Go to the documentation of this file.
59 # HOOK_ABORTED is the new name of UPLOAD_VERIFICATION_ERROR
73 $code_to_status =
array(
74 self::EMPTY_FILE =>
'empty-file',
75 self::FILE_TOO_LARGE =>
'file-too-large',
76 self::FILETYPE_MISSING =>
'filetype-missing',
77 self::FILETYPE_BADTYPE =>
'filetype-banned',
78 self::MIN_LENGTH_PARTNAME =>
'filename-tooshort',
79 self::ILLEGAL_FILENAME =>
'illegal-filename',
80 self::OVERWRITE_EXISTING_FILE =>
'overwrite',
81 self::VERIFICATION_ERROR =>
'verification-error',
82 self::HOOK_ABORTED =>
'hookaborted',
83 self::WINDOWS_NONASCII_FILENAME =>
'windows-nonascii-filename',
84 self::FILENAME_TOO_LONG =>
'filename-toolong',
86 if ( isset( $code_to_status[
$error] ) ) {
87 return $code_to_status[
$error];
90 return 'unknown-error';
101 if ( !$wgEnableUploads ) {
105 # Check php's file_uploads setting
118 foreach (
array(
'upload',
'edit' )
as $permission ) {
119 if ( !
$user->isAllowed( $permission ) ) {
149 if ( is_null( $className ) ) {
150 $className =
'UploadFrom' .
$type;
151 wfDebug( __METHOD__ .
": class name: $className\n" );
152 if ( !in_array(
$type, self::$uploadHandlers ) ) {
158 if ( !call_user_func(
array( $className,
'isEnabled' ) ) ) {
163 if ( !call_user_func(
array( $className,
'isValidRequest' ), $request ) ) {
167 $handler =
new $className;
169 $handler->initializeFromRequest( $request );
203 $this->mDesiredDestName =
$name;
205 throw new MWException( __METHOD__ .
" given storage path `$tempPath`." );
207 $this->mTempPath = $tempPath;
208 $this->mFileSize = $fileSize;
209 $this->mRemoveTempFile = $removeTempFile;
230 return empty( $this->mFileSize );
256 if ( $repo->isVirtualUrl( $srcPath ) ) {
259 $tmpFile = $repo->getLocalCopy( $srcPath );
261 $tmpFile->bind( $this );
263 $path = $tmpFile ? $tmpFile->getPath() :
false;
283 return array(
'status' => self::EMPTY_FILE );
290 if ( $this->mFileSize > $maxSize ) {
293 'status' => self::FILE_TOO_LARGE,
304 if ( $verification !==
true ) {
307 'status' => self::VERIFICATION_ERROR,
308 'details' => $verification
323 array( $this->mDestName, $this->mTempPath, &
$error ) )
326 return array(
'status' => self::HOOK_ABORTED,
'error' =>
$error );
330 return array(
'status' => self::OK );
341 if ( is_null( $nt ) ) {
343 if ( $this->mTitleError == self::ILLEGAL_FILENAME ) {
346 if ( $this->mTitleError == self::FILETYPE_BADTYPE ) {
348 if ( count( $this->mBlackListedExtensions ) ) {
370 if ( $wgVerifyMimeType ) {
371 wfDebug(
"\n\nmime: <$mime> extension: <{$this->mFinalExtension}>\n\n" );
372 global $wgMimeTypeBlacklist;
379 $fp = fopen( $this->mTempPath,
'rb' );
380 $chunk = fread( $fp, 256 );
383 $magic = MimeMagic::singleton();
384 $extMime = $magic->guessTypesForExtension( $this->mFinalExtension );
385 $ieTypes = $magic->getIEMimeTypes( $this->mTempPath, $chunk, $extMime );
386 foreach ( $ieTypes
as $ieType ) {
389 return array(
'filetype-bad-ie-mime', $ieType );
408 if ( $status !==
true ) {
414 $mime = $this->mFileProps[
'file-mime'];
416 if ( $wgVerifyMimeType ) {
417 # XXX: Missing extension will be caught by validateName() via getTitle()
418 if ( $this->mFinalExtension !=
'' && !$this->
verifyExtension(
$mime, $this->mFinalExtension ) ) {
420 return array(
'filetype-mime-mismatch', $this->mFinalExtension,
$mime );
426 $handlerStatus = $handler->verifyUpload( $this->mTempPath );
427 if ( !$handlerStatus->isOK() ) {
428 $errors = $handlerStatus->getErrorsArray();
430 return reset( $errors );
435 if ( $status !==
true ) {
440 wfDebug( __METHOD__ .
