mediawiki.util: Add mw.log.deprecate to #jsMessage

[lhc/web/wiklou.git] / img_auth.php

diff --git a/img_auth.php b/img_auth.php
index a0976af..a3485df 100644 (file)
--- a/img_auth.php
+++ b/img_auth.php
@@ -12,8 +12,6 @@
  * - Set $wgImgAuthDetails = true if you want the reason the access was denied messages to
  *       be displayed instead of just the 403 error (doesn't work on IE anyway),
  *       otherwise it will only appear in error logs
- * - Set $wgImgAuthPublicTest false if you don't want to just check and see if all are public
- *       must be set to false if using specific restrictions such as LockDown or NSFileRepo
  *
  *  For security reasons, you usually don't want your user to know *why* access was denied,
  *  just that it was. If you want to change this, you can set $wgImgAuthDetails to 'true'
@@ -50,18 +48,16 @@ $wgActionPaths = array( "$wgUploadPath/" );
 
 wfImageAuthMain();
 wfLogProfilingData();
+// Commit and close up!
+$factory = wfGetLBFactory();
+$factory->commitMasterChanges();
+$factory->shutdown();
 
 function wfImageAuthMain() {
-       global $wgImgAuthPublicTest, $wgImgAuthUrlPathMap, $wgRequest;
-
-       // See if this is a public Wiki (no protections).
-       if ( $wgImgAuthPublicTest
-               && in_array( 'read', User::getGroupPermissions( array( '*' ) ), true )
-       ) {
-               // This is a public wiki, so disable this script (for private wikis only)
-               wfForbidden( 'img-auth-accessdenied', 'img-auth-public' );
-               return;
-       }
+       global $wgImgAuthUrlPathMap;
+
+       $request = RequestContext::getMain()->getRequest();
+       $publicWiki = in_array( 'read', User::getGroupPermissions( array( '*' ) ), true );
 
        // Get the requested file path (source file or thumbnail)
        $matches = WebRequest::getPathInfo();
@@ -77,11 +73,11 @@ function wfImageAuthMain() {
 
        // Check for bug 28235: QUERY_STRING overriding the correct extension
        $whitelist = array();
-       $extension = FileBackend::extensionFromPath( $path );
+       $extension = FileBackend::extensionFromPath( $path, 'rawcase' );
        if ( $extension != '' ) {
                $whitelist[] = $extension;
        }
-       if ( !$wgRequest->checkUrlExtension( $whitelist ) ) {
+       if ( !$request->checkUrlExtension( $whitelist ) ) {
                return;
        }
 
@@ -118,53 +114,71 @@ function wfImageAuthMain() {
        if ( strpos( $path, '/thumb/' ) === 0 ) {
                $name = wfBaseName( dirname( $path ) ); // file is a thumbnail
                $filename = $repo->getZonePath( 'thumb' ) . substr( $path, 6 ); // strip "/thumb"
+               // Check to see if the file exists
+               if ( !$repo->fileExists( $filename ) ) {
+                       wfForbidden( 'img-auth-accessdenied', 'img-auth-nofile', $filename );
+                       return;
+               }
        } else {
                $name = wfBaseName( $path ); // file is a source file
                $filename = $repo->getZonePath( 'public' ) . $path;
+               // Check to see if the file exists and is not deleted
+               $bits = explode( '!', $name, 2 );
+               if ( substr( $path, 0, 9 ) === '/archive/' && count( $bits ) == 2 ) {
+                       $file = $repo->newFromArchiveName( $bits[1], $name );
+               } else {
+                       $file = $repo->newFile( $name );
+               }
+               if ( !$file->exists() || $file->isDeleted( File::DELETED_FILE ) ) {
+                       wfForbidden( 'img-auth-accessdenied', 'img-auth-nofile', $filename );
+                       return;
+               }
        }
 
-       // Check to see if the file exists
-       if ( !$repo->fileExists( $filename ) ) {
-               wfForbidden( 'img-auth-accessdenied', 'img-auth-nofile', $filename );
-               return;
-       }
+       $headers = array(); // extra HTTP headers to send
 
-       $title = Title::makeTitleSafe( NS_FILE, $name );
-       if ( !$title instanceof Title ) { // files have valid titles
-               wfForbidden( 'img-auth-accessdenied', 'img-auth-badtitle', $name );
-               return;
-       }
+       if ( !$publicWiki ) {
+               // For private wikis, run extra auth checks and set cache control headers
+               $headers[] = 'Cache-Control: private';
+               $headers[] = 'Vary: Cookie';
 
-       // Run hook for extension authorization plugins
-       /** @var $result array */
-       $result = null;
-       if ( !wfRunHooks( 'ImgAuthBeforeStream', array( &$title, &$path, &$name, &$result ) ) ) {
-               wfForbidden( $result[0], $result[1], array_slice( $result, 2 ) );
-               return;
-       }
+               $title = Title::makeTitleSafe( NS_FILE, $name );
+               if ( !$title instanceof Title ) { // files have valid titles
+                       wfForbidden( 'img-auth-accessdenied', 'img-auth-badtitle', $name );
+                       return;
+               }
 
-       // Check user authorization for this title
-       // Checks Whitelist too
-       if ( !$title->userCan( 'read' ) ) {
-               wfForbidden( 'img-auth-accessdenied', 'img-auth-noread', $name );
-               return;
+               // Run hook for extension authorization plugins
+               /** @var $result array */
+               $result = null;
+               if ( !wfRunHooks( 'ImgAuthBeforeStream', array( &$title, &$path, &$name, &$result ) ) ) {
+                       wfForbidden( $result[0], $result[1], array_slice( $result, 2 ) );
+                       return;
+               }
+
+               // Check user authorization for this title
+               // Checks Whitelist too
+               if ( !$title->userCan( 'read' ) ) {
+                       wfForbidden( 'img-auth-accessdenied', 'img-auth-noread', $name );
+                       return;
+               }
        }
 
-       if ( $wgRequest->getCheck( 'download' ) ) {
-               header( 'Content-Disposition: attachment' );
+       if ( $request->getCheck( 'download' ) ) {
+               $headers[] = 'Content-Disposition: attachment';
        }
 
        // Stream the requested file
        wfDebugLog( 'img_auth', "Streaming `" . $filename . "`." );
-       $repo->streamFile( $filename, array( 'Cache-Control: private', 'Vary: Cookie' ) );
+       $repo->streamFile( $filename, $headers );
 }
 
 /**
  * Issue a standard HTTP 403 Forbidden header ($msg1-a message index, not a message) and an
  * error message ($msg2, also a message index), (both required) then end the script
  * subsequent arguments to $msg2 will be passed as parameters only for replacing in $msg2
- * @param $msg1
- * @param $msg2
+ * @param string $msg1
+ * @param string $msg2
  */
 function wfForbidden( $msg1, $msg2 ) {
        global $wgImgAuthDetails;