3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License as published by
5 * the Free Software Foundation; either version 2 of the License, or
6 * (at your option) any later version.
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 * GNU General Public License for more details.
13 * You should have received a copy of the GNU General Public License along
14 * with this program; if not, write to the Free Software Foundation, Inc.,
15 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
16 * http://www.gnu.org/copyleft/gpl.html
22 * MWHttpRequest implemented using internal curl compiled into PHP
24 class CurlHttpRequest
extends MWHttpRequest
{
25 const SUPPORTS_FILE_POSTS
= true;
27 protected $curlOptions = [];
28 protected $headerText = "";
32 * @param string $content
35 protected function readHeader( $fh, $content ) {
36 $this->headerText
.= $content;
37 return strlen( $content );
40 public function execute() {
43 if ( !$this->status
->isOK() ) {
44 return Status
::wrap( $this->status
); // TODO B/C; move this to callers
47 $this->curlOptions
[CURLOPT_PROXY
] = $this->proxy
;
48 $this->curlOptions
[CURLOPT_TIMEOUT
] = $this->timeout
;
50 // Only supported in curl >= 7.16.2
51 if ( defined( 'CURLOPT_CONNECTTIMEOUT_MS' ) ) {
52 $this->curlOptions
[CURLOPT_CONNECTTIMEOUT_MS
] = $this->connectTimeout
* 1000;
55 $this->curlOptions
[CURLOPT_HTTP_VERSION
] = CURL_HTTP_VERSION_1_0
;
56 $this->curlOptions
[CURLOPT_WRITEFUNCTION
] = $this->callback
;
57 $this->curlOptions
[CURLOPT_HEADERFUNCTION
] = [ $this, "readHeader" ];
58 $this->curlOptions
[CURLOPT_MAXREDIRS
] = $this->maxRedirects
;
59 $this->curlOptions
[CURLOPT_ENCODING
] = ""; # Enable compression
61 $this->curlOptions
[CURLOPT_USERAGENT
] = $this->reqHeaders
['User-Agent'];
63 $this->curlOptions
[CURLOPT_SSL_VERIFYHOST
] = $this->sslVerifyHost ?
2 : 0;
64 $this->curlOptions
[CURLOPT_SSL_VERIFYPEER
] = $this->sslVerifyCert
;
66 if ( $this->caInfo
) {
67 $this->curlOptions
[CURLOPT_CAINFO
] = $this->caInfo
;
70 if ( $this->headersOnly
) {
71 $this->curlOptions
[CURLOPT_NOBODY
] = true;
72 $this->curlOptions
[CURLOPT_HEADER
] = true;
73 } elseif ( $this->method
== 'POST' ) {
74 $this->curlOptions
[CURLOPT_POST
] = true;
75 $postData = $this->postData
;
76 // Don't interpret POST parameters starting with '@' as file uploads, because this
77 // makes it impossible to POST plain values starting with '@' (and causes security
78 // issues potentially exposing the contents of local files).
79 // The PHP manual says this option was introduced in PHP 5.5 defaults to true in PHP 5.6,
80 // but we support lower versions, and the option doesn't exist in HHVM 5.6.99.
81 if ( defined( 'CURLOPT_SAFE_UPLOAD' ) ) {
82 $this->curlOptions
[CURLOPT_SAFE_UPLOAD
] = true;
83 } elseif ( is_array( $postData ) ) {
84 // In PHP 5.2 and later, '@' is interpreted as a file upload if POSTFIELDS
85 // is an array, but not if it's a string. So convert $req['body'] to a string
87 $postData = wfArrayToCgi( $postData );
89 $this->curlOptions
[CURLOPT_POSTFIELDS
] = $postData;
91 // Suppress 'Expect: 100-continue' header, as some servers
92 // will reject it with a 417 and Curl won't auto retry
93 // with HTTP 1.0 fallback
94 $this->reqHeaders
['Expect'] = '';
96 $this->curlOptions
[CURLOPT_CUSTOMREQUEST
] = $this->method
;
99 $this->curlOptions
[CURLOPT_HTTPHEADER
] = $this->getHeaderList();
101 $curlHandle = curl_init( $this->url
);
103 if ( !curl_setopt_array( $curlHandle, $this->curlOptions
) ) {
104 throw new InvalidArgumentException( "Error setting curl options." );
107 if ( $this->followRedirects
&& $this->canFollowRedirects() ) {
108 MediaWiki\
suppressWarnings();
109 if ( !curl_setopt( $curlHandle, CURLOPT_FOLLOWLOCATION
, true ) ) {
110 $this->logger
->debug( __METHOD__
. ": Couldn't set CURLOPT_FOLLOWLOCATION. " .
111 "Probably open_basedir is set.\n" );
112 // Continue the processing. If it were in curl_setopt_array,
113 // processing would have halted on its entry
115 MediaWiki\restoreWarnings
();
118 if ( $this->profiler
) {
119 $profileSection = $this->profiler
->scopedProfileIn(
120 __METHOD__
. '-' . $this->profileName
124 $curlRes = curl_exec( $curlHandle );
125 if ( curl_errno( $curlHandle ) == CURLE_OPERATION_TIMEOUTED
) {
126 $this->status
->fatal( 'http-timed-out', $this->url
);
127 } elseif ( $curlRes === false ) {
128 $this->status
->fatal( 'http-curl-error', curl_error( $curlHandle ) );
130 $this->headerList
= explode( "\r\n", $this->headerText
);
133 curl_close( $curlHandle );
135 if ( $this->profiler
) {
136 $this->profiler
->scopedProfileOut( $profileSection );
139 $this->parseHeader();
142 return Status
::wrap( $this->status
); // TODO B/C; move this to callers
148 public function canFollowRedirects() {
149 $curlVersionInfo = curl_version();
150 if ( $curlVersionInfo['version_number'] < 0x071304 ) {
151 $this->logger
->debug( "Cannot follow redirects with libcurl < 7.19.4 due to CVE-2009-0037\n" );
155 if ( version_compare( PHP_VERSION
, '5.6.0', '<' ) ) {
156 if ( strval( ini_get( 'open_basedir' ) ) !== '' ) {
157 $this->logger
->debug( "Cannot follow redirects when open_basedir is set\n" );