": all clear; passing.\n" );
454 global $wgAllowJavaUploads, $wgDisableUploadScriptChecks;
457 # getTitle() sets some internal parameters like $this->mFinalExtension
462 # check mime type, if desired
463 $mime = $this->mFileProps[
'file-mime'];
465 if ( $status !==
true ) {
470 # check for htmlish code and javascript
471 if ( !$wgDisableUploadScriptChecks ) {
472 if ( self::detectScript( $this->mTempPath,
$mime, $this->mFinalExtension ) ) {
474 return array(
'uploadscripted' );
476 if ( $this->mFinalExtension ==
'svg' ||
$mime ==
'image/svg+xml' ) {
478 if ( $svgStatus !==
false ) {
485 # Check for Java applets, which if uploaded can bypass cross-site
487 if ( !$wgAllowJavaUploads ) {
488 $this->mJavaDetected =
false;
490 array( $this,
'zipEntryCallback' ) );
491 if ( !$zipStatus->isOK() ) {
492 $errors = $zipStatus->getErrorsArray();
493 $error = reset( $errors );
494 if (
$error[0] !==
'zip-wrong-format' ) {
499 if ( $this->mJavaDetected ) {
501 return array(
'uploadjava' );
505 # Scan the uploaded file for viruses
509 return array(
'uploadvirus', $virus );
520 $names =
array( $entry[
'name'] );
527 $nullPos = strpos( $entry[
'name'],
"\000" );
528 if ( $nullPos !==
false ) {
529 $names[] = substr( $entry[
'name'], 0, $nullPos );
534 if ( preg_grep(
'!\.class/?$!', $names ) ) {
535 $this->mJavaDetected =
true;
567 if ( is_null( $nt ) ) {
570 $permErrors = $nt->getUserPermissionsErrors(
'edit',
$user );
571 $permErrorsUpload = $nt->getUserPermissionsErrors(
'upload',
$user );
572 if ( !$nt->exists() ) {
573 $permErrorsCreate = $nt->getUserPermissionsErrors(
'create',
$user );
575 $permErrorsCreate =
array();
577 if ( $permErrors || $permErrorsUpload || $permErrorsCreate ) {
578 $permErrors = array_merge( $permErrors,
wfArrayDiff2( $permErrorsUpload, $permErrors ) );
579 $permErrors = array_merge( $permErrors,
wfArrayDiff2( $permErrorsCreate, $permErrors ) );
584 if ( $overwriteError !==
true ) {
585 return array( $overwriteError );
605 $filename = $localFile->getName();
611 $comparableName = str_replace(
' ',
'_', $this->mDesiredDestName );
614 if ( $this->mDesiredDestName != $filename && $comparableName != $filename ) {
615 $warnings[
'badfilename'] = $filename;
617 wfDebugLog(
'upload',
"Filename: '$filename', mDesiredDestName: '$this->mDesiredDestName', comparableName: '$comparableName'" );
622 if ( $wgCheckFileExtensions ) {
625 $warnings[
'filetype-unwanted-type'] =
array( $this->mFinalExtension,
630 global $wgUploadSizeWarning;
631 if ( $wgUploadSizeWarning && ( $this->mFileSize > $wgUploadSizeWarning ) ) {
632 $warnings[
'large-file'] =
array( $wgUploadSizeWarning, $this->mFileSize );
635 if ( $this->mFileSize == 0 ) {
636 $warnings[
'emptyfile'] =
true;
640 if ( $exists !==
false ) {
641 $warnings[
'exists'] = $exists;
649 foreach ( $dupes
as $key => $dupe ) {
650 if (
$title->equals( $dupe->getTitle() ) ) {
651 unset( $dupes[$key] );
655 $warnings[
'duplicate'] = $dupes;
659 $archivedImage =
new ArchivedFile(
null, 0,
"{$hash}.{$this->mFinalExtension}" );
660 if ( $archivedImage->getID() > 0 ) {
662 $warnings[
'duplicate-archive'] = $archivedImage->getName();
664 $warnings[
'duplicate-archive'] =
'';
696 if ( $status->isGood() ) {
714 if ( $this->mTitle !==
false ) {
722 $this->mFilteredName =
$title->getDBkey();
727 # oi_archive_name is max 255 bytes, which include a timestamp and an
728 # exclamation mark, so restrict file name to 240 bytes.
729 if ( strlen( $this->mFilteredName ) > 240 ) {
731 $this->mTitle =
null;
743 if ( is_null( $nt ) ) {
745 $this->mTitle =
null;
748 $this->mFilteredName = $nt->getDBkey();
756 if ( count(
$ext ) ) {
757 $this->mFinalExtension = trim(
$ext[count(
$ext ) - 1] );
759 $this->mFinalExtension =
'';
761 # No extension, try guessing one
762 $magic = MimeMagic::singleton();
763 $mime = $magic->guessMimeType( $this->mTempPath );
764 if (
$mime !==
'unknown/unknown' ) {
765 # Get a space separated list of extensions
766 $extList = $magic->getExtensionsForType(
$mime );
768 # Set the extension to the canonical extension
769 $this->mFinalExtension = strtok( $extList,
' ' );
771 # Fix up the other variables
772 $this->mFilteredName .=
".{$this->mFinalExtension}";
780 global $wgCheckFileExtensions, $wgStrictFileExtensions;
785 if ( $this->mFinalExtension ==
'' ) {
787 $this->mTitle =
null;
789 } elseif ( $blackListedExtensions ||
790 ( $wgCheckFileExtensions && $wgStrictFileExtensions &&
792 $this->mBlackListedExtensions = $blackListedExtensions;
794 $this->mTitle =
null;
799 if (
wfIsWindows() && !preg_match(
'/^[\x0-\x7f]*$/', $nt->getText() ) ) {
801 $this->mTitle =
null;
805 # If there was more than one "extension", reassemble the base
806 # filename to prevent bogus complaints about length
807 if ( count(
$ext ) > 1 ) {
808 for ( $i = 0; $i < count(
$ext ) - 1; $i++ ) {
809 $partname .=
'.' .
$ext[$i];
813 if ( strlen( $partname ) < 1 ) {
815 $this->mTitle =
null;
829 if ( is_null( $this->mLocalFile ) ) {
831 $this->mLocalFile = is_null( $nt ) ? null :
wfLocalFile( $nt );
854 $this->mLocalFile =
$file;
883 if ( $this->mRemoveTempFile && $this->mTempPath && file_exists( $this->mTempPath ) ) {
884 wfDebug( __METHOD__ .
": Removing temporary file {$this->mTempPath}\n" );
885 unlink( $this->mTempPath );
903 $bits = explode(
'.', $filename );
904 $basename = array_shift( $bits );
905 return array( $basename, $bits );
917 return in_array( strtolower(
$ext ), $list );
929 return array_intersect( array_map(
'strtolower',
$ext ), $list );
940 $magic = MimeMagic::singleton();
943 if ( !$magic->isRecognizableExtension( $extension ) ) {
944 wfDebug( __METHOD__ .
": passing file with unknown detected mime type; " .
945 "unrecognized extension '$extension', can't verify\n" );
948 wfDebug( __METHOD__ .
": rejecting file with unknown detected mime type; " .
949 "recognized extension '$extension', so probably invalid file\n" );
954 $match = $magic->isMatchingExtension( $extension,
$mime );
956 if ( $match ===
null ) {
957 if ( $magic->getTypesForExtension( $extension ) !== null ) {
958 wfDebug( __METHOD__ .
": No extension known for $mime, but we know a mime for $extension\n" );
961 wfDebug( __METHOD__ .
": no file extension known for mime type $mime, passing file\n" );
964 } elseif ( $match ===
true ) {
965 wfDebug( __METHOD__ .
