MediaWiki  1.27.1
UploadStash.php
Go to the documentation of this file.
1 <?php
54 class UploadStash {
55  // Format of the key for files -- has to be suitable as a filename itself (e.g. ab12cd34ef.jpg)
56  const KEY_FORMAT_REGEX = '/^[\w-\.]+\.\w*$/';
57  const MAX_US_PROPS_SIZE = 65535;
58 
65  public $repo;
66 
67  // array of initialized repo objects
68  protected $files = [];
69 
70  // cache of the file metadata that's stored in the database
71  protected $fileMetadata = [];
72 
73  // fileprops cache
74  protected $fileProps = [];
75 
76  // current user
77  protected $user, $userId, $isLoggedIn;
78 
87  public function __construct( FileRepo $repo, $user = null ) {
88  // this might change based on wiki's configuration.
89  $this->repo = $repo;
90 
91  // if a user was passed, use it. otherwise, attempt to use the global.
92  // this keeps FileRepo from breaking when it creates an UploadStash object
93  if ( $user ) {
94  $this->user = $user;
95  } else {
97  $this->user = $wgUser;
98  }
99 
100  if ( is_object( $this->user ) ) {
101  $this->userId = $this->user->getId();
102  $this->isLoggedIn = $this->user->isLoggedIn();
103  }
104  }
105 
119  public function getFile( $key, $noAuth = false ) {
120  if ( !preg_match( self::KEY_FORMAT_REGEX, $key ) ) {
121  throw new UploadStashBadPathException( "key '$key' is not in a proper format" );
122  }
123 
124  if ( !$noAuth && !$this->isLoggedIn ) {
125  throw new UploadStashNotLoggedInException( __METHOD__ .
126  ' No user is logged in, files must belong to users' );
127  }
128 
129  if ( !isset( $this->fileMetadata[$key] ) ) {
130  if ( !$this->fetchFileMetadata( $key ) ) {
131  // If nothing was received, it's likely due to replication lag.
132  // Check the master to see if the record is there.
133  $this->fetchFileMetadata( $key, DB_MASTER );
134  }
135 
136  if ( !isset( $this->fileMetadata[$key] ) ) {
137  throw new UploadStashFileNotFoundException( "key '$key' not found in stash" );
138  }
139 
140  // create $this->files[$key]
141  $this->initFile( $key );
142 
143  // fetch fileprops
144  if ( strlen( $this->fileMetadata[$key]['us_props'] ) ) {
145  $this->fileProps[$key] = unserialize( $this->fileMetadata[$key]['us_props'] );
146  } else { // b/c for rows with no us_props
147  wfDebug( __METHOD__ . " fetched props for $key from file\n" );
148  $path = $this->fileMetadata[$key]['us_path'];
149  $this->fileProps[$key] = $this->repo->getFileProps( $path );
150  }
151  }
152 
153  if ( !$this->files[$key]->exists() ) {
154  wfDebug( __METHOD__ . " tried to get file at $key, but it doesn't exist\n" );
155  // @todo Is this not an UploadStashFileNotFoundException case?
156  throw new UploadStashBadPathException( "path doesn't exist" );
157  }
158 
159  if ( !$noAuth ) {
160  if ( $this->fileMetadata[$key]['us_user'] != $this->userId ) {
161  throw new UploadStashWrongOwnerException( "This file ($key) doesn't "
162  . "belong to the current user." );
163  }
164  }
165 
166  return $this->files[$key];
167  }
168 
175  public function getMetadata( $key ) {
176  $this->getFile( $key );
177 
178  return $this->fileMetadata[$key];
179  }
180 
187  public function getFileProps( $key ) {
188  $this->getFile( $key );
189 
190  return $this->fileProps[$key];
191  }
192 
205  public function stashFile( $path, $sourceType = null ) {
206  if ( !is_file( $path ) ) {
207  wfDebug( __METHOD__ . " tried to stash file at '$path', but it doesn't exist\n" );
208  throw new UploadStashBadPathException( "path doesn't exist" );
209  }
211  wfDebug( __METHOD__ . " stashing file at '$path'\n" );
212 
213  // we will be initializing from some tmpnam files that don't have extensions.
