In Special:RevisionDelete:
[lhc/web/wiklou.git] / includes / specials / SpecialUpload.php
index 51b11df..1e4a81a 100644 (file)
@@ -23,7 +23,7 @@ class UploadForm {
        const BEFORE_PROCESSING = 1;
        const LARGE_FILE_SERVER = 2;
        const EMPTY_FILE = 3;
-       const MIN_LENGHT_PARTNAME = 4;
+       const MIN_LENGTH_PARTNAME = 4;
        const ILLEGAL_FILENAME = 5;
        const PROTECTED_PAGE = 6;
        const OVERWRITE_EXISTING_FILE = 7;
@@ -62,6 +62,8 @@ class UploadForm {
                $this->mDesiredDestName   = $request->getText( 'wpDestFile' );
                $this->mIgnoreWarning     = $request->getCheck( 'wpIgnoreWarning' );
                $this->mComment           = $request->getText( 'wpUploadDescription' );
+               $this->mForReUpload       = $request->getBool( 'wpForReUpload' );
+               $this->mReUpload          = $request->getCheck( 'wpReUpload' );
 
                if( !$request->wasPosted() ) {
                        # GET requests just give the main form; no data except destination
@@ -72,8 +74,6 @@ class UploadForm {
                # Placeholders for text injection by hooks (empty per default)
                $this->uploadFormTextTop = "";
                $this->uploadFormTextAfterSummary = "";
-
-               $this->mReUpload          = $request->getCheck( 'wpReUpload' );
                $this->mUploadClicked     = $request->getCheck( 'wpUpload' );
 
                $this->mLicense           = $request->getText( 'wpLicense' );
@@ -155,7 +155,7 @@ class UploadForm {
         * Returns true if there was an error, false otherwise
         */
        private function curlCopy( $url, $dest ) {
-               global $wgUser, $wgOut;
+               global $wgUser, $wgOut, $wgHTTPProxy, $wgCopyUploadTimeout;
 
                if( !$wgUser->isAllowed( 'upload_by_url' ) ) {
                        $wgOut->permissionRequired( 'upload_by_url' );
@@ -180,9 +180,12 @@ class UploadForm {
 
                $ch = curl_init();
                curl_setopt( $ch, CURLOPT_HTTP_VERSION, 1.0); # Probably not needed, but apparently can work around some bug
-               curl_setopt( $ch, CURLOPT_TIMEOUT, 10); # 10 seconds timeout
+               curl_setopt( $ch, CURLOPT_TIMEOUT, $wgCopyUploadTimeout); # Default 30 seconds timeout
                curl_setopt( $ch, CURLOPT_LOW_SPEED_LIMIT, 512); # 0.5KB per second minimum transfer speed
                curl_setopt( $ch, CURLOPT_URL, $url);
+               if( $wgHTTPProxy ) {
+                       curl_setopt( $ch, CURLOPT_PROXY, $wgHTTPProxy );
+               }
                curl_setopt( $ch, CURLOPT_WRITEFUNCTION, array( $this, 'uploadCurlCallback' ) );
                curl_exec( $ch );
                $error = curl_errno( $ch ) ? true : false;
@@ -228,6 +231,12 @@ class UploadForm {
                global $wgUser, $wgOut;
                global $wgEnableUploads;
 
+               # Check php's file_uploads setting
+               if( !wfIniGetBool( 'file_uploads' ) ) {
+                       $wgOut->showErrorPage( 'uploaddisabled', 'php-uploaddisabledtext', array( $this->mDesiredDestName ) );
+                       return;
+               }
+
                # Check uploading enabled
                if( !$wgEnableUploads ) {
                        $wgOut->showErrorPage( 'uploaddisabled', 'uploaddisabledtext', array( $this->mDesiredDestName ) );
@@ -235,8 +244,11 @@ class UploadForm {
                }
 