": mime type $mime matches extension $extension, passing file\n" );
967 #TODO: if it's a bitmap, make sure PHP or ImageMagic resp. can handle it!
971 wfDebug( __METHOD__ .
": mime type $mime mismatches file extension $extension, rejecting file\n" );
988 global $wgAllowTitlesInSVG;
991 # ugly hack: for text files, always look at the entire file.
992 # For binary field, just check the first K.
994 if ( strpos(
$mime,
'text/' ) === 0 ) {
995 $chunk = file_get_contents(
$file );
997 $fp = fopen(
$file,
'rb' );
998 $chunk = fread( $fp, 1024 );
1002 $chunk = strtolower( $chunk );
1009 # decode from UTF-16 if needed (could be used for obfuscation).
1010 if ( substr( $chunk, 0, 2 ) ==
"\xfe\xff" ) {
1012 } elseif ( substr( $chunk, 0, 2 ) ==
"\xff\xfe" ) {
1019 $chunk = iconv( $enc,
"ASCII//IGNORE", $chunk );
1022 $chunk = trim( $chunk );
1024 # @todo FIXME: Convert from UTF-16 if necessary!
1025 wfDebug( __METHOD__ .
": checking for embedded scripts and HTML stuff\n" );
1027 # check for HTML doctype
1028 if ( preg_match(
"/<!DOCTYPE *X?HTML/i", $chunk ) ) {
1035 if ( $extension ==
'svg' || strpos(
$mime,
'image/svg' ) === 0 ) {
1036 if ( self::checkXMLEncodingMissmatch(
$file ) ) {
1061 '<html', #also
in safari
1064 '<script', #also
in safari
1068 if ( !$wgAllowTitlesInSVG && $extension !==
'svg' &&
$mime !==
'image/svg' ) {
1072 foreach ( $tags
as $tag ) {
1073 if (
false !== strpos( $chunk, $tag ) ) {
1074 wfDebug( __METHOD__ .
": found something that may make it be mistaken for html: $tag\n" );
1084 # resolve entity-refs to look at attributes. may be harsh on big files... cache result?
1087 # look for script-types
1088 if ( preg_match(
'!type\s*=\s*[\'"]?\s*(?:\w*/)?(?:ecma|java)!sim', $chunk ) ) {
1089 wfDebug( __METHOD__ .
": found script types\n" );
1094 # look for html-style script-urls
1095 if ( preg_match(
'!(?:href|src|data)\s*=\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) ) {
1096 wfDebug( __METHOD__ .
": found html-style script urls\n" );
1101 # look for css-style script-urls
1102 if ( preg_match(
'!url\s*\(\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) ) {
1103 wfDebug( __METHOD__ .
": found css-style script urls\n" );
1108 wfDebug( __METHOD__ .
": no scripts found\n" );
1121 global $wgSVGMetadataCutoff;
1122 $contents = file_get_contents(
$file,
false,
null, -1, $wgSVGMetadataCutoff );
1123 $encodingRegex =
'!encoding[ \t\n\r]*=[ \t\n\r]*[\'"](.*?)[\'"]!si';
1125 if ( preg_match(
"!<\?xml\b(.*?)\?>!si", $contents,
$matches ) ) {
1126 if ( preg_match( $encodingRegex,
$matches[1], $encMatch )
1127 && !in_array( strtoupper( $encMatch[1] ), self::$safeXmlEncodings )
1129 wfDebug( __METHOD__ .
": Found unsafe XML encoding '{$encMatch[1]}'\n" );
1132 } elseif ( preg_match(
"!<\?xml\b!si", $contents ) ) {
1135 wfDebug( __METHOD__ .
": Unmatched XML declaration start\n" );
1137 } elseif ( substr( $contents, 0, 4 ) ==
"\x4C\x6F\xA7\x94" ) {
1139 wfDebug( __METHOD__ .
": EBCDIC Encoded XML\n" );
1145 $attemptEncodings =
array(
'UTF-16',
'UTF-16BE',
'UTF-32',
'UTF-32BE' );
1146 foreach ( $attemptEncodings
as $encoding ) {
1148 $str = iconv( $encoding,
'UTF-8', $contents );
1150 if ( $str !=
'' && preg_match(
"!<\?xml\b(.*?)\?>!si", $str,
$matches ) ) {
1151 if ( preg_match( $encodingRegex,
$matches[1], $encMatch )
1152 && !in_array( strtoupper( $encMatch[1] ), self::$safeXmlEncodings )
1154 wfDebug( __METHOD__ .
": Found unsafe XML encoding '{$encMatch[1]}'\n" );
1157 } elseif ( $str !=
'' && preg_match(
"!<\?xml\b!si", $str ) ) {
1160 wfDebug( __METHOD__ .
