Update to MediaWiki 1.21.1

1 files changed, 87 insertions, 98 deletions

diff --git a/thumb.php b/thumb.php
index c53eb2a5..ede30e6e 100644
--- a/thumb.php
+++ b/thumb.php
@@ -35,9 +35,10 @@ if ( defined( 'THUMB_HANDLER' ) ) {
 	// Called from thumb_handler.php via 404; extract params from the URI...
 	wfThumbHandle404();
 } else {
-	// Called directly, use $_REQUEST params
+	// Called directly, use $_GET params
 	wfThumbHandleRequest();
 }
+
 wfLogProfilingData();
 
 //--------------------------------------------------------------------------
@@ -49,8 +50,8 @@ wfLogProfilingData();
  */
 function wfThumbHandleRequest() {
 	$params = get_magic_quotes_gpc()
-		? array_map( 'stripslashes', $_REQUEST )
-		: $_REQUEST;
+		? array_map( 'stripslashes', $_GET )
+		: $_GET;
 
 	wfStreamThumb( $params ); // stream the thumbnail
 }
@@ -61,28 +62,21 @@ function wfThumbHandleRequest() {
  * @return void
  */
 function wfThumbHandle404() {
-	# lighttpd puts the original request in REQUEST_URI, while sjs sets
-	# that to the 404 handler, and puts the original request in REDIRECT_URL.
-	if ( isset( $_SERVER['REDIRECT_URL'] ) ) {
-		# The URL is un-encoded, so put it back how it was
-		$uriPath = str_replace( "%2F", "/", urlencode( $_SERVER['REDIRECT_URL'] ) );
-	} else {
-		$uriPath = $_SERVER['REQUEST_URI'];
-	}
-	# Just get the URI path (REDIRECT_URL/REQUEST_URI is either a full URL or a path)
-	if ( substr( $uriPath, 0, 1 ) !== '/' ) {
-		$bits = wfParseUrl( $uriPath );
-		if ( $bits && isset( $bits['path'] ) ) {
-			$uriPath = $bits['path'];
-		} else {
-			wfThumbError( 404, 'The source file for the specified thumbnail does not exist.' );
-			return;
-		}
+	global $wgArticlePath;
+
+	# Set action base paths so that WebRequest::getPathInfo()
+	# recognizes the "X" as the 'title' in ../thumb_handler.php/X urls.
+	$wgArticlePath = false; # Don't let a "/*" article path clober our action path
+
+	$matches = WebRequest::getPathInfo();
+	if ( !isset( $matches['title'] ) ) {
+		wfThumbError( 404, 'Could not determine the name of the requested thumbnail.' );
+		return;
 	}
 
-	$params = wfExtractThumbParams( $uriPath ); // basic wiki URL param extracting
+	$params = wfExtractThumbParams( $matches['title'] ); // basic wiki URL param extracting
 	if ( $params == null ) {
-		wfThumbError( 404, 'The source file for the specified thumbnail does not exist.' );
+		wfThumbError( 400, 'The specified thumbnail parameters are not recognized.' );
 		return;
 	}
 
@@ -97,6 +91,7 @@ function wfThumbHandle404() {
  */
 function wfStreamThumb( array $params ) {
 	global $wgVaryOnXFP;
+
 	wfProfileIn( __METHOD__ );
 
 	$headers = array(); // HTTP headers to send
@@ -153,6 +148,13 @@ function wfStreamThumb( array $params ) {
 		$img = wfLocalFile( $fileName );
 	}
 
+	// Check the source file title
+	if ( !$img ) {
+		wfThumbError( 404, wfMessage( 'badtitletext' )->text() );
+		wfProfileOut( __METHOD__ );
+		return;
+	}
+
 	// Check permissions if there are read restrictions
 	$varyHeader = array();
 	if ( !in_array( 'read', User::getGroupPermissions( array( '*' ) ), true ) ) {
@@ -167,19 +169,12 @@ function wfStreamThumb( array $params ) {
 	}
 