                # Check permissions
+               global $wgGroupPermissions;
                if( !$wgUser->isAllowed( 'upload' ) ) {
-                       if( !$wgUser->isLoggedIn() ) {
+                       if( !$wgUser->isLoggedIn() && ( $wgGroupPermissions['user']['upload']
+                               || $wgGroupPermissions['autoconfirmed']['upload'] ) ) {
+                               // Custom message if logged-in users without any special rights can upload
                                $wgOut->showErrorPage( 'uploadnologin', 'uploadnologintext' );
                        } else {
                                $wgOut->permissionRequired( 'upload' );
@@ -279,7 +291,7 @@ class UploadForm {
         * @access private
         */
        function processUpload(){
-               global $wgUser, $wgOut, $wgFileExtensions, $wgLang;
+               global $wgOut, $wgFileExtensions, $wgLang;
                $details = null;
                $value = null;
                $value = $this->internalProcessUpload( $details );
@@ -300,7 +312,7 @@ class UploadForm {
                                $this->mainUploadForm( wfMsgHtml( 'emptyfile' ) );
                                break;
 
-                       case self::MIN_LENGHT_PARTNAME:
+                       case self::MIN_LENGTH_PARTNAME:
                                $this->mainUploadForm( wfMsgHtml( 'minlength1' ) );
                                break;
 
@@ -372,7 +384,7 @@ class UploadForm {
 
                if( !wfRunHooks( 'UploadForm:BeforeProcessing', array( &$this ) ) )
                {
-                       wfDebug( "Hook 'UploadForm:BeforeProcessing' broke processing the file." );
+                       wfDebug( "Hook 'UploadForm:BeforeProcessing' broke processing the file.\n" );
                        return self::BEFORE_PROCESSING;
                }
 
@@ -399,7 +411,15 @@ class UploadForm {
                        $basename = $this->mSrcName;
                }
                $filtered = wfStripIllegalFilenameChars( $basename );
-
+               
+               /* Normalize to title form before we do any further processing */
+               $nt = Title::makeTitleSafe( NS_FILE, $filtered );
+               if( is_null( $nt ) ) {
+                       $resultDetails = array( 'filtered' => $filtered );
+                       return self::ILLEGAL_FILENAME;
+               }
+               $filtered = $nt->getDBkey();
+               
                /**
                 * We'll want to blacklist against *any* 'extension', and use
                 * only the final one for the whitelist.
@@ -407,7 +427,7 @@ class UploadForm {
                list( $partname, $ext ) = $this->splitExtensions( $filtered );
 
                if( count( $ext ) ) {
-                       $finalExt = trim( $ext[count( $ext ) - 1] );
+                       $finalExt = $ext[count( $ext ) - 1];
                } else {
                        $finalExt = '';
                }
@@ -420,14 +440,9 @@ class UploadForm {
                }
 
                if( strlen( $partname ) < 1 ) {
-                       return self::MIN_LENGHT_PARTNAME;
+                       return self::MIN_LENGTH_PARTNAME;
                }
 
-               $nt = Title::makeTitleSafe( NS_IMAGE, $filtered );
-               if( is_null( $nt ) ) {
-                       $resultDetails = array( 'filtered' => $filtered );
-                       return self::ILLEGAL_FILENAME;
-               }
                $this->mLocalFile = wfLocalFile( $nt );
                $this->mDestName = $this->mLocalFile->getName();
 
@@ -501,11 +516,13 @@ class UploadForm {
                if ( ! $this->mIgnoreWarning ) {
                        $warning = '';
 
-                       global $wgCapitalLinks;
-                       if( $wgCapitalLinks ) {
-                               $filtered = ucfirst( $filtered );
+                       $comparableName = str_replace( ' ', '_', $basename );
+                       global $wgCapitalLinks, $wgContLang;
+                       if ( $wgCapitalLinks ) {
+                               $comparableName = $wgContLang->ucfirst( $comparableName );
                        }
-                       if( $basename != $filtered ) {
+
+                       if( $comparableName !== $filtered ) {
                                $warning .=  '<li>'.wfMsgHtml( 'badfilename', htmlspecialchars( $this->mDestName ) ).'</li>';
                        }
 