": Unmatched XML declaration start\n" );
1173 $this->mSVGNSError =
false;
1176 array( $this,
'checkSvgScriptCallback' ),
1178 array(
'processing_instruction_handler' =>
'UploadBase::checkSvgPICallback' )
1180 if ( $check->wellFormed !==
true ) {
1182 return array(
'uploadinvalidxml' );
1183 } elseif ( $check->filterMatch ) {
1184 if ( $this->mSVGNSError ) {
1185 return array(
'uploadscriptednamespace', $this->mSVGNSError );
1187 return array(
'uploadscripted' );
1200 if ( preg_match(
'/xml-stylesheet/i', $target ) ) {
1216 static $validNamespaces =
array(
1219 'http://creativecommons.org/ns#',
1220 'http://inkscape.sourceforge.net/dtd/sodipodi-0.dtd',
1221 'http://ns.adobe.com/adobeillustrator/10.0/',
1222 'http://ns.adobe.com/adobesvgviewerextensions/3.0/',
1223 'http://ns.adobe.com/extensibility/1.0/',
1224 'http://ns.adobe.com/flows/1.0/',
1225 'http://ns.adobe.com/illustrator/1.0/',
1226 'http://ns.adobe.com/imagereplacement/1.0/',
1227 'http://ns.adobe.com/pdf/1.3/',
1228 'http://ns.adobe.com/photoshop/1.0/',
1229 'http://ns.adobe.com/saveforweb/1.0/',
1230 'http://ns.adobe.com/variables/1.0/',
1231 'http://ns.adobe.com/xap/1.0/',
1232 'http://ns.adobe.com/xap/1.0/g/',
1233 'http://ns.adobe.com/xap/1.0/g/img/',
1234 'http://ns.adobe.com/xap/1.0/mm/',
1235 'http://ns.adobe.com/xap/1.0/rights/',
1236 'http://ns.adobe.com/xap/1.0/stype/dimensions#',
1237 'http://ns.adobe.com/xap/1.0/stype/font#',
1238 'http://ns.adobe.com/xap/1.0/stype/manifestitem#',
1239 'http://ns.adobe.com/xap/1.0/stype/resourceevent#',
1240 'http://ns.adobe.com/xap/1.0/stype/resourceref#',
1241 'http://ns.adobe.com/xap/1.0/t/pg/',
1242 'http://purl.org/dc/elements/1.1/',
1243 'http://purl.org/dc/elements/1.1',
1244 'http://schemas.microsoft.com/visio/2003/svgextensions/',
1245 'http://sodipodi.sourceforge.net/dtd/sodipodi-0.dtd',
1246 'http://web.resource.org/cc/',
1247 'http://www.freesoftware.fsf.org/bkchem/cdml',
1248 'http://www.inkscape.org/namespaces/inkscape',
1249 'http://www.w3.org/1999/02/22-rdf-syntax-ns#',
1250 'http://www.w3.org/2000/svg',
1253 if ( !in_array( $namespace, $validNamespaces ) ) {
1254 wfDebug( __METHOD__ .
": Non-svg namespace '$namespace' in uploaded file.\n" );
1256 $this->mSVGNSError = $namespace;
1263 if ( $strippedElement ==
'script' ) {
1264 wfDebug( __METHOD__ .
": Found script element '$element' in uploaded file.\n" );
1268 # e.g., <svg xmlns="http://www.w3.org/2000/svg"> <handler xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load">alert(1)</handler> </svg>
1269 if ( $strippedElement ==
'handler' ) {
1270 wfDebug( __METHOD__ .
": Found scriptable element '$element' in uploaded file.\n" );
1274 # SVG reported in Feb '12 that used xml:stylesheet to generate javascript block
1275 if ( $strippedElement ==
'stylesheet' ) {
1276 wfDebug( __METHOD__ .
": Found scriptable element '$element' in uploaded file.\n" );
1280 # Block iframes, in case they pass the namespace check
1281 if ( $strippedElement ==
'iframe' ) {
1282 wfDebug( __METHOD__ .
": iframe in uploaded file.\n" );
1287 if ( $strippedElement ==
'style'
1290 wfDebug( __METHOD__ .
": hostile css in style element.\n" );
1298 if ( substr( $stripped, 0, 2 ) ==
'on' ) {
1299 wfDebug( __METHOD__ .
": Found event-handler attribute '$attrib'='$value' in uploaded file.\n" );
1303 # href with non-local target (don't allow http://, javascript:, etc)
1304 if ( $stripped ==
'href'
1305 && strpos(
$value,
'data:' ) !== 0
1306 && strpos(
$value,
'#' ) !== 0
1308 if ( !( $strippedElement ===
'a'
1309 && preg_match(
'!^https?://!im',
$value ) )
1311 wfDebug( __METHOD__ .
": Found href attribute <$strippedElement "
1312 .
"'$attrib'='$value' in uploaded file.\n" );
1318 # href with embedded svg as target
1319 if ( $stripped ==
'href' && preg_match(
'!data:[^,]*image/svg[^,]*,!sim',
$value ) ) {
1320 wfDebug( __METHOD__ .
": Found href to embedded svg \"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" );
1324 # href with embedded (text/xml) svg as target
1325 if ( $stripped ==
'href' && preg_match(
'!data:[^,]*text/xml[^,]*,!sim',
$value ) ) {
1326 wfDebug( __METHOD__ .
": Found href to embedded svg \"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" );
1330 # Change href with animate from (http://html5sec.org/#137). This doesn't seem
1331 # possible without embedding the svg, but filter here in case.
1332 if ( $stripped ==
'from'
1333 && $strippedElement ===
'animate'
1334 && !preg_match(
'!^https?://!im',
$value )
1336 wfDebug( __METHOD__ .
": Found animate that might be changing href using from "
1337 .
"\"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" );
1342 # use set/animate to add event-handler attribute to parent
1343 if ( ( $strippedElement ==
'set' || $strippedElement ==
'animate' ) && $stripped ==
'attributename' && substr(
$value, 0, 2 ) ==
'on' ) {
1344 wfDebug( __METHOD__ .
": Found svg setting event-handler attribute with \"<$strippedElement $stripped='$value'...\" in uploaded file.\n" );
1348 # use set to add href attribute to parent element
1349 if ( $strippedElement ==
'set' && $stripped ==
'attributename' && strpos(
$value,
'href' ) !==
false ) {
1350 wfDebug( __METHOD__ .
": Found svg setting href attribute '$value' in uploaded file.\n" );
1354 # use set to add a remote / data / script target to an element
1355 if ( $strippedElement ==
'set' && $stripped ==
'to' && preg_match(
'!(http|https|data|script):!sim',
$value ) ) {
1356 wfDebug( __METHOD__ .
": Found svg setting attribute to '$value' in uploaded file.\n" );
1360 # use handler attribute with remote / data / script
1361 if ( $stripped ==
'handler' && preg_match(
'!(http|https|data|script):!sim',
$value ) ) {
1362 wfDebug( __METHOD__ .
": Found svg setting handler with remote/data/script '$attrib'='$value' in uploaded file.\n" );
1366 # use CSS styles to bring in remote code
1367 if ( $stripped ==
'style'
1370 wfDebug( __METHOD__ .
": Found svg setting a style with "
1371 .