 	// Check the source file storage path
-	if ( !$img ) {
-		wfThumbError( 404, wfMessage( 'badtitletext' )->text() );
-		wfProfileOut( __METHOD__ );
-		return;
-	}
 	if ( !$img->exists() ) {
-		wfThumbError( 404, 'The source file for the specified thumbnail does not exist.' );
+		wfThumbError( 404, "The source file '$fileName' does not exist." );
 		wfProfileOut( __METHOD__ );
 		return;
-	}
-	$sourcePath = $img->getPath();
-	if ( $sourcePath === false ) {
-		wfThumbError( 500, 'The source file is not locally accessible.' );
+	} elseif ( $img->getPath() === false ) {
+		wfThumbError( 500, "The source file '$fileName' is not locally accessible." );
 		wfProfileOut( __METHOD__ );
 		return;
 	}
@@ -193,66 +188,74 @@ function wfStreamThumb( array $params ) {
 		wfSuppressWarnings();
 		$imsUnix = strtotime( $imsString );
 		wfRestoreWarnings();
-		$sourceTsUnix = wfTimestamp( TS_UNIX, $img->getTimestamp() );
-		if ( $sourceTsUnix <= $imsUnix ) {
+		if ( wfTimestamp( TS_UNIX, $img->getTimestamp() ) <= $imsUnix ) {
 			header( 'HTTP/1.1 304 Not Modified' );
 			wfProfileOut( __METHOD__ );
 			return;
 		}
 	}
 
-	$thumbName = $img->thumbName( $params );
-	if ( !strlen( $thumbName ) ) { // invalid params?
-		wfThumbError( 400, 'The specified thumbnail parameters are not valid.' );
+	// Get the normalized thumbnail name from the parameters...
+	try {
+		$thumbName = $img->thumbName( $params );
+		if ( !strlen( $thumbName ) ) { // invalid params?
+			wfThumbError( 400, 'The specified thumbnail parameters are not valid.' );
+			wfProfileOut( __METHOD__ );
+			return;
+		}
+		$thumbName2 = $img->thumbName( $params, File::THUMB_FULL_NAME ); // b/c; "long" style
+	} catch ( MWException $e ) {
+		wfThumbError( 500, $e->getHTML() );
 		wfProfileOut( __METHOD__ );
 		return;
 	}
 