@@ -538,7 +555,7 @@ class UploadForm {
                                $warning .= self::getExistsWarning( $this->mLocalFile );
                        }
                        
-                       $warning .= $this->getDupeWarning( $this->mTempPath );
+                       $warning .= $this->getDupeWarning( $this->mTempPath, $finalExt, $nt );
                        
                        if( $warning != '' ) {
                                /**
@@ -554,8 +571,12 @@ class UploadForm {
                 * Try actually saving the thing...
                 * It will show an error form on failure.
                 */
-               $pageText = self::getInitialPageText( $this->mComment, $this->mLicense,
-                       $this->mCopyrightStatus, $this->mCopyrightSource );
+               if( !$this->mForReUpload ) {
+                       $pageText = self::getInitialPageText( $this->mComment, $this->mLicense,
+                               $this->mCopyrightStatus, $this->mCopyrightSource );
+               } else {
+                       $pageText = false;
+               }
 
                $status = $this->mLocalFile->upload( $this->mTempPath, $this->mComment, $pageText,
                        File::DELETE_SOURCE, $this->mFileProps );
@@ -604,7 +625,7 @@ class UploadForm {
                        // extensions (eg 'jpg' rather than 'JPEG').
                        //
                        // Check for another file using the normalized form...
-                       $nt_lc = Title::makeTitle( NS_IMAGE, $partname . '.' . $file->getExtension() );
+                       $nt_lc = Title::makeTitle( NS_FILE, $partname . '.' . $file->getExtension() );
                        $file_lc = wfLocalFile( $nt_lc );
                } else {
                        $file_lc = false;
@@ -649,7 +670,7 @@ class UploadForm {
                                '</li>' . $dlink2;
 
                } elseif ( ( substr( $partname , 3, 3 ) == 'px-' || substr( $partname , 2, 3 ) == 'px-' )
-                       && ereg( "[0-9]{2}" , substr( $partname , 0, 2) ) )
+                       && preg_match( "/[0-9]{2}/" , substr( $partname , 0, 2 ) ) )
                {
                        # Check for filenames like 50px- or 180px-, these are mostly thumbnails
                        $nt_thb = Title::newFromText( substr( $partname , strpos( $partname , '-' ) +1 ) . '.' . $rawExtension );
@@ -731,7 +752,7 @@ class UploadForm {
        public static function ajaxGetLicensePreview( $license ) {
                global $wgParser, $wgUser;
                $text = '{{' . $license . '}}';
-               $title = Title::makeTitle( NS_IMAGE, 'Sample.jpg' );
+               $title = Title::makeTitle( NS_FILE, 'Sample.jpg' );
                $options = ParserOptions::newFromUser( $wgUser );
 