"remote url '$attrib'='$value' in uploaded file.\n" );
1375 # Several attributes can include css, css character escaping isn't allowed
1376 $cssAttrs =
array(
'font',
'clip-path',
'fill',
'filter',
'marker',
1377 'marker-end',
'marker-mid',
'marker-start',
'mask',
'stroke' );
1378 if ( in_array( $stripped, $cssAttrs )
1379 && self::checkCssFragment(
$value )
1381 wfDebug( __METHOD__ .
": Found svg setting a style with "
1382 .
"remote url '$attrib'='$value' in uploaded file.\n" );
1386 # image filters can pull in url, which could be svg that executes scripts
1387 if ( $strippedElement ==
'image' && $stripped ==
'filter' && preg_match(
'!url\s*\(!sim',
$value ) ) {
1388 wfDebug( __METHOD__ .
": Found image filter with url: \"<$strippedElement $stripped='$value'...\" in uploaded file.\n" );
1406 # Forbid external stylesheets, for both reliability and to protect viewer's privacy
1407 if ( strpos(
$value,
'@import' ) !==
false ) {
1411 # We allow @font-face to embed fonts with data: urls, so we snip the string
1412 # 'url' out so this case won't match when we check for urls below
1413 $pattern =
'!(@font-face\s*{[^}]*src:)url(\("data:;base64,)!im';
1416 # Check for remote and executable CSS. Unlike in Sanitizer::checkCss, the CSS
1417 # properties filter and accelerator don't seem to be useful for xss in SVG files.
1418 # Expression and -o-link don't seem to work either, but filtering them here in case.
1419 # Additionally, we catch remote urls like url("http:..., url('http:..., url(http:...,
1420 # but not local ones such as url("#..., url('#..., url(#....
1421 if ( preg_match(
'!expression
1423 | -o-link-source\s*:
1424 | -o-replace\s*:!imx',
$value ) ) {
1428 if ( preg_match_all(
1429 "!(\s*(url|image|image-set)\s*\(\s*[\"']?\s*[^#]+.*?\))!sim",
1434 # TODO: redo this in one regex. Until then, url("#whatever") matches the first
1436 if ( !preg_match(
"!\s*(url|image|image-set)\s*\(\s*(#|'#|\"#)!im", $match ) ) {
1442 if ( preg_match(
'/[\000-\010\013\016-\037\177]/',
$value ) ) {
1456 $parts = explode(
':', strtolower( $element ) );
1457 $name = array_pop( $parts );
1458 $ns = implode(
':', $parts );
1468 $parts = explode(
':', strtolower(
$name ) );
1469 return array_pop( $parts );
1483 global $wgAntivirus, $wgAntivirusSetup, $wgAntivirusRequired,
$wgOut;
1486 if ( !$wgAntivirus ) {
1487 wfDebug( __METHOD__ .
": virus scanner disabled\n" );
1492 if ( !$wgAntivirusSetup[$wgAntivirus] ) {
1493 wfDebug( __METHOD__ .
": unknown virus scanner: $wgAntivirus\n" );
1494 $wgOut->wrapWikiMsg(
"<div class=\"error\">\n$1\n</div>",
1495 array(
'virus-badscanner', $wgAntivirus ) );
1497 return wfMessage(
'virus-unknownscanner' )->text() .
" $wgAntivirus";
1500 # look up scanner configuration
1501 $command = $wgAntivirusSetup[$wgAntivirus][
'command'];
1502 $exitCodeMap = $wgAntivirusSetup[$wgAntivirus][
'codemap'];
1503 $msgPattern = isset( $wgAntivirusSetup[$wgAntivirus][
'messagepattern'] ) ?
1504 $wgAntivirusSetup[$wgAntivirus][
'messagepattern'] :
null;
1506 if ( strpos(
$command,
"%f" ) ===
false ) {
1507 # simple pattern: append file to scan
1510 # complex pattern: replace "%f" with file to scan
1514 wfDebug( __METHOD__ .
": running virus scan: $command \n" );
1516 # execute virus scanner
1519 # NOTE: there's a 50 line workaround to make stderr redirection work on windows, too.
1520 # that does not seem to be worth the pain.
1521 # Ask me (Duesentrieb) about it if it's ever needed.
1524 # map exit code to AV_xxx constants.
1525 $mappedCode = $exitCode;
1526 if ( $exitCodeMap ) {
1527 if ( isset( $exitCodeMap[$exitCode] ) ) {
1528 $mappedCode = $exitCodeMap[$exitCode];
1529 } elseif ( isset( $exitCodeMap[
"*"] ) ) {
1530 $mappedCode = $exitCodeMap[
"*"];
1538 # scan failed (code was mapped to false by $exitCodeMap)
1539 wfDebug( __METHOD__ .
": failed to scan $file (code $exitCode).\n" );
1541 $output = $wgAntivirusRequired ?
wfMessage(
'virus-scanfailed',
array( $exitCode ) )->text() :
null;
1543 # scan failed because filetype is unknown (probably imune)
1544 wfDebug( __METHOD__ .
": unsupported file type $file (code $exitCode).\n" );
1548 wfDebug( __METHOD__ .
": file passed virus scan.\n" );
1555 } elseif ( $msgPattern ) {
1557 if ( preg_match( $msgPattern, $output, $groups ) ) {
1559 $output = $groups[1];
1564 wfDebug( __METHOD__ . ": FOUND VIRUS! scanner feedback: $output \n" );
1567 wfProfileOut( __METHOD__ );
1579 private function checkOverwrite( $user ) {
1580 // First check whether the local file can be overwritten
1581 $file = $this->getLocalFile();
1582 if ( $file->exists() ) {
1583 if ( !self::userCanReUpload( $user, $file ) ) {
1584 return array( 'fileexists-forbidden
', $file->getName() );
1590 /* Check shared conflicts: if the local file does not exist, but
1591 * wfFindFile finds a file, it exists in a shared repository.
