diff options
| author | Pierre Schmitz <pierre@archlinux.de> | 2007-09-14 13:18:58 +0200 |
|---|---|---|
| committer | Pierre Schmitz <pierre@archlinux.de> | 2007-09-14 13:18:58 +0200 |
| commit | 8f416baead93a48e5799e44b8bd2e2c4859f4e04 (patch) | |
| tree | cd47ac55eb80a39e3225e8b4f3161b88ea16c2cf /img_auth.php | |
| parent | d7d08bd1a17618c7d77a6b9b2989e9f7293d6ed6 (diff) | |
auf Version 1.11 aktualisiert; Login-Bug behoben
Diffstat (limited to 'img_auth.php')
| -rw-r--r-- | img_auth.php | 86 |
1 files changed, 56 insertions, 30 deletions
diff --git a/img_auth.php b/img_auth.php index 11684b37..2e8f6240 100644 --- a/img_auth.php +++ b/img_auth.php @@ -1,63 +1,89 @@ <?php + /** - * Image download authorisation script + * Image authorisation script + * + * To use this: + * + * Set $wgUploadDirectory to a non-public directory (not web accessible) + * Set $wgUploadPath to point to this file * - * To use, in LocalSettings.php set $wgUploadDirectory to point to a non-public - * directory, and $wgUploadPath to point to this file. Also set $wgWhitelistRead - * to an array of pages you want everyone to be able to access. Your server must - * support PATH_INFO, CGI-based configurations generally don't. + * Your server needs to support PATH_INFO; CGI-based configurations + * usually don't. */ + define( 'MW_NO_OUTPUT_COMPRESSION', 1 ); -require_once( './includes/WebStart.php' ); +require_once( dirname( __FILE__ ) . '/includes/WebStart.php' ); wfProfileIn( 'img_auth.php' ); -require_once( './includes/StreamFile.php' ); +require_once( dirname( __FILE__ ) . '/includes/StreamFile.php' ); +// Extract path and image information if( !isset( $_SERVER['PATH_INFO'] ) ) { - wfDebugLog( 'img_auth', "missing PATH_INFO" ); + wfDebugLog( 'img_auth', 'Missing PATH_INFO' ); wfForbidden(); } -# Get filenames/directories -wfDebugLog( 'img_auth', "PATH_INFO is: " . $_SERVER['PATH_INFO'] ); +$path = $_SERVER['PATH_INFO']; $filename = realpath( $wgUploadDirectory . $_SERVER['PATH_INFO'] ); -$realUploadDirectory = realpath( $wgUploadDirectory ); -$imageName = $wgContLang->getNsText( NS_IMAGE ) . ":" . wfBaseName( $_SERVER['PATH_INFO'] ); +$realUpload = realpath( $wgUploadDirectory ); +wfDebugLog( 'img_auth', "\$path is {$path}" ); +wfDebugLog( 'img_auth', "\$filename is {$filename}" ); -# Check if the filename is in the correct directory -if ( substr( $filename, 0, strlen( $realUploadDirectory ) ) != $realUploadDirectory ) { - wfDebugLog( 'img_auth', "requested path not in upload dir: $filename" ); +// Basic directory traversal check +if( substr( $filename, 0, strlen( $realUpload ) ) != $realUpload ) { + wfDebugLog( 'img_auth', 'Requested path not in upload directory' ); wfForbidden(); } -if ( is_array( $wgWhitelistRead ) && !in_array( $imageName, $wgWhitelistRead ) && !$wgUser->getID() ) { - wfDebugLog( 'img_auth', "not logged in and requested file not in whitelist: $imageName" ); +// Extract the file name and chop off the size specifier +// (e.g. 120px-Foo.png => Foo.png) +$name = wfBaseName( $path ); +if( preg_match( '!\d+px-(.*)!i', $name, $m ) ) + $name = $m[1]; +wfDebugLog( 'img_auth', "\$name is {$name}" ); + +$title = Title::makeTitleSafe( NS_IMAGE, $name ); +if( !$title instanceof Title ) { + wfDebugLog( 'img_auth', "Unable to construct a valid Title from `{$name}`" ); + wfForbidden(); +} +$title = $title->getPrefixedText(); + +// Check the whitelist if needed +if( !$wgUser->getId() && ( !is_array( $wgWhitelistRead ) || !in_array( $title, $wgWhitelistRead ) ) ) { + wfDebugLog( 'img_auth', "Not logged in and `{$title}` not in whitelist." ); wfForbidden(); } if( !file_exists( $filename ) ) { - wfDebugLog( 'img_auth', "requested file does not exist: $filename" ); + wfDebugLog( 'img_auth', "`{$filename}` does not exist" ); wfForbidden(); } if( is_dir( $filename ) ) { - wfDebugLog( 'img_auth', "requested file is a directory: $filename" ); + wfDebugLog( 'img_auth', "`{$filename}` is a directory" ); wfForbidden(); } -# Write file -wfDebugLog( 'img_auth', "streaming file: $filename" ); +// Stream the requested file +wfDebugLog( 'img_auth', "Streaming `{$filename}`" ); wfStreamFile( $filename ); wfLogProfilingData(); +/** + * Issue a standard HTTP 403 Forbidden header and a basic + * error message, then end the script + */ function wfForbidden() { header( 'HTTP/1.0 403 Forbidden' ); header( 'Content-Type: text/html; charset=utf-8' ); - print -"<html><body> -<h1>Access denied</h1> -<p>You need to log in to access files on this server</p> -</body></html>"; + echo <<<END +<html> +<body> +<h1>Access Denied</h1> +<p>You need to log in to access files on this server.</p> +</body> +</html> +END; wfLogProfilingData(); - exit; -} - -?> + exit(); +}
\ No newline at end of file |