                // Expand subst: first, then live templates...
@@ -745,22 +766,31 @@ class UploadForm {
         * Check for duplicate files and throw up a warning before the upload
         * completes.
         */
-       function getDupeWarning( $tempfile ) {
+       function getDupeWarning( $tempfile, $extension, $destinationTitle ) {
                $hash = File::sha1Base36( $tempfile );
                $dupes = RepoGroup::singleton()->findBySha1( $hash );
+               $archivedImage = new ArchivedFile( null, 0, $hash.".$extension" );
                if( $dupes ) {
                        global $wgOut;
                        $msg = "<gallery>";
                        foreach( $dupes as $file ) {
                                $title = $file->getTitle();
-                               $msg .= $title->getPrefixedText() .
-                                       "|" . $title->getText() . "\n";
+                               # Don't throw the warning when the titles are the same, it's a reupload
+                               # and highly redundant.
+                               if ( !$title->equals( $destinationTitle ) || !$this->mForReUpload ) {
+                                       $msg .= $title->getPrefixedText() .
+                                               "|" . $title->getText() . "\n";
+                               }
                        }
                        $msg .= "</gallery>";
                        return "<li>" .
                                wfMsgExt( "file-exists-duplicate", array( "parse" ), count( $dupes ) ) .
                                $wgOut->parse( $msg ) .
                                "</li>\n";
+               } elseif ( $archivedImage->getID() > 0 ) {
+                       global $wgOut;
+                       $name = Title::makeTitle( NS_FILE, $archivedImage->getName() )->getPrefixedText();
+                       return Xml::tags( 'li', null, wfMsgExt( 'file-deleted-duplicate', array( 'parseinline' ), array( $name ) ) );
                } else {
                        return '';
                }
@@ -852,6 +882,7 @@ class UploadForm {
         */
        function unsaveUploadedFile() {
                global $wgOut;
+               if( !$this->mTempPath ) return true; // nothing to delete
                $repo = RepoGroup::singleton()->getLocalRepo();
                $success = $repo->freeTemp( $this->mTempPath );
                if ( ! $success ) {
@@ -950,12 +981,12 @@ wgUploadAutoFill = {$autofill};
 
                if( !wfRunHooks( 'UploadForm:initial', array( &$this ) ) )
                {
-                       wfDebug( "Hook 'UploadForm:initial' broke output of the upload form" );
+                       wfDebug( "Hook 'UploadForm:initial' broke output of the upload form\n" );
                        return false;
                }
 
                if( $this->mDesiredDestName ) {
-                       $title = Title::makeTitleSafe( NS_IMAGE, $this->mDesiredDestName );
+                       $title = Title::makeTitleSafe( NS_FILE, $this->mDesiredDestName );
                        // Show a subtitle link to deleted revisions (to sysops et al only)
                        if( $title instanceof Title && ( $count = $title->isDeleted() ) > 0 && $wgUser->isAllowed( 'deletedhistory' ) ) {
                                $link = wfMsgExt(
@@ -966,11 +997,11 @@ wgUploadAutoFill = {$autofill};
                                                wfMsgExt( 'restorelink', array( 'parsemag', 'escape' ), $count )
                                        )
                                );
-                               $wgOut->addHtml( "<div id=\"contentSub2\">{$link}</div>" );
+                               $wgOut->addHTML( "<div id=\"contentSub2\">{$link}</div>" );
                        }
 
                        // Show the relevant lines from deletion log (for still deleted files only)
-                       if( $title instanceof Title && $title->isDeleted() > 0 && !$title->exists() ) {
+                       if( $title instanceof Title && $title->isDeletedQuick() && !$title->exists() ) {
                                $this->showDeletionLog( $wgOut, $title->getPrefixedText() );
                        }
                }
@@ -1021,32 +1052,36 @@ wgUploadAutoFill = {$autofill};
                }
 
