X-Git-Url: https://git.cyclocoop.org/?a=blobdiff_plain;f=includes%2FStreamFile.php;h=0a8309f142c496f1c9e39f96ee17896e1f436a72;hb=957850f0da357337c24291a29d5ea0f08b5050a9;hp=e65b724cccae2210acd0da3dffcd77f60b4621b0;hpb=7bbe971aec2d548de981a12ed08a7b56a536dcdb;p=lhc%2Fweb%2Fwiklou.git diff --git a/includes/StreamFile.php b/includes/StreamFile.php index e65b724ccc..0a8309f142 100644 --- a/includes/StreamFile.php +++ b/includes/StreamFile.php @@ -1,64 +1,133 @@ -

File not found

-

Although this PHP script ({$_SERVER['SCRIPT_NAME']}) exists, the file requested for output -does not.

-"; - return; - } +/** + * Functions related to the output of file content + * + * @file + */ +class StreamFile { + /** + * Stream a file to the browser, adding all the headings and fun stuff + * @param $fname string Full name and path of the file to stream + * @param $headers array Any additional headers to send + * @param $sendErrors bool Send error messages if errors occur (like 404) + * @return bool Success + */ + public static function stream( $fname, $headers = array(), $sendErrors = true ) { + global $wgLanguageCode; + + wfSuppressWarnings(); + $stat = stat( $fname ); + wfRestoreWarnings(); + if ( !$stat ) { + if ( $sendErrors ) { + header( 'HTTP/1.0 404 Not Found' ); + header( 'Cache-Control: no-cache' ); + header( 'Content-Type: text/html; charset=utf-8' ); + $encFile = htmlspecialchars( $fname ); + $encScript = htmlspecialchars( $_SERVER['SCRIPT_NAME'] ); + echo " +

File not found

+

Although this PHP script ($encScript) exists, the file requested for output + ($encFile) does not.

+ + "; + } + return false; + } - header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s', $stat['mtime'] ) . ' GMT' ); + header( 'Last-Modified: ' . gmdate( 'D, d M Y H:i:s', $stat['mtime'] ) . ' GMT' ); - if ( !empty( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) ) { - $modsince = preg_replace( '/;.*$/', '', $_SERVER['HTTP_IF_MODIFIED_SINCE'] ); - $sinceTime = strtotime( $modsince ); - if ( $stat['mtime'] <= $sinceTime ) { - header( "HTTP/1.0 304 Not Modified" ); - return; + // Cancel output buffering and gzipping if set + wfResetOutputBuffers(); + + $type = self::getType( $fname ); + if ( $type && $type != 'unknown/unknown' ) { + header( "Content-type: $type" ); + } else { + header( 'Content-type: application/x-wiki' ); + } + + // Don't stream it out as text/html if there was a PHP error + if ( headers_sent() ) { + echo "Headers already sent, terminating.\n"; + return false; + } + + header( "Content-Disposition: inline;filename*=utf-8'$wgLanguageCode'" . + urlencode( basename( $fname ) ) ); + + // Send additional headers + foreach ( $headers as $header ) { + header( $header ); } - } - - header( 'Content-Length: ' . $stat['size'] ); - - $type = wfGetType( $fname ); - if ( $type and $type!="unknown/unknown") { - header("Content-type: $type"); - } else { - header('Content-type: application/x-wiki'); - } - - readfile( $fname ); -} -/** */ -function wfGetType( $filename ) { - global $wgTrivialMimeDetection; - - # trivial detection by file extension, - # used for thumbnails (thumb.php) - if ($wgTrivialMimeDetection) { - $ext= strtolower(strrchr($filename, '.')); - - switch ($ext) { - case '.gif': return 'image/gif'; - case '.png': return 'image/png'; - case '.jpg': return 'image/jpeg'; - case '.jpeg': return 'image/jpeg'; + // Don't send if client has up to date cache + if ( !empty( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) ) { + $modsince = preg_replace( '/;.*$/', '', $_SERVER['HTTP_IF_MODIFIED_SINCE'] ); + $sinceTime = strtotime( $modsince ); + if ( $stat['mtime'] <= $sinceTime ) { + ini_set( 'zlib.output_compression', 0 ); + header( "HTTP/1.0 304 Not Modified" ); + return true; // ok + } } - - return 'unknown/unknown'; + + header( 'Content-Length: ' . $stat['size'] ); + + return readfile( $fname ); } - else { - $magic=& wfGetMimeMagic(); - return $magic->guessMimeType($filename); //full fancy mime detection + + /** + * Determine the filetype we're dealing with + * @param $filename string + * @param $safe bool + * @return null|string + */ + private static function getType( $filename, $safe = true ) { + global $wgTrivialMimeDetection; + + $ext = strrchr( $filename, '.' ); + $ext = $ext === false ? '' : strtolower( substr( $ext, 1 ) ); + + # trivial detection by file extension, + # used for thumbnails (thumb.php) + if ( $wgTrivialMimeDetection ) { + switch ( $ext ) { + case 'gif': return 'image/gif'; + case 'png': return 'image/png'; + case 'jpg': return 'image/jpeg'; + case 'jpeg': return 'image/jpeg'; + } + + return 'unknown/unknown'; + } + + $magic = MimeMagic::singleton(); + // Use the extension only, rather than magic numbers, to avoid opening + // up vulnerabilities due to uploads of files with allowed extensions + // but disallowed types. + $type = $magic->guessTypesForExtension( $ext ); + + /** + * Double-check some security settings that were done on upload but might + * have changed since. + */ + if ( $safe ) { + global $wgFileBlacklist, $wgCheckFileExtensions, $wgStrictFileExtensions, + $wgFileExtensions, $wgVerifyMimeType, $wgMimeTypeBlacklist; + list( , $extList ) = UploadBase::splitExtensions( $filename ); + if ( UploadBase::checkFileExtensionList( $extList, $wgFileBlacklist ) ) { + return 'unknown/unknown'; + } + if ( $wgCheckFileExtensions && $wgStrictFileExtensions + && !UploadBase::checkFileExtensionList( $extList, $wgFileExtensions ) ) + { + return 'unknown/unknown'; + } + if ( $wgVerifyMimeType && in_array( strtolower( $type ), $wgMimeTypeBlacklist ) ) { + return 'unknown/unknown'; + } + } + return $type; } } - -?>