HttpFunctions.php

Go to the documentation of this file.

<?php
use MediaWiki\Logger\LoggerFactory;
 
class Http {
    static public $httpEngine = false;
 
    public static function request( $method, $url, $options = [], $caller = __METHOD__ ) {
        wfDebug( "HTTP: $method: $url\n" );
 
        $options['method'] = strtoupper( $method );
 
        if ( !isset( $options['timeout'] ) ) {
            $options['timeout'] = 'default';
        }
        if ( !isset( $options['connectTimeout'] ) ) {
            $options['connectTimeout'] = 'default';
        }
 
        $req = MWHttpRequest::factory( $url, $options, $caller );
        $status = $req->execute();
 
        if ( $status->isOK() ) {
            return $req->getContent();
        } else {
            $errors = $status->getErrorsByType( 'error' );
            $logger = LoggerFactory::getInstance( 'http' );
            $logger->warning( $status->getWikiText( false, false, 'en' ),
                [ 'error' => $errors, 'caller' => $caller, 'content' => $req->getContent() ] );
            return false;
        }
    }
 
    public static function get( $url, $options = [], $caller = __METHOD__ ) {
        $args = func_get_args();
        if ( isset( $args[1] ) && ( is_string( $args[1] ) || is_numeric( $args[1] ) ) ) {
            // Second was used to be the timeout
            // And third parameter used to be $options
            wfWarn( "Second parameter should not be a timeout.", 2 );
            $options = isset( $args[2] ) && is_array( $args[2] ) ?
                $args[2] : [];
            $options['timeout'] = $args[1];
            $caller = __METHOD__;
        }
        return Http::request( 'GET', $url, $options, $caller );
    }
 
    public static function post( $url, $options = [], $caller = __METHOD__ ) {
        return Http::request( 'POST', $url, $options, $caller );
    }
 
    public static function isLocalURL( $url ) {
        global $wgCommandLineMode, $wgLocalVirtualHosts;
 
        if ( $wgCommandLineMode ) {
            return false;
        }
 
        // Extract host part
        $matches = [];
        if ( preg_match( '!^http://([\w.-]+)[/:].*$!', $url, $matches ) ) {
            $host = $matches[1];
            // Split up dotwise
            $domainParts = explode( '.', $host );
            // Check if this domain or any superdomain is listed as a local virtual host
            $domainParts = array_reverse( $domainParts );
 
            $domain = '';
            $countParts = count( $domainParts );
            for ( $i = 0; $i < $countParts; $i++ ) {
                $domainPart = $domainParts[$i];
                if ( $i == 0 ) {
                    $domain = $domainPart;
                } else {
                    $domain = $domainPart . '.' . $domain;
                }
 
                if ( in_array( $domain, $wgLocalVirtualHosts ) ) {
                    return true;
                }
            }
        }
 
        return false;
    }
 
    public static function userAgent() {
        global $wgVersion;
        return "MediaWiki/$wgVersion";
    }
 
    public static function isValidURI( $uri ) {
        return preg_match(
            '/^https?:\/\/[^\/\s]\S*$/D',
            $uri
        );
    }
 
    public static function getProxy() {
        global $wgHTTPProxy;
 
        if ( $wgHTTPProxy ) {
            return $wgHTTPProxy;
        }
 
        return "";
    }
}
 
class MWHttpRequest {
    const SUPPORTS_FILE_POSTS = false;
 
    protected $content;
    protected $timeout = 'default';
    protected $headersOnly = null;
    protected $postData = null;
    protected $proxy = null;
    protected $noProxy = false;
    protected $sslVerifyHost = true;
    protected $sslVerifyCert = true;
    protected $caInfo = null;
    protected $method = "GET";
    protected $reqHeaders = [];
    protected $url;
    protected $parsedUrl;
    protected $callback;
    protected $maxRedirects = 5;
    protected $followRedirects = false;
 
    protected $cookieJar;
 
    protected $headerList = [];
    protected $respVersion = "0.9";
    protected $respStatus = "200 Ok";
    protected $respHeaders = [];
 
    public $status;
 
    protected $profiler;
 
    protected $profileName;
 
    protected function __construct(
        $url, $options = [], $caller = __METHOD__, $profiler = null
    ) {
        global $wgHTTPTimeout, $wgHTTPConnectTimeout;
 
        $this->url = wfExpandUrl( $url, PROTO_HTTP );
        $this->parsedUrl = wfParseUrl( $this->url );
 
        if ( !$this->parsedUrl || !Http::isValidURI( $this->url ) ) {
            $this->status = Status::newFatal( 'http-invalid-url', $url );
        } else {
            $this->status = Status::newGood( 100 ); // continue
        }
 
        if ( isset( $options['timeout'] ) && $options['timeout'] != 'default' ) {
            $this->timeout = $options['timeout'];
        } else {
            $this->timeout = $wgHTTPTimeout;
        }
        if ( isset( $options['connectTimeout'] ) && $options['connectTimeout'] != 'default' ) {
            $this->connectTimeout = $options['connectTimeout'];
        } else {
            $this->connectTimeout = $wgHTTPConnectTimeout;
        }
        if ( isset( $options['userAgent'] ) ) {
            $this->setUserAgent( $options['userAgent'] );
        }
 