214  // most of MediaWiki assumes all uploaded files have good extensions. So, we fix this.
215  $extension = self::getExtensionForPath( $path );
216  if ( !preg_match( "/\\.\\Q$extension\\E$/", $path ) ) {
217  $pathWithGoodExtension = "$path.$extension";
218  } else {
219  $pathWithGoodExtension = $path;
220  }
221 
222  // If no key was supplied, make one. a mysql insertid would be totally
223  // reasonable here, except that for historical reasons, the key is this
224  // random thing instead. At least it's not guessable.
225  // Some things that when combined will make a suitably unique key.
226  // see: http://www.jwz.org/doc/mid.html
227  list( $usec, $sec ) = explode( ' ', microtime() );
228  $usec = substr( $usec, 2 );
229  $key = Wikimedia\base_convert( $sec . $usec, 10, 36 ) . '.' .
230  Wikimedia\base_convert( mt_rand(), 10, 36 ) . '.' .
231  $this->userId . '.' .
232  $extension;
233 
234  $this->fileProps[$key] = $fileProps;
235 
236  if ( !preg_match( self::KEY_FORMAT_REGEX, $key ) ) {
237  throw new UploadStashBadPathException( "key '$key' is not in a proper format" );
238  }
239 
240  wfDebug( __METHOD__ . " key for '$path': $key\n" );
241 
242  // if not already in a temporary area, put it there
243  $storeStatus = $this->repo->storeTemp( basename( $pathWithGoodExtension ), $path );
244 
245  if ( !$storeStatus->isOK() ) {
246  // It is a convention in MediaWiki to only return one error per API
247  // exception, even if multiple errors are available. We use reset()
248  // to pick the "first" thing that was wrong, preferring errors to
249  // warnings. This is a bit lame, as we may have more info in the
250  // $storeStatus and we're throwing it away, but to fix it means
251  // redesigning API errors significantly.
252  // $storeStatus->value just contains the virtual URL (if anything)
253  // which is probably useless to the caller.
254  $error = $storeStatus->getErrorsArray();
255  $error = reset( $error );
256  if ( !count( $error ) ) {
257  $error = $storeStatus->getWarningsArray();
258  $error = reset( $error );
259  if ( !count( $error ) ) {
260  $error = [ 'unknown', 'no error recorded' ];
261  }
262  }
263  // At this point, $error should contain the single "most important"
264  // error, plus any parameters.
265  $errorMsg = array_shift( $error );
266  throw new UploadStashFileException( "Error storing file in '$path': "
267  . wfMessage( $errorMsg, $error )->text() );
268  }
269  $stashPath = $storeStatus->value;
270 
271  // fetch the current user ID
272  if ( !$this->isLoggedIn ) {
273  throw new UploadStashNotLoggedInException( __METHOD__
274  . ' No user is logged in, files must belong to users' );
275  }
276 
277  // insert the file metadata into the db.
278  wfDebug( __METHOD__ . " inserting $stashPath under $key\n" );
279  $dbw = $this->repo->getMasterDB();
280 
281  $serializedFileProps = serialize( $fileProps );
282  if ( strlen( $serializedFileProps ) > self::MAX_US_PROPS_SIZE ) {
283  // Database is going to truncate this and make the field invalid.
284  // Prioritize important metadata over file handler metadata.
285  // File handler should be prepared to regenerate invalid metadata if needed.
