From 2062e9508fc22de48001be3c28bf7664a9e617f9 Mon Sep 17 00:00:00 2001
From: Rob Church <robchurch@users.mediawiki.org>
Date: Mon, 6 Aug 2007 06:15:21 +0000
Subject: [PATCH] * Fix img_auth.php image name extraction for whitelist
 checking * (bug 10756) img_auth.php will now refuse logged-out requests when
 there is no whitelist, rather than allowing them through

---
 RELEASE-NOTES |  3 ++
 img_auth.php  | 86 +++++++++++++++++++++++++++++++++------------------
 2 files changed, 59 insertions(+), 30 deletions(-)

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index be3fa46877..22c9302731 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -356,6 +356,9 @@ it from source control: http://www.mediawiki.org/wiki/Download_from_SVN
   edit box scroll position preserve/restore behaviour
 * (bug 10805) Fix "undo" link when viewing the diff of the most recent
   change to a page using "diff=0"
+* img_auth.php now interacts properly with $wgWhitelistRead
+* (bug 10765) img_auth.php will now forbid access to images if $wgWhitelistRead
+  is not set to an array
 
 == API changes since 1.10 ==
 
diff --git a/img_auth.php b/img_auth.php
index 24bda422a0..2e8f6240f7 100644
--- a/img_auth.php
+++ b/img_auth.php
@@ -1,63 +1,89 @@
 <?php
+
 /**
- * Image download authorisation script
+ * Image authorisation script
+ *
+ * To use this:
+ *
+ * Set $wgUploadDirectory to a non-public directory (not web accessible)
+ * Set $wgUploadPath to point to this file
  *
- * To use, in LocalSettings.php set $wgUploadDirectory to point to a non-public
- * directory, and $wgUploadPath to point to this file. Also set $wgWhitelistRead
- * to an array of pages you want everyone to be able to access. Your server must
- * support PATH_INFO, CGI-based configurations generally don't.
+ * Your server needs to support PATH_INFO; CGI-based configurations
+ * usually don't.
  */
+ 
 define( 'MW_NO_OUTPUT_COMPRESSION', 1 );
-require_once( './includes/WebStart.php' );
+require_once( dirname( __FILE__ ) . '/includes/WebStart.php' );
 wfProfileIn( 'img_auth.php' );
-require_once( './includes/StreamFile.php' );
+require_once( dirname( __FILE__ ) . '/includes/StreamFile.php' );
 
+// Extract path and image information
 if( !isset( $_SERVER['PATH_INFO'] ) ) {
-	wfDebugLog( 'img_auth', "missing PATH_INFO" );
+	wfDebugLog( 'img_auth', 'Missing PATH_INFO' );
 	wfForbidden();
 }
 
-# Get filenames/directories
-wfDebugLog( 'img_auth', "PATH_INFO is: " . $_SERVER['PATH_INFO'] );
+$path = $_SERVER['PATH_INFO'];
 $filename = realpath( $wgUploadDirectory . $_SERVER['PATH_INFO'] );
-$realUploadDirectory = realpath( $wgUploadDirectory );
-$imageName = $wgContLang->getNsText( NS_IMAGE ) . ":" . wfBaseName( $_SERVER['PATH_INFO'] );
+$realUpload = realpath( $wgUploadDirectory );
+wfDebugLog( 'img_auth', "\$path is {$path}" );
+wfDebugLog( 'img_auth', "\$filename is {$filename}" );
+
+// Basic directory traversal check
+if( substr( $filename, 0, strlen( $realUpload ) ) != $realUpload ) {
+	wfDebugLog( 'img_auth', 'Requested path not in upload directory' );
+	wfForbidden();
+}
 
-# Check if the filename is in the correct directory
-if ( substr( $filename, 0, strlen( $realUploadDirectory ) ) != $realUploadDirectory ) {
-	wfDebugLog( 'img_auth', "requested path not in upload dir: $filename" );
+// Extract the file name and chop off the size specifier
+// (e.g. 120px-Foo.png => Foo.png)
+$name = wfBaseName( $path );
+if( preg_match( '!\d+px-(.*)!i', $name, $m ) )
+	$name = $m[1];
+wfDebugLog( 'img_auth', "\$name is {$name}" );
+
+$title = Title::makeTitleSafe( NS_IMAGE, $name );
+if( !$title instanceof Title ) {
+	wfDebugLog( 'img_auth', "Unable to construct a valid Title from `{$name}`" );
 	wfForbidden();
 }
+$title = $title->getPrefixedText();
 
-if ( is_array( $wgWhitelistRead ) && !in_array( $imageName, $wgWhitelistRead ) && !$wgUser->getID() ) {
-	wfDebugLog( 'img_auth', "not logged in and requested file not in whitelist: $imageName" );
+// Check the whitelist if needed
+if( !$wgUser->getId() && ( !is_array( $wgWhitelistRead ) || !in_array( $title, $wgWhitelistRead ) ) ) {
+	wfDebugLog( 'img_auth', "Not logged in and `{$title}` not in whitelist." );
 	wfForbidden();
 }
 
 if( !file_exists( $filename ) ) {
-	wfDebugLog( 'img_auth', "requested file does not exist: $filename" );
+	wfDebugLog( 'img_auth', "`{$filename}` does not exist" );
 	wfForbidden();
 }
 if( is_dir( $filename ) ) {
-	wfDebugLog( 'img_auth', "requested file is a directory: $filename" );
+	wfDebugLog( 'img_auth', "`{$filename}` is a directory" );
 	wfForbidden();
 }
 
-# Write file
-wfDebugLog( 'img_auth', "streaming file: $filename" );
+// Stream the requested file
+wfDebugLog( 'img_auth', "Streaming `{$filename}`" );
 wfStreamFile( $filename );
 wfLogProfilingData();
 
+/**
+ * Issue a standard HTTP 403 Forbidden header and a basic
+ * error message, then end the script
+ */
 function wfForbidden() {
 	header( 'HTTP/1.0 403 Forbidden' );
 	header( 'Content-Type: text/html; charset=utf-8' );
-	print
-"<html><body>
-<h1>Access denied</h1>
-<p>You need to log in to access files on this server</p>
-</body></html>";
+	echo <<<END
+<html>
+<body>
+<h1>Access Denied</h1>
+<p>You need to log in to access files on this server.</p>
+</body>
+</html>
+END;
 	wfLogProfilingData();
-	exit;
-}
-
-
+	exit();
+}
\ No newline at end of file
-- 
2.20.1