        $members = [ "postData", "proxy", "noProxy", "sslVerifyHost", "caInfo",
                "method", "followRedirects", "maxRedirects", "sslVerifyCert", "callback" ];
 
        foreach ( $members as $o ) {
            if ( isset( $options[$o] ) ) {
                // ensure that MWHttpRequest::method is always
                // uppercased. Bug 36137
                if ( $o == 'method' ) {
                    $options[$o] = strtoupper( $options[$o] );
                }
                $this->$o = $options[$o];
            }
        }
 
        if ( $this->noProxy ) {
            $this->proxy = ''; // noProxy takes precedence
        }
 
        // Profile based on what's calling us
        $this->profiler = $profiler;
        $this->profileName = $caller;
    }
 
    public static function canMakeRequests() {
        return function_exists( 'curl_init' ) || wfIniGetBool( 'allow_url_fopen' );
    }
 
    public static function factory( $url, $options = null, $caller = __METHOD__ ) {
        if ( !Http::$httpEngine ) {
            Http::$httpEngine = function_exists( 'curl_init' ) ? 'curl' : 'php';
        } elseif ( Http::$httpEngine == 'curl' && !function_exists( 'curl_init' ) ) {
            throw new MWException( __METHOD__ . ': curl (http://php.net/curl) is not installed, but' .
                ' Http::$httpEngine is set to "curl"' );
        }
 
        switch ( Http::$httpEngine ) {
            case 'curl':
                return new CurlHttpRequest( $url, $options, $caller, Profiler::instance() );
            case 'php':
                if ( !wfIniGetBool( 'allow_url_fopen' ) ) {
                    throw new MWException( __METHOD__ . ': allow_url_fopen ' .
                        'needs to be enabled for pure PHP http requests to ' .
                        'work. If possible, curl should be used instead. See ' .
                        'http://php.net/curl.'
                    );
                }
                return new PhpHttpRequest( $url, $options, $caller, Profiler::instance() );
            default:
                throw new MWException( __METHOD__ . ': The setting of Http::$httpEngine is not valid.' );
        }
    }
 
    public function getContent() {
        return $this->content;
    }
 
    public function setData( $args ) {
        $this->postData = $args;
    }
 
    public function proxySetup() {
        // If there is an explicit proxy set and proxies are not disabled, then use it
        if ( $this->proxy && !$this->noProxy ) {
            return;
        }
 
        // Otherwise, fallback to $wgHTTPProxy if this is not a machine
        // local URL and proxies are not disabled
        if ( Http::isLocalURL( $this->url ) || $this->noProxy ) {
            $this->proxy = '';
        } else {
            $this->proxy = Http::getProxy();
        }
    }
 
    public function setUserAgent( $UA ) {
        $this->setHeader( 'User-Agent', $UA );
    }
 
    public function setHeader( $name, $value ) {
        // I feel like I should normalize the case here...
        $this->reqHeaders[$name] = $value;
    }
 
    public function getHeaderList() {
        $list = [];
 
        if ( $this->cookieJar ) {
            $this->reqHeaders['Cookie'] =
                $this->cookieJar->serializeToHttpRequest(
                    $this->parsedUrl['path'],
                    $this->parsedUrl['host']
                );
        }
 
        foreach ( $this->reqHeaders as $name => $value ) {
            $list[] = "$name: $value";
        }
 
        return $list;
    }
 
    public function setCallback( $callback ) {
        if ( !is_callable( $callback ) ) {
            throw new MWException( 'Invalid MwHttpRequest callback' );
        }
        $this->callback = $callback;
    }
 
    public function read( $fh, $content ) {
        $this->content .= $content;
        return strlen( $content );
    }
 
    public function execute() {
 
        $this->content = "";
 
        if ( strtoupper( $this->method ) == "HEAD" ) {
            $this->headersOnly = true;
        }
 
        $this->proxySetup(); // set up any proxy as needed
 
        if ( !$this->callback ) {
            $this->setCallback( [ $this, 'read' ] );
        }
 
        if ( !isset( $this->reqHeaders['User-Agent'] ) ) {
            $this->setUserAgent( Http::userAgent() );
        }
 
    }
 
    protected function parseHeader() {
 
        $lastname = "";
 
        foreach ( $this->headerList as $header ) {
            if ( preg_match( "#^HTTP/([0-9.]+) (.*)#", $header, $match ) ) {
                $this->respVersion = $match[1];
                $this->respStatus = $match[2];
            } elseif ( preg_match( "#^[ \t]#", $header ) ) {
                $last = count( $this->respHeaders[$lastname] ) - 1;
                $this->respHeaders[$lastname][$last] .= "\r\n$header";
            } elseif ( preg_match( "#^([^:]*):[\t ]*(.*)#", $header, $match ) ) {
                $this->respHeaders[strtolower( $match[1] )][] = $match[2];
                $lastname = strtolower( $match[1] );
            }
        }
 
        $this->parseCookies();
 