286  $fileProps['metadata'] = false;
287  $serializedFileProps = serialize( $fileProps );
288  }
289 
290  $this->fileMetadata[$key] = [
291  'us_id' => $dbw->nextSequenceValue( 'uploadstash_us_id_seq' ),
292  'us_user' => $this->userId,
293  'us_key' => $key,
294  'us_orig_path' => $path,
295  'us_path' => $stashPath, // virtual URL
296  'us_props' => $dbw->encodeBlob( $serializedFileProps ),
297  'us_size' => $fileProps['size'],
298  'us_sha1' => $fileProps['sha1'],
299  'us_mime' => $fileProps['mime'],
300  'us_media_type' => $fileProps['media_type'],
301  'us_image_width' => $fileProps['width'],
302  'us_image_height' => $fileProps['height'],
303  'us_image_bits' => $fileProps['bits'],
304  'us_source_type' => $sourceType,
305  'us_timestamp' => $dbw->timestamp(),
306  'us_status' => 'finished'
307  ];
308 
309  $dbw->insert(
310  'uploadstash',
311  $this->fileMetadata[$key],
312  __METHOD__
313  );
314 
315  // store the insertid in the class variable so immediate retrieval
316  // (possibly laggy) isn't necesary.
317  $this->fileMetadata[$key]['us_id'] = $dbw->insertId();
318 
319  # create the UploadStashFile object for this file.
320  $this->initFile( $key );
321 
322  return $this->getFile( $key );
323  }
324 
332  public function clear() {
333  if ( !$this->isLoggedIn ) {
334  throw new UploadStashNotLoggedInException( __METHOD__
335  . ' No user is logged in, files must belong to users' );
336  }
337 
338  wfDebug( __METHOD__ . ' clearing all rows for user ' . $this->userId . "\n" );
339  $dbw = $this->repo->getMasterDB();
340  $dbw->delete(
341  'uploadstash',
342  [ 'us_user' => $this->userId ],
343  __METHOD__
344  );
345 
346  # destroy objects.
347  $this->files = [];
348  $this->fileMetadata = [];
349 
350  return true;
351  }
352 
361  public function removeFile( $key ) {
362  if ( !$this->isLoggedIn ) {
363  throw new UploadStashNotLoggedInException( __METHOD__
364  . ' No user is logged in, files must belong to users' );
365  }
366 
367  $dbw = $this->repo->getMasterDB();
368 
369  // this is a cheap query. it runs on the master so that this function
370  // still works when there's lag. It won't be called all that often.
371  $row = $dbw->selectRow(
372  'uploadstash',
373  'us_user',
374  [ 'us_key' => $key ],
375  __METHOD__
376  );
377 
378  if ( !$row ) {
379  throw new UploadStashNoSuchKeyException( "No such key ($key), cannot remove" );
380  }
381 
382  if ( $row->us_user != $this->userId ) {
383  throw new UploadStashWrongOwnerException( "Can't delete: "
384  . "the file ($key) doesn't belong to this user." );
385  }
386 
387  return $this->removeFileNoAuth( $key );
388  }
389 
396  public function removeFileNoAuth( $key ) {
397  wfDebug( __METHOD__ . " clearing row $key\n" );
398 
399  // Ensure we have the UploadStashFile loaded for this key
400  $this->getFile( $key, true );
401 
402  $dbw = $this->repo->getMasterDB();
403 
404  $dbw->delete(
405  'uploadstash',
406  [ 'us_key' => $key ],
407  __METHOD__
408  );
409 
413  $this->files[$key]->remove();
414 
415  unset( $this->files[$key] );
416  unset( $this->fileMetadata[$key] );
417 
418  return true;
419  }
420 
427  public function listFiles() {
428  if ( !$this->isLoggedIn ) {
429  throw new UploadStashNotLoggedInException( __METHOD__
430  . ' No user is logged in, files must belong to users' );
431  }
432 
433  $dbr = $this->repo->getSlaveDB();
434  $res = $dbr->select(
435  'uploadstash',
436  'us_key',
437  [ 'us_user' => $this->userId ],
438  __METHOD__
439  );
440 
441  if ( !is_object( $res ) || $res->numRows() == 0 ) {
442  // nothing to do.
