Improved the security of wfStreamFile():

* Use the file extension to determine Content-Type, don't look for magic numbers. This makes the attack surface similar to ordinary web server downloads, and avoids problems when MIME type is not checked on upload.
* Use the same restrictions for Content-Type when streaming as for uploading. This closes any vulnerabilities caused by a change to a more secure configuration, post-upload.
* Don't stream out the file after headers are unexpectedly sent (e.g. due to display_errors). The Content-Type will typically be fixed to text/html in this case and so we need to be careful what we send.

diff --git a/includes/StreamFile.php b/includes/StreamFile.php
index b4bf531..4abd736 100644 (file)
--- a/includes/StreamFile.php
+++ b/includes/StreamFile.php
@@ -31,6 +31,12 @@ function wfStreamFile( $fname, $headers = array() ) {
                header('Content-type: application/x-wiki');
        }
 
+       // Don't stream it out as text/html if there was a PHP error
+       if ( headers_sent() ) {
+               echo "Headers already sent, terminating.\n";
+               return;
+       }
+
        global $wgContLanguageCode;
        header( "Content-Disposition: inline;filename*=utf-8'$wgContLanguageCode'" . urlencode( basename( $fname ) ) );
 
@@ -53,25 +59,51 @@ function wfStreamFile( $fname, $headers = array() ) {
 }
 
 /** */
-function wfGetType( $filename ) {
+function wfGetType( $filename, $safe = true ) {
        global $wgTrivialMimeDetection;
 
+       $ext = strrchr($filename, '.');
+       $ext = $ext === false ? '' : strtolower( substr( $ext, 1 ) );
+
        # trivial detection by file extension,
        # used for thumbnails (thumb.php)
        if ($wgTrivialMimeDetection) {
-               $ext= strtolower(strrchr($filename, '.'));
-
                switch ($ext) {
-                       case '.gif': return 'image/gif';
-                       case '.png': return 'image/png';
-                       case '.jpg': return 'image/jpeg';
-                       case '.jpeg': return 'image/jpeg';
+                       case 'gif': return 'image/gif';
+                       case 'png': return 'image/png';
+                       case 'jpg': return 'image/jpeg';
+                       case 'jpeg': return 'image/jpeg';
                }
 
                return 'unknown/unknown';
        }
-       else {
-               $magic = MimeMagic::singleton();
-               return $magic->guessMimeType($filename); //full fancy mime detection
+       
+       $magic = MimeMagic::singleton();
+       // Use the extension only, rather than magic numbers, to avoid opening 
+       // up vulnerabilities due to uploads of files with allowed extensions
+       // but disallowed types.
+       $type = $magic->guessTypesForExtension( $ext );
+
+       /**
+        * Double-check some security settings that were done on upload but might 
+        * have changed since.
+        */
+       if ( $safe ) {
+               global $wgFileBlacklist, $wgCheckFileExtensions, $wgStrictFileExtensions, 
+                       $wgFileExtensions, $wgVerifyMimeType, $wgMimeTypeBlacklist, $wgRequest;
+               $form = new UploadForm( $wgRequest );
+               list( $partName, $extList ) = $form->splitExtensions( $filename );
+               if ( $form->checkFileExtensionList( $extList, $wgFileBlacklist ) ) {
+                       return 'unknown/unknown';
+               }
+               if ( $wgCheckFileExtensions && $wgStrictFileExtensions 
+                       && !$form->checkFileExtensionList( $extList, $wgFileExtensions ) )
+               {
+                       return 'unknown/unknown';
+               }
+               if ( $wgVerifyMimeType && in_array( strtolower( $type ), $wgMimeTypeBlacklist ) ) {
+                       return 'unknown/unknown';
+               }
        }
+       return $type;
 }