summaryrefslogtreecommitdiff
path: root/img_auth.php
blob: e5d8d8880b9244a936b8bbc07a3f5be1c08ccd34 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
<?php

/**
 * Image authorisation script
 *
 * To use this:
 *
 * - Set $wgUploadDirectory to a non-public directory (not web accessible)
 * - Set $wgUploadPath to point to this file
 *
 * Your server needs to support PATH_INFO; CGI-based configurations
 * usually don't.
 *
 * @file
 */
 
define( 'MW_NO_OUTPUT_COMPRESSION', 1 );
require_once( dirname( __FILE__ ) . '/includes/WebStart.php' );
wfProfileIn( 'img_auth.php' );
require_once( dirname( __FILE__ ) . '/includes/StreamFile.php' );

$perms = User::getGroupPermissions( array( '*' ) );
if ( in_array( 'read', $perms, true ) ) {
	wfDebugLog( 'img_auth', 'Public wiki' );
	wfPublicError();
}

// Extract path and image information
if( !isset( $_SERVER['PATH_INFO'] ) ) {
	wfDebugLog( 'img_auth', 'Missing PATH_INFO' );
	wfForbidden();
}

$path = $_SERVER['PATH_INFO'];
$filename = realpath( $wgUploadDirectory . $_SERVER['PATH_INFO'] );
$realUpload = realpath( $wgUploadDirectory );
wfDebugLog( 'img_auth', "\$path is {$path}" );
wfDebugLog( 'img_auth', "\$filename is {$filename}" );

// Basic directory traversal check
if( substr( $filename, 0, strlen( $realUpload ) ) != $realUpload ) {
	wfDebugLog( 'img_auth', 'Requested path not in upload directory' );
	wfForbidden();
}

// Extract the file name and chop off the size specifier
// (e.g. 120px-Foo.png => Foo.png)
$name = wfBaseName( $path );
if( preg_match( '!\d+px-(.*)!i', $name, $m ) )
	$name = $m[1];
wfDebugLog( 'img_auth', "\$name is {$name}" );

$title = Title::makeTitleSafe( NS_FILE, $name );
if( !$title instanceof Title ) {
	wfDebugLog( 'img_auth', "Unable to construct a valid Title from `{$name}`" );
	wfForbidden();
}
$title = $title->getPrefixedText();

// Check the whitelist if needed
if( !$wgUser->getId() && ( !is_array( $wgWhitelistRead ) || !in_array( $title, $wgWhitelistRead ) ) ) {
	wfDebugLog( 'img_auth', "Not logged in and `{$title}` not in whitelist." );
	wfForbidden();
}

if( !file_exists( $filename ) ) {
	wfDebugLog( 'img_auth', "`{$filename}` does not exist" );
	wfForbidden();
}
if( is_dir( $filename ) ) {
	wfDebugLog( 'img_auth', "`{$filename}` is a directory" );
	wfForbidden();
}

// Stream the requested file
wfDebugLog( 'img_auth', "Streaming `{$filename}`" );
wfStreamFile( $filename, array( 'Cache-Control: private', 'Vary: Cookie' ) );
wfLogProfilingData();

/**
 * Issue a standard HTTP 403 Forbidden header and a basic
 * error message, then end the script
 */
function wfForbidden() {
	header( 'HTTP/1.0 403 Forbidden' );
	header( 'Vary: Cookie' );
	header( 'Content-Type: text/html; charset=utf-8' );
	echo <<<ENDS
<html>
<body>
<h1>Access Denied</h1>
<p>You need to log in to access files on this server.</p>
</body>
</html>
ENDS;
	wfLogProfilingData();
	exit();
}

/**
 * Show a 403 error for use when the wiki is public
 */
function wfPublicError() {
	header( 'HTTP/1.0 403 Forbidden' );
	header( 'Content-Type: text/html; charset=utf-8' );
	echo <<<ENDS
<html>
<body>
<h1>Access Denied</h1>
<p>The function of img_auth.php is to output files from a private wiki. This wiki
is configured as a public wiki. For optimal security, img_auth.php is disabled in 
this case.
</p>
</body>
</html>
ENDS;
	wfLogProfilingData();
	exit;
}