443  return false;
444  }
445 
446  // finish the read before starting writes.
447  $keys = [];
448  foreach ( $res as $row ) {
449  array_push( $keys, $row->us_key );
450  }
451 
452  return $keys;
453  }
454 
465  public static function getExtensionForPath( $path ) {
467  // Does this have an extension?
468  $n = strrpos( $path, '.' );
469  $extension = null;
470  if ( $n !== false ) {
471  $extension = $n ? substr( $path, $n + 1 ) : '';
472  } else {
473  // If not, assume that it should be related to the MIME type of the original file.
474  $magic = MimeMagic::singleton();
475  $mimeType = $magic->guessMimeType( $path );
476  $extensions = explode( ' ', MimeMagic::singleton()->getExtensionsForType( $mimeType ) );
477  if ( count( $extensions ) ) {
478  $extension = $extensions[0];
479  }
480  }
481 
482  if ( is_null( $extension ) ) {
483  throw new UploadStashFileException( "extension is null" );
484  }
485 
486  $extension = File::normalizeExtension( $extension );
487  if ( in_array( $extension, $wgFileBlacklist ) ) {
488  // The file should already be checked for being evil.
489  // However, if somehow we got here, we definitely
490  // don't want to give it an extension of .php and
491  // put it in a web accesible directory.
492  return '';
493  }
494 
495  return $extension;
496  }
497 
505  protected function fetchFileMetadata( $key, $readFromDB = DB_SLAVE ) {
506  // populate $fileMetadata[$key]
507  $dbr = null;
508  if ( $readFromDB === DB_MASTER ) {
509  // sometimes reading from the master is necessary, if there's replication lag.
510  $dbr = $this->repo->getMasterDB();
511  } else {
512  $dbr = $this->repo->getSlaveDB();
513  }
514 
515  $row = $dbr->selectRow(
516  'uploadstash',
517  '*',
518  [ 'us_key' => $key ],
519  __METHOD__
520  );
521 
522  if ( !is_object( $row ) ) {
523  // key wasn't present in the database. this will happen sometimes.
524  return false;
525  }
526 
527  $this->fileMetadata[$key] = (array)$row;
528  $this->fileMetadata[$key]['us_props'] = $dbr->decodeBlob( $row->us_props );
529 
530  return true;
531  }
532 
540  protected function initFile( $key ) {
541  $file = new UploadStashFile( $this->repo, $this->fileMetadata[$key]['us_path'], $key );
542  if ( $file->getSize() === 0 ) {
543  throw new UploadStashZeroLengthFileException( "File is zero length" );
544  }
545  $this->files[$key] = $file;
546 
547  return true;
548  }
549 }
550 
552  private $fileKey;
553  private $urlName;
554  protected $url;
555 
568  public function __construct( $repo, $path, $key ) {
569  $this->fileKey = $key;
570 
571  // resolve mwrepo:// urls
572  if ( $repo->isVirtualUrl( $path ) ) {
574  } else {
575  // check if path appears to be sane, no parent traversals,
576  // and is in this repo's temp zone.
577  $repoTempPath = $repo->getZonePath( 'temp' );
578  if ( ( !$repo->validateFilename( $path ) ) ||
579  ( strpos( $path, $repoTempPath ) !== 0 )
580  ) {
581  wfDebug( "UploadStash: tried to construct an UploadStashFile "
582  . "from a file that should already exist at '$path', but path is not valid\n" );
583  throw new UploadStashBadPathException( 'path is not valid' );
584  }
585 
586  // check if path exists! and is a plain file.