1593 $file = wfFindFile( $this->getTitle() );
1594 if ( $file && !$user->isAllowed( 'reupload-shared
' ) ) {
1595 return array( 'fileexists-shared-forbidden
', $file->getName() );
1608 public static function userCanReUpload( User $user, $img ) {
1609 if ( $user->isAllowed( 'reupload
' ) ) {
1610 return true; // non-conditional
1612 if ( !$user->isAllowed( 'reupload-own
' ) ) {
1615 if ( is_string( $img ) ) {
1616 $img = wfLocalFile( $img );
1618 if ( !( $img instanceof LocalFile ) ) {
1622 return $user->getId() == $img->getUser( 'id' );
1636 public static function getExistsWarning( $file ) {
1637 if ( $file->exists() ) {
1638 return array( 'warning
' => 'exists
', 'file' => $file );
1641 if ( $file->getTitle()->getArticleID() ) {
1642 return array( 'warning
' => 'page-exists
', 'file' => $file );
1645 if ( $file->wasDeleted() && !$file->exists() ) {
1646 return array( 'warning
' => 'was-deleted
', 'file' => $file );
1649 if ( strpos( $file->getName(), '.
' ) == false ) {
1650 $partname = $file->getName();
1653 $n = strrpos( $file->getName(), '.
' );
1654 $extension = substr( $file->getName(), $n + 1 );
1655 $partname = substr( $file->getName(), 0, $n );
1657 $normalizedExtension = File::normalizeExtension( $extension );
1659 if ( $normalizedExtension != $extension ) {
1660 // We're not
using the normalized
form of the extension.
1668 if ( $file_lc->exists() ) {
1670 'warning' =>
'exists-normalized',
1672 'normalizedFile' => $file_lc
1679 "{$partname}.", 1 );
1680 if ( count( $similarFiles ) ) {
1682 'warning' =>
'exists-normalized',
1684 'normalizedFile' => $similarFiles[0],
1688 if ( self::isThumbName(
$file->getName() ) ) {
1689 # Check for filenames like 50px- or 180px-, these are mostly thumbnails
1692 if ( $file_thb->exists() ) {
1694 'warning' =>
'thumb',
1696 'thumbFile' => $file_thb
1701 'warning' =>
'thumb-name',
1703 'thumbFile' => $file_thb
1708 foreach ( self::getFilenamePrefixBlacklist()
as $prefix ) {
1709 if ( substr( $partname, 0, strlen( $prefix ) ) == $prefix ) {
1711 'warning' =>
'bad-prefix',
1727 $n = strrpos( $filename,
'.' );
1728 $partname =
$n ? substr( $filename, 0,
$n ) : $filename;
1730 substr( $partname, 3, 3 ) ==
'px-' ||
1731 substr( $partname, 2, 3 ) ==
'px-'
1733 preg_match(
"/[0-9]{2}/", substr( $partname, 0, 2 ) );
1742 $blacklist =
array();
1743 $message =
wfMessage(
'filename-prefix-blacklist' )->inContentLanguage();
1744 if ( !$message->isDisabled() ) {
1745 $lines = explode(
"\n", $message->plain() );
1757 $blacklist[] = trim(
$line );
1792 $code =
$error[
'status'];
1793 unset( $code[
'status'] );
1804 if ( is_array( $wgMaxUploadSize ) ) {
1805 if ( !is_null( $forType ) && isset( $wgMaxUploadSize[$forType] ) ) {
1806 return $wgMaxUploadSize[$forType];
1808 return $wgMaxUploadSize[
'*'];
1811 return intval( $wgMaxUploadSize );
1822 return isset( $_SESSION[self::SESSION_STATUS_KEY][$statusKey] )
1835 if (
$value ===
false ) {
1836 unset( $_SESSION[self::SESSION_STATUS_KEY][$statusKey] );
static & makeTitle( $ns, $title, $fragment='', $interwiki='')
Create a new Title from a namespace index and a DB key.
verifyTitlePermissions( $user)
Check whether the user can edit, upload and create the image.
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message. Please note the header message cannot receive/use parameters. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item. $reader:XMLReader object $logInfo:Array of information Return false to stop further processing of the tag 'ImportHandlePageXMLTag':When parsing a XML tag in a page. $reader:XMLReader object $pageInfo:Array of information Return false to stop further processing of the tag 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision. $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information Return false to stop further processing of the tag 'ImportHandleToplevelXMLTag':When parsing a top level XML tag. $reader:XMLReader object Return false to stop further processing of the tag 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload. $reader:XMLReader object $revisionInfo:Array of information Return false to stop further processing of the tag 'InfoAction':When building information to display on the action=info page. $context:IContextSource object & $pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect. $title:Title object for the current page $request:WebRequest $ignoreRedirect:boolean to skip redirect check $target:Title/string of redirect target $article:Article object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not. Return true without providing an interwiki to continue interwiki search. $prefix:interwiki prefix we are looking for. & $iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InternalParseBeforeSanitize':during Parser 's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings. Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments. & $parser:Parser object & $text:string containing partially parsed text & $stripState:Parser 's internal StripState object 'InternalParseBeforeLinks':during Parser 's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings. & $parser:Parser object & $text:string containing partially parsed text & $stripState:Parser 's internal StripState object 'InvalidateEmailComplete':Called after a user 's email has been invalidated successfully. $user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification. Callee may modify $url and $query, URL will be constructed as $url . $query & $url:URL to index.php & $query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) $article:article(object) being checked 'IsTrustedProxy':Override the result of wfIsTrustedProxy() $ip:IP being check $result:Change this value to override the result of wfIsTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from & $allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of User::isValidEmailAddr(), for instance to return false if the domain name doesn 't match your organization. $addr:The e-mail address entered by the user & $result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user & $result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we 're looking for a messages file for & $file:The messages file path, you can override this to change the location. 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces. Do not use this hook to add namespaces. Use CanonicalNamespaces for that. & $namespaces:Array of namespaces indexed by their numbers 'LanguageGetMagic':DEPRECATED, use $magicWords in a file listed in $wgExtensionMessagesFiles instead. Use this to define synonyms of magic words depending of the language $magicExtensions:associative array of magic words synonyms $lang:language code(string) 'LanguageGetSpecialPageAliases':DEPRECATED, use $specialPageAliases in a file listed in $wgExtensionMessagesFiles instead. Use to define aliases of special pages names depending of the language $specialPageAliases:associative array of magic words synonyms $lang:language code(string) 'LanguageGetTranslatedLanguageNames':Provide translated language names. & $names:array of language code=> language name $code language of the preferred translations 'LanguageLinks':Manipulate a page 's language links. This is called in various places to allow extensions to define the effective language links for a page. $title:The page 's Title. & $links:Associative array mapping language codes to prefixed links of the form "language:title". & $linkFlags:Associative array mapping prefixed links to arrays of flags. Currently unused, but planned to provide support for marking individual language links in the UI, e.g. for featured articles. 'LinkBegin':Used when generating internal and interwiki links in Linker::link(), before processing starts. Return false to skip default processing and return $ret. See documentation for Linker::link() for details on the expected meanings of parameters. $skin:the Skin object $target:the Title that the link is pointing to & $html:the contents that the< a > tag should have(raw HTML) $result
static newFromText( $text, $defaultNamespace=NS_MAIN)
Create a new Title from text, such as what one would find in a link.