-	$disposition = $img->getThumbDisposition( $thumbName );
-	$headers[] = "Content-Disposition: $disposition";
-
-	// Stream the file if it exists already...
-	try {
-		$thumbName2 = $img->thumbName( $params, File::THUMB_FULL_NAME ); // b/c; "long" style
-		// For 404 handled thumbnails, we only use the the base name of the URI
-		// for the thumb params and the parent directory for the source file name.
-		// Check that the zone relative path matches up so squid caches won't pick
-		// up thumbs that would not be purged on source file deletion (bug 34231).
-		if ( isset( $params['rel404'] ) ) { // thumbnail was handled via 404
-			if ( urldecode( $params['rel404'] ) === $img->getThumbRel( $thumbName ) ) {
-				// Request for the canonical thumbnail name
-			} elseif ( urldecode( $params['rel404'] ) === $img->getThumbRel( $thumbName2 ) ) {
-				// Request for the "long" thumbnail name; redirect to canonical name
-				$response = RequestContext::getMain()->getRequest()->response();
-				$response->header( "HTTP/1.1 301 " . HttpStatus::getMessage( 301 ) );
-				$response->header( 'Location: ' . wfExpandUrl( $img->getThumbUrl( $thumbName ), PROTO_CURRENT ) );
-				$response->header( 'Expires: ' .
-					gmdate( 'D, d M Y H:i:s', time() + 7*86400 ) . ' GMT' );
-				if ( $wgVaryOnXFP ) {
-					$varyHeader[] = 'X-Forwarded-Proto';
-				}
+	// For 404 handled thumbnails, we only use the the base name of the URI
+	// for the thumb params and the parent directory for the source file name.
+	// Check that the zone relative path matches up so squid caches won't pick
+	// up thumbs that would not be purged on source file deletion (bug 34231).
+	if ( isset( $params['rel404'] ) ) { // thumbnail was handled via 404
+		if ( rawurldecode( $params['rel404'] ) === $img->getThumbRel( $thumbName ) ) {
+			// Request for the canonical thumbnail name
+		} elseif ( rawurldecode( $params['rel404'] ) === $img->getThumbRel( $thumbName2 ) ) {
+			// Request for the "long" thumbnail name; redirect to canonical name
+			$response = RequestContext::getMain()->getRequest()->response();
+			$response->header( "HTTP/1.1 301 " . HttpStatus::getMessage( 301 ) );
+			$response->header( 'Location: ' .
+				wfExpandUrl( $img->getThumbUrl( $thumbName ), PROTO_CURRENT ) );
+			$response->header( 'Expires: ' .
+				gmdate( 'D, d M Y H:i:s', time() + 7 * 86400 ) . ' GMT' );
+			if ( $wgVaryOnXFP ) {
+				$varyHeader[] = 'X-Forwarded-Proto';
+			}
+			if ( count( $varyHeader ) ) {
 				$response->header( 'Vary: ' . implode( ', ', $varyHeader ) );
-				wfProfileOut( __METHOD__ );
-				return;
-			} else {
-				wfThumbError( 404, 'The given path of the specified thumbnail is incorrect.' );
-				wfProfileOut( __METHOD__ );
-				return;
 			}
-		}
-		$thumbPath = $img->getThumbPath( $thumbName );
-		if ( $img->getRepo()->fileExists( $thumbPath ) ) {
-			$headers[] = 'Vary: ' . implode( ', ', $varyHeader );
-			$img->getRepo()->streamFile( $thumbPath, $headers );
+			wfProfileOut( __METHOD__ );
+			return;
+		} else {
+			wfThumbError( 404, "The given path of the specified thumbnail is incorrect;
+				expected '" . $img->getThumbRel( $thumbName ) . "' but got '" .
+				rawurldecode( $params['rel404'] ) . "'." );
 			wfProfileOut( __METHOD__ );
 			return;
 		}
-	} catch ( MWException $e ) {
-		wfThumbError( 500, $e->getHTML() );
+	}
+
+	// Suggest a good name for users downloading this thumbnail
+	$headers[] = "Content-Disposition: {$img->getThumbDisposition( $thumbName )}";
+
+	if ( count( $varyHeader ) ) {
+		$headers[] = 'Vary: ' . implode( ', ', $varyHeader );
+	}
+
+	// Stream the file if it exists already...
+	$thumbPath = $img->getThumbPath( $thumbName );
+	if ( $img->getRepo()->fileExists( $thumbPath ) ) {
+		$img->getRepo()->streamFile( $thumbPath, $headers );
 		wfProfileOut( __METHOD__ );
 		return;
 	}
-	$headers[] = 'Vary: ' . implode( ', ', $varyHeader );
 
 	// Thumbnail isn't already there, so create the new thumbnail...
 	try {
@@ -290,43 +293,28 @@ function wfStreamThumb( array $params ) {
  * Extract the required params for thumb.php from the thumbnail request URI.
  * At least 'width' and 'f' should be set if the result is an array.
  *
- * @param $uriPath String Thumbnail request URI path
+ * @param $thumbRel String Thumbnail path relative to the thumb zone
  * @return Array|null associative params array or null
  */
-function wfExtractThumbParams( $uriPath ) {
+function wfExtractThumbParams( $thumbRel ) {
 	$repo = RepoGroup::singleton()->getLocalRepo();
 
