thumb.php

   1 <?php
   2
   3 /**
   4  * PHP script to stream out an image thumbnail.
   5  * If the file exists, we make do with abridged MediaWiki initialisation.
   6  */
   7
   8 define( 'MEDIAWIKI', true );
   9 unset( $IP );
  10 if ( isset( $_REQUEST['GLOBALS'] ) ) {
  11         die( '<a href="http://www.hardened-php.net/index.76.html">$GLOBALS overwrite vulnerability</a>');
  12 }
  13
  14 $wgNoOutputBuffer = true;
  15
  16 require_once( './includes/Defines.php' );
  17 require_once( './LocalSettings.php' );
  18 require_once( 'GlobalFunctions.php' );
  19
  20 $wgTrivialMimeDetection = true; //don't use fancy mime detection, just check the file extension for jpg/gif/png.
  21
  22 require_once( 'Image.php' );
  23 require_once( 'StreamFile.php' );
  24
  25 // Get input parameters
  26
  27 if ( get_magic_quotes_gpc() ) {
  28         $fileName = stripslashes( $_REQUEST['f'] );
  29         $width = stripslashes( $_REQUEST['w'] );
  30 } else {
  31         $fileName = $_REQUEST['f'];
  32         $width = $_REQUEST['w'];
  33 }
  34
  35 $pre_render= isset($_REQUEST['r']) && $_REQUEST['r']!="0";
  36
  37 // Some basic input validation
  38
  39 $width = intval( $width );
  40 $fileName = strtr( $fileName, '\\/', '__' );
  41
  42 // Work out paths, carefully avoiding constructing an Image object because that won't work yet
  43
  44 $imagePath = wfImageDir( $fileName ) . '/' . $fileName;
  45 $thumbName = "{$width}px-$fileName";
  46 if ( $pre_render ) {
  47         $thumbName .= '.png';
  48 }
  49 $thumbPath = wfImageThumbDir( $fileName ) . '/' . $thumbName;
  50
  51 if ( file_exists( $thumbPath ) && filemtime( $thumbPath ) >= filemtime( $imagePath ) ) {
  52         wfStreamFile( $thumbPath );
  53         exit;
  54 }
  55
  56 // OK, no valid thumbnail, time to get out the heavy machinery
  57 require_once( 'Setup.php' );
  58 wfProfileIn( 'thumb.php' );
  59
  60 $img = Image::newFromName( $fileName );
  61 if ( $img ) {
  62         $thumb = $img->renderThumb( $width, false );
  63 } else {
  64         $thumb = false;
  65 }
  66
  67 if ( $thumb && $thumb->path ) {
  68         wfStreamFile( $thumb->path );
  69 } else {
  70         $badtitle = wfMsg( 'badtitle' );
  71         $badtitletext = wfMsg( 'badtitletext' );
  72         echo "<html><head>
  73         <title>$badtitle</title>
  74         <body>
  75 <h1>$badtitle</h1>
  76 <p>$badtitletext</p>
  77 </body></html>";
  78 }
  79
  80 wfProfileOut( 'thumb.php' );
  81
  82
  83 ?>