thumb.php

   1 <?php
   2
   3 /**
   4  * PHP script to stream out an image thumbnail.
   5  * If the file exists, we make do with abridged MediaWiki initialisation.
   6  */
   7
   8 define( 'MEDIAWIKI', true );
   9 unset( $IP );
  10 if ( isset( $_REQUEST['GLOBALS'] ) ) {
  11         echo '<a href="http://www.hardened-php.net/index.76.html">$GLOBALS overwrite vulnerability</a>';
  12         die( -1 );
  13 }
  14
  15 $wgNoOutputBuffer = true;
  16
  17 require_once( './includes/Defines.php' );
  18 require_once( './LocalSettings.php' );
  19 require_once( 'GlobalFunctions.php' );
  20
  21 $wgTrivialMimeDetection = true; //don't use fancy mime detection, just check the file extension for jpg/gif/png.
  22
  23 require_once( 'Image.php' );
  24 require_once( 'StreamFile.php' );
  25
  26 // Get input parameters
  27
  28 if ( get_magic_quotes_gpc() ) {
  29         $fileName = stripslashes( $_REQUEST['f'] );
  30         $width = stripslashes( $_REQUEST['w'] );
  31 } else {
  32         $fileName = $_REQUEST['f'];
  33         $width = $_REQUEST['w'];
  34 }
  35
  36 $pre_render= isset($_REQUEST['r']) && $_REQUEST['r']!="0";
  37
  38 // Some basic input validation
  39
  40 $width = intval( $width );
  41 $fileName = strtr( $fileName, '\\/', '__' );
  42
  43 // Work out paths, carefully avoiding constructing an Image object because that won't work yet
  44
  45 $imagePath = wfImageDir( $fileName ) . '/' . $fileName;
  46 $thumbName = "{$width}px-$fileName";
  47 if ( $pre_render ) {
  48         $thumbName .= '.png';
  49 }
  50 $thumbPath = wfImageThumbDir( $fileName ) . '/' . $thumbName;
  51
  52 if ( file_exists( $thumbPath ) && filemtime( $thumbPath ) >= filemtime( $imagePath ) ) {
  53         wfStreamFile( $thumbPath );
  54         exit;
  55 }
  56
  57 // OK, no valid thumbnail, time to get out the heavy machinery
  58 require_once( 'Setup.php' );
  59 wfProfileIn( 'thumb.php' );
  60
  61 $img = Image::newFromName( $fileName );
  62 if ( $img ) {
  63         $thumb = $img->renderThumb( $width, false );
  64 } else {
  65         $thumb = false;
  66 }
  67
  68 if ( $thumb && $thumb->path ) {
  69         wfStreamFile( $thumb->path );
  70 } else {
  71         $badtitle = wfMsg( 'badtitle' );
  72         $badtitletext = wfMsg( 'badtitletext' );
  73         echo "<html><head>
  74         <title>$badtitle</title>
  75         <body>
  76 <h1>$badtitle</h1>
  77 <p>$badtitletext</p>
  78 </body></html>";
  79 }
  80
  81 wfProfileOut( 'thumb.php' );
  82
  83
  84 ?>