stashSession()
alias for stashFileGetKey, for backwards compatibility
globals txt Globals are evil The original MediaWiki code relied on globals for processing context far too often MediaWiki development since then has been a story of slowly moving context out of global variables and into objects Storing processing context in object member variables allows those objects to be reused in a much more flexible way Consider the elegance of
static singleton()
Get a RepoGroup instance.
stashFile(User $user=null)
If the user does not supply all necessary information in the first upload form submission (either by ...
skin txt MediaWiki includes four core it has been set as the default in MediaWiki since the replacing Monobook it had been been the default skin since before being replaced by Vector largely rewritten in while keeping its appearance Several legacy skins were removed in the as the burden of supporting them became too heavy to bear Those in etc for skin dependent CSS etc for skin dependent JavaScript These can also be customised on a per user by etc This feature has led to a wide variety of user styles becoming that gallery is a good place to ending in php
usually copyright or history_copyright This message must be in HTML not wikitext $subpages will be ignored and the rest of subPageSubtitle() will run. 'SkinTemplateBuildNavUrlsNav_urlsAfterPermalink' whether MediaWiki currently thinks this is a CSS JS page Hooks may change this value to override the return value of Title::isCssOrJsPage(). 'TitleIsAlwaysKnown' whether MediaWiki currently thinks this page is known isMovable() always returns false. $title whether MediaWiki currently thinks this page is movable Hooks may change this value to override the return value of Title::isMovable(). 'TitleIsWikitextPage' whether MediaWiki currently thinks this is a wikitext page Hooks may change this value to override the return value of Title::isWikitextPage() 'TitleMove' use UploadVerification and UploadVerifyFile instead where the first element is the message key and the remaining elements are used as parameters to the message based on mime etc Preferred in most cases over UploadVerification object with all info about the upload string $mime
static isThumbName( $filename)
Helper function that checks whether the filename looks like a thumbnail.
getSourceType()
Returns the upload type.
checkWarnings()
Check for non fatal problems with the file.
const MIN_LENGTH_PARTNAME
verifyUpload()
Verify whether the upload is sane.
static getPropsFromPath( $path, $ext=true)
Get an associative array containing information about a file in the local filesystem.
static isEnabled()
Returns true if uploads are enabled.
static checkFileExtensionList( $ext, $list)
Perform case-insensitive match against a list of file extensions.
wfDebugLog( $logGroup, $text, $dest='all')
Send a line to a supplementary debug log file, if configured, or main debug log if not.
getTitle()
Returns the title of the file to be uploaded.
wfProfileIn( $functionname)
Begin profiling of a function.
wfSuppressWarnings( $end=false)
Reference-counted warning suppression.
cleanupTempFile()
If we've modified the upload file we need to manually remove it on exit to clean up.
initializeFromRequest(&$request)
Initialize from a WebRequest.
getLocalFile()
Return the local file and initializes if necessary.
if(!defined( 'MEDIAWIKI')) wfArrayDiff2( $a, $b)
Like array_diff( $a, $b ) except that it works with two-dimensional arrays.
static newGood( $value=null)
Factory function for good results.
wfShellExecWithStderr( $cmd, &$retval=null, $environ=array(), $limits=array())
Execute a shell command, returning both stdout and stderr.
static getFilenamePrefixBlacklist()
Get a list of blacklisted filename prefixes from [[MediaWiki:Filename-prefix-blacklist]].
static getPropertyNames( $filter=array())
Returns all possible parameters to iiprop.
stripXmlNamespace( $name)
validateName()
Verify that the name is valid and, if necessary, that we can overwrite.
static getInfo( $file, $prop, $result, $thumbParams=null, $opts=false)
Get result information for an image revision.
static isValidRequest( $request)
Check whether a request if valid for this handler.
static getSessionStatus( $statusKey)
Get the current status of a chunked upload (used for polling).
performUpload( $comment, $pageText, $watch, $user)
Really perform the upload.
verifyPermissions( $user)
Alias for verifyTitlePermissions.
checkSvgScriptCallback( $element, $attribs, $data=null)
We ve cleaned up the code here by removing clumps of infrequently used code and moving them off somewhere else It s much easier for someone working with this code to see what s _really_ going and make changes or fix bugs In we can take all the code that deals with the little used title reversing we can concentrate it all in an extension file
wfStripIllegalFilenameChars( $name)
Replace all invalid characters with - Additional characters can be defined in $wgIllegalFileChars (se...
wfRestoreWarnings()
Restore error level to previous value.
static verifyExtension( $mime, $extension)
Checks if the mime type of the uploaded file matches the file extension.
static isStoragePath( $path)
Check if a given path is a "mwstore://" path.
const WINDOWS_NONASCII_FILENAME
verifyMimeType( $mime)
Verify the mime type.
has been added to your &Future changes to this page and its associated Talk page will be listed there
verifyFile()
Verifies that it's ok to include the uploaded file.
const IGNORE_USER_RIGHTS
Constant to specify that user rights 'editmywatchlist' and 'viewmywatchlist' should not be checked.
static getSha1Base36FromPath( $path)
Get a SHA-1 hash of a file in the local filesystem, in base-36 lower case encoding,...
getVerificationErrorCode( $error)
getImageInfo( $result)
Gets image info about the file just uploaded.
wfProfileOut( $functionname='missing')
Stop profiling of a function.