587  if ( !$repo->fileExists( $path ) ) {
588  wfDebug( "UploadStash: tried to construct an UploadStashFile from "
589  . "a file that should already exist at '$path', but path is not found\n" );
590  throw new UploadStashFileNotFoundException( 'cannot find path, or not a plain file' );
591  }
592  }
593 
594  parent::__construct( false, $repo, $path, false );
595 
596  $this->name = basename( $this->path );
597  }
598 
607  public function getDescriptionUrl() {
608  return $this->getUrl();
609  }
610 
621  public function getThumbPath( $thumbName = false ) {
622  $path = dirname( $this->path );
623  if ( $thumbName !== false ) {
624  $path .= "/$thumbName";
625  }
626 
627  return $path;
628  }
629 
639  function thumbName( $params, $flags = 0 ) {
640  return $this->generateThumbName( $this->getUrlName(), $params );
641  }
642 
649  private function getSpecialUrl( $subPage ) {
650  return SpecialPage::getTitleFor( 'UploadStash', $subPage )->getLocalURL();
651  }
652 
663  public function getThumbUrl( $thumbName = false ) {
664  wfDebug( __METHOD__ . " getting for $thumbName \n" );
665 
666  return $this->getSpecialUrl( 'thumb/' . $this->getUrlName() . '/' . $thumbName );
667  }
668 
675  public function getUrlName() {
676  if ( !$this->urlName ) {
677  $this->urlName = $this->fileKey;
678  }
679 
680  return $this->urlName;
681  }
682 
689  public function getUrl() {
690  if ( !isset( $this->url ) ) {
691  $this->url = $this->getSpecialUrl( 'file/' . $this->getUrlName() );
692  }
693 
694  return $this->url;
695  }
696 
704  public function getFullUrl() {
705  return $this->getUrl();
706  }
707 
714  public function getFileKey() {
715  return $this->fileKey;
716  }
717 
722  public function remove() {
723  if ( !$this->repo->fileExists( $this->path ) ) {
724  // Maybe the file's already been removed? This could totally happen in UploadBase.
725  return true;
726  }
727 
728  return $this->repo->freeTemp( $this->path );
729  }
730 
731  public function exists() {
732  return $this->repo->fileExists( $this->path );
733  }
734 }
735 
737 }
738 
740 }
741 
743 }
744 
746 }
747 
749 }
750 
752 }
753 
755 }
756 
758 }
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
the array() calling protocol came about after MediaWiki 1.4rc1.
const KEY_FORMAT_REGEX
Definition: UploadStash.php:56
magic word the default is to use $key to get the and $key value or $key value text $key value html to format the value $key
Definition: hooks.txt:2321
clear()
Remove all files from the stash.
getSpecialUrl($subPage)
Helper function – given a 'subpage', return the local URL, e.g.
static getTitleFor($name, $subpage=false, $fragment= '')
Get a localised Title object for a specified special page name.
Definition: SpecialPage.php:75
static singleton()
Get an instance of this class.
Definition: MimeMagic.php:366
listFiles()
List all files in the stash.
static isVirtualUrl($url)
Determine if a string is an mwrepo:// URL.
Definition: FileRepo.php:254
it s the revision text itself In either if gzip is the revision text is gzipped $flags
Definition: hooks.txt:2548
resolveVirtualUrl($url)
Get the backend storage path corresponding to a virtual URL.
Definition: FileRepo.php:323
when a variable name is used in a it is silently declared as a new local masking the global
Definition: design.txt:93
static normalizeExtension($extension)
Normalize a file extension to the common form, making it lowercase and checking some synonyms...
Definition: File.php:223
wfDebug($text, $dest= 'all', array $context=[])
Sends a line to the debug log if enabled or, optionally, to a comment in output.
A file object referring to either a standalone local file, or a file in a local repository with no da...
getFileKey()
Getter for file key (the unique id by which this file's location & metadata is stored in the db) ...
initFile($key)
Helper function: Initialize the UploadStashFile for a given file.
getUrlName()
The basename for the URL, which we want to not be related to the filename.
__construct(FileRepo $repo, $user=null)
Represents a temporary filestore, with metadata in the database.
Definition: UploadStash.php:87
unserialize($serialized)
Definition: ApiMessage.php:102
fetchFileMetadata($key, $readFromDB=DB_SLAVE)
Helper function: do the actual database query to fetch file metadata.