-	// Zone URL might be relative ("/images") or protocol-relative ("//lang.site/image")
-	$zoneUriPath = $repo->getZoneHandlerUrl( 'thumb' )
-		? $repo->getZoneHandlerUrl( 'thumb' ) // custom URL
-		: $repo->getZoneUrl( 'thumb' ); // default to main URL
-	$bits = wfParseUrl( wfExpandUrl( $zoneUriPath, PROTO_INTERNAL ) );
-	if ( $bits && isset( $bits['path'] ) ) {
-		$zoneUriPath = $bits['path'];
-	} else {
-		return null; // not a valid thumbnail URL
-	}
-
 	$hashDirReg = $subdirReg = '';
 	for ( $i = 0; $i < $repo->getHashLevels(); $i++ ) {
 		$subdirReg .= '[0-9a-f]';
 		$hashDirReg .= "$subdirReg/";
 	}
-	$zoneReg = preg_quote( $zoneUriPath ); // regex for thumb zone URI
 
 	// Check if this is a thumbnail of an original in the local file repo
-	if ( preg_match( "!^$zoneReg/((archive/)?$hashDirReg([^/]*)/([^/]*))$!", $uriPath, $m ) ) {
+	if ( preg_match( "!^((archive/)?$hashDirReg([^/]*)/([^/]*))$!", $thumbRel, $m ) ) {
 		list( /*all*/, $rel, $archOrTemp, $filename, $thumbname ) = $m;
 	// Check if this is a thumbnail of an temp file in the local file repo
-	} elseif ( preg_match( "!^$zoneReg/(temp/)($hashDirReg([^/]*)/([^/]*))$!", $uriPath, $m ) ) {
+	} elseif ( preg_match( "!^(temp/)($hashDirReg([^/]*)/([^/]*))$!", $thumbRel, $m ) ) {
 		list( /*all*/, $archOrTemp, $rel, $filename, $thumbname ) = $m;
 	} else {
 		return null; // not a valid looking thumbnail request
 	}
 
-	$filename = urldecode( $filename );
-	$thumbname = urldecode( $thumbname );
-
 	$params = array( 'f' => $filename, 'rel404' => $rel );
 	if ( $archOrTemp === 'archive/' ) {
 		$params['archived'] = 1;
@@ -334,17 +322,18 @@ function wfExtractThumbParams( $uriPath ) {
 		$params['temp'] = 1;
 	}
 
+	// Check hooks if parameters can be extracted
+	// Hooks return false if they manage to *resolve* the parameters
+	if ( !wfRunHooks( 'ExtractThumbParameters', array( $thumbname, &$params ) ) ) {
+		return $params; // valid thumbnail URL (via extension or config)
 	// Check if the parameters can be extracted from the thumbnail name...
-	if ( preg_match( '!^(page(\d*)-)*(\d*)px-[^/]*$!', $thumbname, $matches ) ) {
+	} elseif ( preg_match( '!^(page(\d*)-)*(\d*)px-[^/]*$!', $thumbname, $matches ) ) {
 		list( /* all */, $pagefull, $pagenum, $size ) = $matches;
 		$params['width'] = $size;
 		if ( $pagenum ) {
 			$params['page'] = $pagenum;
 		}
 		return $params; // valid thumbnail URL
-	// Hooks return false if they manage to *resolve* the parameters
-	} elseif ( !wfRunHooks( 'ExtractThumbParameters', array( $thumbname, &$params ) ) ) {
-		return $params; // valid thumbnail URL (via extension or config)
 	}
 
 	return null; // not a valid thumbnail URL
@@ -375,7 +364,7 @@ function wfThumbError( $status, $msg ) {
 		$hostname = htmlspecialchars( wfHostname() );
 		$debug = "<!-- $url -->\n<!-- $hostname -->\n";
 	} else {
-		$debug = "";
+		$debug = '';
 	}
 	echo <<<EOT
 <html><head><title>Error generating thumbnail</title></head>