                # Get the maximum file size from php.ini as $wgMaxUploadSize works for uploads from URL via CURL only
-               # See http://www.php.net/manual/en/ini.core.php#ini.upload-max-filesize for possible values of upload_max_filesize
-               $val = trim( ini_get( 'upload_max_filesize' ) );
-               $last = strtoupper( ( substr( $val, -1 ) ) );
-               switch( $last ) {
-                       case 'G':
-                               $val2 = substr( $val, 0, -1 ) * 1024 * 1024 * 1024;
-                               break;
-                       case 'M':
-                               $val2 = substr( $val, 0, -1 ) * 1024 * 1024;
-                               break;
-                       case 'K':
-                               $val2 = substr( $val, 0, -1 ) * 1024;
-                               break;
-                       default:
-                               $val2 = $val;
+               # See http://www.php.net/manual/en/faq.using.php#faq.using.shorthandbytes for possible values of upload_max_filesize and post_max_filesize
+               $max_sizes = array();
+               $max_sizes[] = trim( ini_get( 'upload_max_filesize' ) );
+               $max_sizes[] = trim( ini_get( 'post_max_size' ) );
+               foreach( $max_sizes as &$size) {
+                       $last = strtoupper( substr( $size, -1 ) );
+                       switch( $last ) {
+                               case 'G':
+                                       $size = substr( $size, 0, -1 ) * 1024 * 1024 * 1024;
+                                       break;
+                               case 'M':
+                                       $size = substr( $size, 0, -1 ) * 1024 * 1024;
+                                       break;
+                               case 'K':
+                                       $size = substr( $size, 0, -1 ) * 1024;
+                                       break;
+                       }
                }
-               $val2 = $wgAllowCopyUploads ? min( $wgMaxUploadSize, $val2 ) : $val2;
+               $val = min( $max_sizes[0], $max_sizes[1] );
+               $val = $wgAllowCopyUploads ? min( $wgMaxUploadSize, $val ) : $val;
                $maxUploadSize = '<div id="mw-upload-maxfilesize">' . 
                        wfMsgExt( 'upload-maxfilesize', array( 'parseinline', 'escapenoentities' ), 
-                               $wgLang->formatSize( $val2 ) ) .
+                               $wgLang->formatSize( $val ) ) .
                                "</div>\n";
 
                $sourcefilename = wfMsgExt( 'sourcefilename', array( 'parseinline', 'escapenoentities' ) );
         $destfilename = wfMsgExt( 'destfilename', array( 'parseinline', 'escapenoentities' ) ); 
                
-               $summary = wfMsgExt( 'fileuploadsummary', 'parseinline' );
+               $msg = $this->mForReUpload ? 'filereuploadsummary' : 'fileuploadsummary';
+               $summary = wfMsgExt( $msg, 'parseinline' );
 
                $licenses = new Licenses();
                $license = wfMsgExt( 'license', array( 'parseinline' ) );
@@ -1060,10 +1095,9 @@ wgUploadAutoFill = {$autofill};
 
                $encDestName = htmlspecialchars( $this->mDesiredDestName );
 
-               $watchChecked = $this->watchCheck()
-                       ? 'checked="checked"'
-                       : '';
-               $warningChecked = $this->mIgnoreWarning ? 'checked' : '';
+               $watchChecked = $this->watchCheck() ? 'checked="checked"' : '';
+               # Re-uploads should not need "file exist already" warnings
+               $warningChecked = ($this->mIgnoreWarning || $this->mForReUpload) ? 'checked="checked"' : '';
 
                // Prepare form for upload or upload/copy
                if( $wgAllowCopyUploads && $wgUser->isAllowed( 'upload_by_url' ) ) {
@@ -1098,8 +1132,8 @@ wgUploadAutoFill = {$autofill};
                        $warningRow = '';
                        $destOnkeyup = '';
                }
-
                $encComment = htmlspecialchars( $this->mComment );
+               
 