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing after in associative array form externallinks including delete and has completed for all link tables default is conds Array Extra conditions for the No matching items in log is displayed if loglist is empty msgKey Array If you want a nice box with a set this to the key of the message First element is the message additional optional elements are parameters for the key that are processed with wfMessage() -> params() ->parseAsBlock() - offset Set to overwrite offset parameter in $wgRequest set to '' to unset offset - wrap String Wrap the message in html(usually something like "<
wfRunHooks( $event, array $args=array(), $deprecatedVersion=null)
Call hook functions defined in $wgHooks.
zipEntryCallback( $entry)
Callback for ZipDirectoryReader to detect Java class files.
the array() calling protocol came about after MediaWiki 1.4rc1.
List of Api Query prop modules.
static detectVirus( $file)
Generic wrapper function for a virus scanner program.
when a variable name is used in a it is silently declared as a new masking the global
null means default in associative array form
if(! $wgHtml5Version && $wgAllowRdfaAttributes) $wgFileExtensions
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
static checkFileExtension( $ext, $list)
Perform case-insensitive match against a list of file extensions.
wfDebug( $text, $dest='all')
Sends a line to the debug log if enabled or, optionally, to a comment in output.
static detectScript( $file, $mime, $extension)
Heuristic for detecting files that could contain JavaScript instructions or things that may look like...
static makeTitleSafe( $ns, $title, $fragment='', $interwiki='')
Create a new Title from a namespace index and a DB key.
presenting them properly to the user as errors is done by the caller $title
Allows to change the fields on the form that will be generated $name
if(!defined( 'MEDIAWIKI')) if(!isset( $wgVersion)) $matches
static splitXmlNamespace( $element)
Divide the element name passed by the xml parser to the callback into URI and prifix.
isEmptyFile()
Return true if the file is empty.
Class representing a row of the 'filearchive' table.
static isAllowed( $user)
Returns true if the user can use this upload module or else a string identifying the missing permissi...
wfIsWindows()
Check if the operating system is Windows.
wfEscapeShellArg()
Windows-compatible version of escapeshellarg() Windows doesn't recognise single-quotes in the shell,...
checkOverwrite( $user)
Check if there's an overwrite conflict and, if so, if restrictions forbid this user from performing t...
const UPLOAD_VERIFICATION_ERROR
static getExistsWarning( $file)
Helper function that does various existence checks for a file.
verifyPartialFile()
A verification routine suitable for partial files.
please add to it if you re going to add events to the MediaWiki code where normally authentication against an external auth plugin would be creating a account $user
wfIniGetBool( $setting)
Safety wrapper around ini_get() for boolean settings.
const OVERWRITE_EXISTING_FILE
return false to override stock group addition can be modified try getUserPermissionsErrors userCan checks are continued by internal code can override on output return false to not delete it return false to override the default password checks & $hash
static getMaxUploadSize( $forType=null)
if(PHP_SAPI !='cli') $file
static createFromRequest(&$request, $type=null)
Create a form of UploadBase depending on wpSourceType and initializes it.
static setSessionStatus( $statusKey, $value)
Set the current status of a chunked upload (used for polling).
convertVerifyErrorToStatus( $error)
initializePathInfo( $name, $tempPath, $fileSize, $removeTempFile=false)
Initialize the path information.
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as $wgLang
static normalizeCss( $value)
Normalize CSS into a format we can easily search for hostile input.
static splitExtensions( $filename)
Split a file into a base name and all dot-delimited 'extensions' on the end.
getTempFileSha1Base36()
Get the base 36 SHA1 of the file.
Prior to maintenance scripts were a hodgepodge of code that had no cohesion or formal method of action Beginning in
static capitalize( $text, $ns=NS_MAIN)
Capitalize a text string for a title if it belongs to a namespace that capitalizes.
you don t have to do a grep find to see where the $wgReverseTitle variable is used
detectScriptInSvg( $filename)
static checkSvgPICallback( $target, $data)
Callback to filter SVG Processing Instructions.
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
fetchFile()
Fetch the file.
stashFileGetKey()
Stash a file in a temporary directory, returning a key which can be used to find the file again.
static decodeCharReferences( $text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string.
usually copyright or history_copyright This message must be in HTML not wikitext $subpages will be ignored and the rest of subPageSubtitle() will run. 'SkinTemplateBuildNavUrlsNav_urlsAfterPermalink' whether MediaWiki currently thinks this is a CSS JS page Hooks may change this value to override the return value of Title::isCssOrJsPage(). 'TitleIsAlwaysKnown' whether MediaWiki currently thinks this page is known isMovable() always returns false. $title whether MediaWiki currently thinks this page is movable Hooks may change this value to override the return value of Title::isMovable(). 'TitleIsWikitextPage' whether MediaWiki currently thinks this is a wikitext page Hooks may change this value to override the return value of Title::isWikitextPage() 'TitleMove' use UploadVerification and UploadVerifyFile instead where the first element is the message key and the remaining elements are used as parameters to the message based on mime etc Preferred in most cases over UploadVerification object with all info about the upload string as detected by MediaWiki Handlers will typically only apply for specific mime types object & $error
static doWatch(Title $title, User $user, $checkRights=WatchedItem::CHECK_USER_RIGHTS)
Watch a page.
wfIsHHVM()
Check if we are running under HHVM.
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
The User object encapsulates all of the user-specific settings (user_id, name, rights,...
wfLocalFile( $title)
Get an object referring to a locally registered file.
static read( $fileName, $callback, $options=array())
Read a ZIP file and call a function for each file discovered in it.
getFileSize()
Return the file size.
static newFatal( $message)
Factory function for fatal errors.
do that in ParserLimitReportFormat instead use this to modify the parameters of the image and a DIV can begin in one section and end in another Make sure your code can handle that case gracefully See the EditSectionClearerLink extension for an example zero but section is usually empty its values are the globals values my talk page
static checkXMLEncodingMissmatch( $file)
Check a whitelist of xml encodings that are known not to be interpreted differently by the server's x...
static checkCssFragment( $value)
Check a block of CSS or CSS fragment for anything that looks like it is bringing in remote code.