From 24babf696a57e7828522c7d5c9e4cdcada5433ad Mon Sep 17 00:00:00 2001 From: Tim Starling Date: Thu, 10 Jun 2004 11:52:04 +0000 Subject: [PATCH] Output actual content with the error message, better usage of $wgWhitelistRead, explanation of how to use --- img_auth.php | 42 +++++++++++++++++++++++++++++++----------- 1 file changed, 31 insertions(+), 11 deletions(-) diff --git a/img_auth.php b/img_auth.php index f38d400338..02240ceea9 100644 --- a/img_auth.php +++ b/img_auth.php @@ -1,20 +1,26 @@ getID() ) { - header( "HTTP/1.0 403 Forbidden" ); - exit; -} -# Check if the filename is in the correct directory +# Get filenames/directories $filename = realpath( $wgUploadDirectory . $_SERVER['PATH_INFO'] ); $realUploadDirectory = realpath( $wgUploadDirectory ); +$imageName = $wgLang->getNsText( NS_IMAGE ) . ":" . basename( $_SERVER['PATH_INFO'] ); + +# Check if the filename is in the correct directory if ( substr( $filename, 0, strlen( $realUploadDirectory ) ) != $realUploadDirectory ) { - header( "HTTP/1.0 403 Forbidden" ); - exit; + wfForbidden(); +} + +if ( is_array( $wgWhitelistRead ) && !in_array( $imageName, $wgWhitelistRead ) && !$wgUser->getID() ) { + wfForbidden(); } # Write file @@ -27,7 +33,8 @@ readfile( $filename ); function wfGetType( $filename ) { # There's probably a better way to do this - $types = "application/andrew-inset ez + $types = << +

Access denied

You need to log in to access files on this server

+"; + exit; +} + ?> -- 2.20.1