                $wgOut->addHTML(
                         Xml::openElement( 'form', array( 'method' => 'post', 'action' => $titleObj->getLocalURL(),
@@ -1127,10 +1161,26 @@ wgUploadAutoFill = {$autofill};
                                <td class='mw-label'>
                                        <label for='wpDestFile'>{$destfilename}</label>
                                </td>
-                               <td class='mw-input'>
-                                       <input tabindex='2' type='text' name='wpDestFile' id='wpDestFile' size='60'
-                                               value=\"{$encDestName}\" onchange='toggleFilenameFiller()' $destOnkeyup />
-                               </td>
+                               <td class='mw-input'>"
+               );
+               if( $this->mForReUpload ) {
+                       $wgOut->addHTML(
+                               Xml::hidden( 'wpDestFile', $this->mDesiredDestName, array('id'=>'wpDestFile','tabindex'=>2) ) .
+                               "<tt>" .
+                               $encDestName .
+                               "</tt>"
+                       );
+               }
+               else {
+                       $wgOut->addHTML(
+                               "<input tabindex='2' type='text' name='wpDestFile' id='wpDestFile' size='60'
+                                               value=\"{$encDestName}\" onchange='toggleFilenameFiller()' $destOnkeyup />"
+                       );
+               }
+               
+
+               $wgOut->addHTML(
+                               "</td>
                        </tr>
                        <tr>
                                <td class='mw-label'>
@@ -1144,8 +1194,8 @@ wgUploadAutoFill = {$autofill};
                        </tr>
                        <tr>"
                );
-
-               if ( $licenseshtml != '' ) {
+               # Re-uploads should not need license info
+               if ( !$this->mForReUpload && $licenseshtml != '' ) {
                        global $wgStylePath;
                        $wgOut->addHTML( "
                                        <td class='mw-label'>
@@ -1162,7 +1212,7 @@ wgUploadAutoFill = {$autofill};
                                <tr>"
                        );
                        if( $useAjaxLicensePreview ) {
-                               $wgOut->addHtml( "
+                               $wgOut->addHTML( "
                                                <td></td>
                                                <td id=\"mw-license-preview\"></td>
                                        </tr>
@@ -1171,7 +1221,7 @@ wgUploadAutoFill = {$autofill};
                        }
                }
 
-               if ( $wgUseCopyrightUpload ) {
+               if ( !$this->mForReUpload && $wgUseCopyrightUpload ) {
                        $filestatus = wfMsgExt( 'filestatus', 'escapenoentities' );
                        $copystatus =  htmlspecialchars( $this->mCopyrightStatus );
                        $filesource = wfMsgExt( 'filesource', 'escapenoentities' );
@@ -1198,12 +1248,12 @@ wgUploadAutoFill = {$autofill};
                        );
                }
 
-               $wgOut->addHtml( "
+               $wgOut->addHTML( "
                                <td></td>
                                <td>
                                        <input tabindex='7' type='checkbox' name='wpWatchthis' id='wpWatchthis' $watchChecked value='true' />
                                        <label for='wpWatchthis'>" . wfMsgHtml( 'watchthisupload' ) . "</label>
-                                       <input tabindex='8' type='checkbox' name='wpIgnoreWarning' id='wpIgnoreWarning' value='true' $warningChecked/>
+                                       <input tabindex='8' type='checkbox' name='wpIgnoreWarning' id='wpIgnoreWarning' value='true' $warningChecked />
                                        <label for='wpIgnoreWarning'>" . wfMsgHtml( 'ignorewarnings' ) . "</label>
                                </td>
                        </tr>
@@ -1211,19 +1261,23 @@ wgUploadAutoFill = {$autofill};
                        <tr>
                                <td></td>
                                        <td class='mw-input'>
-                                               <input tabindex='9' type='submit' name='wpUpload' value=\"{$ulb}\"" . $wgUser->getSkin()->tooltipAndAccesskey( 'upload' ) . " />
+                                               <input tabindex='9' type='submit' name='wpUpload' value=\"{$ulb}\"" .
+                                                       $wgUser->getSkin()->tooltipAndAccesskey( 'upload' ) . " />
                                        </td>
                        </tr>
                        <tr>
                                <td></td>
                                <td class='mw-input'>"
                );
-               $wgOut->addWikiText( wfMsgForContent( 'edittools' ) );
+               $wgOut->addHTML( '<div class="mw-editTools">' );
+               $wgOut->addWikiMsgArray( 'edittools', array(), array( 'content' ) );
+               $wgOut->addHTML( '</div>' );
                $wgOut->addHTML( "
                                </td>
                        </tr>" .
                        Xml::closeElement( 'table' ) .
                        Xml::hidden( 'wpDestFileWarningAck', '', array( 'id' => 'wpDestFileWarningAck' ) ) .
+                       Xml::hidden( 'wpForReUpload', $this->mForReUpload, array( 'id' => 'wpForReUpload' ) ) .
                        Xml::closeElement( 'fieldset' ) .
                        Xml::closeElement( 'form' )
                );
@@ -1272,7 +1326,7 @@ wgUploadAutoFill = {$autofill};
         *
         * @return array
         */
-       function splitExtensions( $filename ) {
+       public function splitExtensions( $filename ) {
                $bits = explode( '.', $filename );
                $basename = array_shift( $bits );
                return array( $basename, $bits );
@@ -1298,7 +1352,7 @@ wgUploadAutoFill = {$autofill};
         * @param array $list
         * @return bool
         */
-       function checkFileExtensionList( $ext, $list ) {
+       public function checkFileExtensionList( $ext, $list ) {
                foreach( $ext as $e ) {
                        if( in_array( strtolower( $e ), $list ) ) {
                                return true;
@@ -1319,11 +1373,11 @@ wgUploadAutoFill = {$autofill};
                $magic = MimeMagic::singleton();
                $mime = $magic->guessMimeType($tmpfile,false);
 
