = [ $this, "readHeader" ];
  58                 $this->curlOptions[CURLOPT_MAXREDIRS] = $this->maxRedirects;
  59                 $this->curlOptions[CURLOPT_ENCODING] = ""; # Enable compression
  60
  61                 $this->curlOptions[CURLOPT_USERAGENT] = $this->reqHeaders['User-Agent'];
  62
  63                 $this->curlOptions[CURLOPT_SSL_VERIFYHOST] = $this->sslVerifyHost ? 2 : 0;
  64                 $this->curlOptions[CURLOPT_SSL_VERIFYPEER] = $this->sslVerifyCert;
  65
  66                 if ( $this->caInfo ) {
  67                         $this->curlOptions[CURLOPT_CAINFO] = $this->caInfo;
  68                 }
  69
  70                 if ( $this->headersOnly ) {
  71                         $this->curlOptions[CURLOPT_NOBODY] = true;
  72                         $this->curlOptions[CURLOPT_HEADER] = true;
  73                 } elseif ( $this->method == 'POST' ) {
  74                         $this->curlOptions[CURLOPT_POST] = true;
  75                         $postData = $this->postData;
  76                         // Don't interpret POST parameters starting with '@' as file uploads, because this
  77                         // makes it impossible to POST plain values starting with '@' (and causes security
  78                         // issues potentially exposing the contents of local files).
  79                         // The PHP manual says this option was introduced in PHP 5.5 defaults to true in PHP 5.6,
  80                         // but we support lower versions, and the option doesn't exist in HHVM 5.6.99.
  81                         if ( defined( 'CURLOPT_SAFE_UPLOAD' ) ) {
  82                                 $this->curlOptions[CURLOPT_SAFE_UPLOAD] = true;
  83                         } elseif ( is_array( $postData ) ) {
  84                                 // In PHP 5.2 and later, '@' is interpreted as a file upload if POSTFIELDS
  85                                 // is an array, but not if it's a string. So convert $req['body'] to a string
  86                                 // for safety.
  87                                 $postData = wfArrayToCgi( $postData );
  88                         }
  89                         $this->curlOptions[CURLOPT_POSTFIELDS] = $postData;
  90
  91                         // Suppress 'Expect: 100-continue' header, as some servers
  92                         // will reject it with a 417 and Curl won't auto retry
  93                         // with HTTP 1.0 fallback
  94                         $this->reqHeaders['Expect'] = '';
  95                 } else {
  96                         $this->curlOptions[CURLOPT_CUSTOMREQUEST] = $this->method;
  97                 }
  98
  99                 $this->curlOptions[CURLOPT_HTTPHEADER] = $this->getHeaderList();
 100
 101                 $curlHandle = curl_init( $this->url );
 102
 103                 if ( !curl_setopt_array( $curlHandle, $this->curlOptions ) ) {
 104                         throw new InvalidArgumentException( "Error setting curl options." );
 105                 }
 106
 107                 if ( $this->followRedirects && $this->canFollowRedirects() ) {
 108                         MediaWiki\suppressWarnings();
 109                         if ( !curl_setopt( $curlHandle, CURLOPT_FOLLOWLOCATION, true ) ) {
 110                                 $this->logger->debug( __METHOD__ . ": Couldn't set CURLOPT_FOLLOWLOCATION. " .
 111                                         "Probably open_basedir is set.\n" );
 112                                 // Continue the processing. If it were in curl_setopt_array,
 113                                 // processing would have halted on its entry
 114                         }
 115                         MediaWiki\restoreWarnings();
 116                 }
 117
 118                 if ( $this->profiler ) {
 119                         $profileSection = $this->profiler->scopedProfileIn(
 120                                 __METHOD__ . '-' . $this->profileName
 121                         );
 122                 }
 123
 124                 $curlRes = curl_exec( $curlHandle );
 125                 if ( curl_errno( $curlHandle ) == CURLE_OPERATION_TIMEOUTED ) {
 126                         $this->status->fatal( 'http-timed-out', $this->url );
 127                 } elseif ( $curlRes === false ) {
 128                         $this->status->fatal( 'http-curl-error', curl_error( $curlHandle ) );
 129                 } else {
 130                         $this->headerList = explode( "\r\n", $this->headerText );
 131                 }
 132
 133                 curl_close( $curlHandle );
 134
 135                 if ( $this->profiler ) {
 136                         $this->profiler->scopedProfileOut( $profileSection );
 137                 }
 138
 139                 $this->parseHeader();
 140                 $this->setStatus();
 141
 142                 return Status::wrap( $this->status );  // TODO B/C; move this to callers
 143         }
 144
 145         /**
 146          * @return bool
 147          */
 148         public function canFollowRedirects() {
 149                 $curlVersionInfo = curl_version();
 150                 if ( $curlVersionInfo['version_number'] < 0x071304 ) {
 151                         $this->logger->debug( "Cannot follow redirects with libcurl < 7.19.4 due to CVE-2009-0037\n" );
 152                         return false;
 153                 }
 154
 155                 if ( version_compare( PHP_VERSION, '5.6.0', '<' ) ) {
 156                         if ( strval( ini_get( 'open_basedir' ) ) !== '' ) {
 157                                 $this->logger->debug( "Cannot follow redirects when open_basedir is set\n" );
 158                                 return false;
 159                         }
 160                 }
 161
 162                 return true;
 163         }
 164 }