$res
Definition: database.txt:21
const MAX_US_PROPS_SIZE
Definition: UploadStash.php:57
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such and we might be restricted by PHP settings such as safe mode or open_basedir We cannot assume that the software even has read access anywhere useful Many shared hosts run all users web applications under the same user
Wikitext formatted, in the key only.
Definition: distributors.txt:9
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing after in associative array form externallinks including delete and has completed for all link tables whether this was an auto creation default is conds Array Extra conditions for the No matching items in log is displayed if loglist is empty msgKey Array If you want a nice box with a set this to the key of the message First element is the message additional optional elements are parameters for the key that are processed with wfMessage() -> params() ->parseAsBlock()-offset Set to overwrite offset parameter in $wgRequest set to ''to unsetoffset-wrap String Wrap the message in html(usually something like"&lt
getUrl()
Return the URL of the file, if for some reason we wanted to download it We tend not to do this for th...
$params
getMetadata($key)
Getter for file metadata.
validateFilename($filename)
Determine if a relative path is valid, i.e.
Definition: FileRepo.php:1663
getThumbUrl($thumbName=false)
Get a URL to access the thumbnail This is required because the model of how files work requires that ...
const DB_SLAVE
Definition: Defines.php:46
fileExists($file)
Checks existence of a a file.
Definition: FileRepo.php:1359
design txt This is a brief overview of the new design More thorough and up to date information is available on the documentation wiki at etc Handles the details of getting and saving to the user table of the and dealing with sessions and cookies OutputPage Encapsulates the entire HTML page that will be sent in response to any server request It is used by calling its functions to add text
Definition: design.txt:12
FileRepo LocalRepo ForeignAPIRepo bool $repo
Some member variables can be lazy-initialised using __get().
Definition: File.php:95
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
getFileProps($key)
Getter for fileProps.
generateThumbName($name, $params)
Generate a thumbnail file name from a name and specified parameters.
Definition: File.php:952
getThumbPath($thumbName=false)
Get the path for the thumbnail (actually any transformation of this file) The actual argument is the ...
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
UploadStash is intended to accomplish a few things:
Definition: UploadStash.php:54
__construct($repo, $path, $key)
A LocalFile wrapper around a file that has been temporarily stashed, so we can do things like create ...
thumbName($params, $flags=0)
Return the file/url base name of a thumbnail with the specified parameters.
as see the revision history and available at free of to any person obtaining a copy of this software and associated documentation files(the"Software")
design txt This is a brief overview of the new design More thorough and up to date information is available on the documentation wiki at name
Definition: design.txt:12
Base class for file repositories.
Definition: FileRepo.php:37
getFullUrl()
Parent classes use this method, for no obvious reason, to return the path (relative to wiki root...
const DB_MASTER
Definition: Defines.php:47
static getExtensionForPath($path)
Find or guess extension – ensuring that our extension matches our MIME type.
serialize()
Definition: ApiMessage.php:94
removeFileNoAuth($key)
Remove a file (see removeFile), but doesn't check ownership first.
$extensions
removeFile($key)
Remove a particular file from the stash.
getDescriptionUrl()
A method needed by the file transforming and scaling routines in File.php We do not necessarily care ...
$wgFileBlacklist
Files with these extensions will never be allowed as uploads.
LocalRepo $repo
repository that this uses to store temp files public because we sometimes need to get a LocalFile wit...
Definition: UploadStash.php:65
getFile($key, $noAuth=false)
Get a file and its metadata from the stash.
getZonePath($zone)
Get the storage path corresponding to one of the zones.
Definition: FileRepo.php:363
static getPropsFromPath($path, $ext=true)
Get an associative array containing information about a file in the local filesystem.
Definition: FSFile.php:259
stashFile($path, $sourceType=null)
Stash a file in a temp directory and record that we did this in the database, along with other metada...
$wgUser
Definition: Setup.php:794