+
                #check mime type, if desired
                global $wgVerifyMimeType;
                if ($wgVerifyMimeType) {
-
-                 wfDebug ( "\n\nmime: <$mime> extension: <$extension>\n\n");
+                       wfDebug ( "\n\nmime: <$mime> extension: <$extension>\n\n");
                        #check mime type against file extension
                        if( !self::verifyExtension( $mime, $extension ) ) {
                                return new WikiErrorMsg( 'uploadcorrupt' );
@@ -1331,9 +1385,22 @@ wgUploadAutoFill = {$autofill};
 
                        #check mime type blacklist
                        global $wgMimeTypeBlacklist;
-                       if( isset($wgMimeTypeBlacklist) && !is_null($wgMimeTypeBlacklist)
-                               && $this->checkFileExtension( $mime, $wgMimeTypeBlacklist ) ) {
-                               return new WikiErrorMsg( 'filetype-badmime', htmlspecialchars( $mime ) );
+                       if( isset($wgMimeTypeBlacklist) && !is_null($wgMimeTypeBlacklist) ) {
+                               if ( $this->checkFileExtension( $mime, $wgMimeTypeBlacklist ) ) {
+                                       return new WikiErrorMsg( 'filetype-badmime', htmlspecialchars( $mime ) );
+                               }
+
+                               # Check IE type
+                               $fp = fopen( $tmpfile, 'rb' );
+                               $chunk = fread( $fp, 256 );
+                               fclose( $fp );
+                               $extMime = $magic->guessTypesForExtension( $extension );
+                               $ieTypes = $magic->getIEMimeTypes( $tmpfile, $chunk, $extMime );
+                               foreach ( $ieTypes as $ieType ) {
+                                       if ( $this->checkFileExtension( $ieType, $wgMimeTypeBlacklist ) ) {
+                                               return new WikiErrorMsg( 'filetype-bad-ie-mime', $ieType );
+                                       }
+                               }
                        }
                }
 
@@ -1341,6 +1408,11 @@ wgUploadAutoFill = {$autofill};
                if( $this->detectScript ( $tmpfile, $mime, $extension ) ) {
                        return new WikiErrorMsg( 'uploadscripted' );
                }
+               if( $extension == 'svg' || $mime == 'image/svg+xml' ) {
+                       if( $this->detectScriptInSvg( $tmpfile ) ) {
+                               return new WikiErrorMsg( 'uploadscripted' );
+                       }
+               }
 
                /**
                * Scan the uploaded file for viruses
@@ -1392,6 +1464,7 @@ wgUploadAutoFill = {$autofill};
                }
        }
 
+
        /**
         * Heuristic for detecting files that *could* contain JavaScript instructions or
         * things that may look like HTML to a browser and are thus
@@ -1433,7 +1506,7 @@ wgUploadAutoFill = {$autofill};
                wfDebug("SpecialUpload::detectScript: checking for embedded scripts and HTML stuff\n");
 
