UploadBase: Avoid deprecated wfMemcKey()

[lhc/web/wiklou.git] / includes / upload / UploadBase.php

diff --git a/includes/upload/UploadBase.php b/includes/upload/UploadBase.php
index bac7129..0868ce6 100644 (file)
--- a/includes/upload/UploadBase.php
+++ b/includes/upload/UploadBase.php
@@ -20,6 +20,7 @@
  * @file
  * @ingroup Upload
  */
+use MediaWiki\MediaWikiServices;
 
 /**
  * @defgroup Upload Upload related
@@ -797,7 +798,7 @@ abstract class UploadBase {
         * Returns the title of the file to be uploaded. Sets mTitleError in case
         * the name was illegal.
         *
-        * @return Title The title of the file or null in case the name was illegal
+        * @return Title|null The title of the file or null in case the name was illegal
         */
        public function getTitle() {
                if ( $this->mTitle !== false ) {
@@ -1358,7 +1359,10 @@ abstract class UploadBase {
                        $filename,
                        [ $this, 'checkSvgScriptCallback' ],
                        true,
-                       [ 'processing_instruction_handler' => 'UploadBase::checkSvgPICallback' ]
+                       [
+                               'processing_instruction_handler' => 'UploadBase::checkSvgPICallback',
+                               'external_dtd_handler' => 'UploadBase::checkSvgExternalDTD',
+                       ]
                );
                if ( $check->wellFormed !== true ) {
                        // Invalid xml (T60553)
@@ -1390,6 +1394,34 @@ abstract class UploadBase {
                return false;
        }
 
+       /**
+        * Verify that DTD urls referenced are only the standard dtds
+        *
+        * Browsers seem to ignore external dtds. However just to be on the
+        * safe side, only allow dtds from the svg standard.
+        *
+        * @param string $type PUBLIC or SYSTEM
+        * @param string $publicId The well-known public identifier for the dtd
+        * @param string $systemId The url for the external dtd
+        */
+       public static function checkSvgExternalDTD( $type, $publicId, $systemId ) {
+               // This doesn't include the XHTML+MathML+SVG doctype since we don't
+               // allow XHTML anyways.
+               $allowedDTDs = [
+                       'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd',
+                       'http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd',
+                       'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-basic.dtd',
+                       'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd'
+               ];
+               if ( $type !== 'PUBLIC'
+                       || !in_array( $systemId, $allowedDTDs )
+                       || strpos( $publicId, "-//W3C//" ) !== 0
+               ) {
+                       return [ 'upload-scripted-dtd' ];
+               }
+               return false;
+       }
+
        /**
         * @todo Replace this with a whitelist filter!
         * @param string $element
@@ -2081,9 +2113,10 @@ abstract class UploadBase {
         * @return Status[]|bool
         */
        public static function getSessionStatus( User $user, $statusKey ) {
-               $key = wfMemcKey( 'uploadstatus', $user->getId() ?: md5( $user->getName() ), $statusKey );
+               $cache = MediaWikiServices::getInstance()->getMainObjectStash();
+               $key = $cache->makeKey( 'uploadstatus', $user->getId() ?: md5( $user->getName() ), $statusKey );
 
-               return ObjectCache::getMainStashInstance()->get( $key );
+               return $cache->get( $key );
        }
 
        /**
@@ -2097,9 +2130,9 @@ abstract class UploadBase {
         * @return void
         */
        public static function setSessionStatus( User $user, $statusKey, $value ) {
-               $key = wfMemcKey( 'uploadstatus', $user->getId() ?: md5( $user->getName() ), $statusKey );
+               $cache = MediaWikiServices::getInstance()->getMainObjectStash();
+               $key = $cache->makeKey( 'uploadstatus', $user->getId() ?: md5( $user->getName() ), $statusKey );
 
-               $cache = ObjectCache::getMainStashInstance();
                if ( $value === false ) {
                        $cache->delete( $key );
                } else {