                #check for HTML doctype
-               if (eregi("<!DOCTYPE *X?HTML",$chunk)) return true;
+               if ( preg_match( "/<!DOCTYPE *X?HTML/i", $chunk ) ) return true;
 
                /**
                * Internet Explorer for Windows performs some really stupid file type
@@ -1452,6 +1525,7 @@ wgUploadAutoFill = {$autofill};
                */
 
                $tags = array(
+                       '<a href',
                        '<body',
                        '<head',
                        '<html',   #also in safari
@@ -1490,6 +1564,41 @@ wgUploadAutoFill = {$autofill};
                return false;
        }
 
+       function detectScriptInSvg( $filename ) {
+               $check = new XmlTypeCheck( $filename, array( $this, 'checkSvgScriptCallback' ) );
+               return $check->filterMatch;
+       }
+       
+       /**
+        * @todo Replace this with a whitelist filter!
+        */
+       function checkSvgScriptCallback( $element, $attribs ) {
+               $stripped = $this->stripXmlNamespace( $element );
+               
+               if( $stripped == 'script' ) {
+                       wfDebug( __METHOD__ . ": Found script element '$element' in uploaded file.\n" );
+                       return true;
+               }
+               
+               foreach( $attribs as $attrib => $value ) {
+                       $stripped = $this->stripXmlNamespace( $attrib );
+                       if( substr( $stripped, 0, 2 ) == 'on' ) {
+                               wfDebug( __METHOD__ . ": Found script attribute '$attrib'='value' in uploaded file.\n" );
+                               return true;
+                       }
+                       if( $stripped == 'href' && strpos( strtolower( $value ), 'javascript:' ) !== false ) {
+                               wfDebug( __METHOD__ . ": Found script href attribute '$attrib'='$value' in uploaded file.\n" );
+                               return true;
+                       }
+               }
+       }
+       
+       private function stripXmlNamespace( $name ) {
+               // 'http://www.w3.org/2000/svg:script' -> 'script'
+               $parts = explode( ':', strtolower( $name ) );
+               return array_pop( $parts );
+       }
+       
        /**
         * Generic wrapper function for a virus scanner program.
         * This relies on the $wgAntivirus and $wgAntivirusSetup variables.
@@ -1585,7 +1694,7 @@ wgUploadAutoFill = {$autofill};
                                }
                        }
 
-                       wfDebug( __METHOD__.": FOUND VIRUS! scanner feedback: $output" );
+                       wfDebug( __METHOD__.": FOUND VIRUS! scanner feedback: $output \n" );
                        return $output;
                }
        }
@@ -1622,7 +1731,7 @@ wgUploadAutoFill = {$autofill};
         * @access private
         */
        function cleanupTempFile() {
-               if ( $this->mRemoveTempFile && file_exists( $this->mTempPath ) ) {
+               if ( $this->mRemoveTempFile && $this->mTempPath && file_exists( $this->mTempPath ) ) {
                        wfDebug( "SpecialUpload::cleanupTempFile: Removing temporary file {$this->mTempPath}\n" );
                        unlink( $this->mTempPath );
                }
@@ -1735,14 +1844,14 @@ wgUploadAutoFill = {$autofill};
                $loglist = new LogEventsList( $wgUser->getSkin(), $out );
                $pager = new LogPager( $loglist, 'delete', false, $filename );
                if( $pager->getNumRows() > 0 ) {
-                       $out->addHtml( '<div class="mw-warning-with-logexcerpt">' );
+                       $out->addHTML( '<div class="mw-warning-with-logexcerpt">' );
                        $out->addWikiMsg( 'upload-wasdeleted' );
                        $out->addHTML(
                                $loglist->beginLogEventsList() .
                                $pager->getBody() .
                                $loglist->endLogEventsList()
                        );
-                       $out->addHtml( '</div>' );
+                       $out->addHTML( '</div>' );
                }
        }
 }