    }
 
    protected function setStatus() {
        if ( !$this->respHeaders ) {
            $this->parseHeader();
        }
 
        if ( (int)$this->respStatus > 399 ) {
            list( $code, $message ) = explode( " ", $this->respStatus, 2 );
            $this->status->fatal( "http-bad-status", $code, $message );
        }
    }
 
    public function getStatus() {
        if ( !$this->respHeaders ) {
            $this->parseHeader();
        }
 
        return (int)$this->respStatus;
    }
 
    public function isRedirect() {
        if ( !$this->respHeaders ) {
            $this->parseHeader();
        }
 
        $status = (int)$this->respStatus;
 
        if ( $status >= 300 && $status <= 303 ) {
            return true;
        }
 
        return false;
    }
 
    public function getResponseHeaders() {
        if ( !$this->respHeaders ) {
            $this->parseHeader();
        }
 
        return $this->respHeaders;
    }
 
    public function getResponseHeader( $header ) {
        if ( !$this->respHeaders ) {
            $this->parseHeader();
        }
 
        if ( isset( $this->respHeaders[strtolower( $header )] ) ) {
            $v = $this->respHeaders[strtolower( $header )];
            return $v[count( $v ) - 1];
        }
 
        return null;
    }
 
    public function setCookieJar( $jar ) {
        $this->cookieJar = $jar;
    }
 
    public function getCookieJar() {
        if ( !$this->respHeaders ) {
            $this->parseHeader();
        }
 
        return $this->cookieJar;
    }
 
    public function setCookie( $name, $value = null, $attr = null ) {
        if ( !$this->cookieJar ) {
            $this->cookieJar = new CookieJar;
        }
 
        $this->cookieJar->setCookie( $name, $value, $attr );
    }
 
    protected function parseCookies() {
 
        if ( !$this->cookieJar ) {
            $this->cookieJar = new CookieJar;
        }
 
        if ( isset( $this->respHeaders['set-cookie'] ) ) {
            $url = parse_url( $this->getFinalUrl() );
            foreach ( $this->respHeaders['set-cookie'] as $cookie ) {
                $this->cookieJar->parseCookieResponseHeader( $cookie, $url['host'] );
            }
        }
 
    }
 
    public function getFinalUrl() {
        $headers = $this->getResponseHeaders();
 
        // return full url (fix for incorrect but handled relative location)
        if ( isset( $headers['location'] ) ) {
            $locations = $headers['location'];
            $domain = '';
            $foundRelativeURI = false;
            $countLocations = count( $locations );
 
            for ( $i = $countLocations - 1; $i >= 0; $i-- ) {
                $url = parse_url( $locations[$i] );
 
                if ( isset( $url['host'] ) ) {
                    $domain = $url['scheme'] . '://' . $url['host'];
                    break; // found correct URI (with host)
                } else {
                    $foundRelativeURI = true;
                }
            }
 
            if ( $foundRelativeURI ) {
                if ( $domain ) {
                    return $domain . $locations[$countLocations - 1];
                } else {
                    $url = parse_url( $this->url );
                    if ( isset( $url['host'] ) ) {
                        return $url['scheme'] . '://' . $url['host'] .
                            $locations[$countLocations - 1];
                    }
                }
            } else {
                return $locations[$countLocations - 1];
            }
        }
 
        return $this->url;
    }
 
    public function canFollowRedirects() {
        return true;
    }
}
 
class CurlHttpRequest extends MWHttpRequest {
    const SUPPORTS_FILE_POSTS = true;
 
    protected $curlOptions = [];
    protected $headerText = "";
 
    protected function readHeader( $fh, $content ) {
        $this->headerText .= $content;
        return strlen( $content );
    }
 
    public function execute() {
 
        parent::execute();
 
        if ( !$this->status->isOK() ) {
            return $this->status;
        }
 
        $this->curlOptions[CURLOPT_PROXY] = $this->proxy;
        $this->curlOptions[CURLOPT_TIMEOUT] = $this->timeout;
 
        // Only supported in curl >= 7.16.2
        if ( defined( 'CURLOPT_CONNECTTIMEOUT_MS' ) ) {
            $this->curlOptions[CURLOPT_CONNECTTIMEOUT_MS] = $this->connectTimeout * 1000;
        }
 
        $this->curlOptions[CURLOPT_HTTP_VERSION] = CURL_HTTP_VERSION_1_0;
        $this->curlOptions[CURLOPT_WRITEFUNCTION] = $this->callback;
        $this->curlOptions[CURLOPT_HEADERFUNCTION] = [ $this, "readHeader" ];
        $this->curlOptions[CURLOPT_MAXREDIRS] = $this->maxRedirects;
        $this->curlOptions[CURLOPT_ENCODING] = ""; # Enable compression
 
        $this->curlOptions[CURLOPT_USERAGENT] = $this->reqHeaders['User-Agent'];
 
        $this->curlOptions[CURLOPT_SSL_VERIFYHOST] = $this->sslVerifyHost ? 2 : 0;
        $this->curlOptions[CURLOPT_SSL_VERIFYPEER] = $this->sslVerifyCert;
 
        if ( $this->caInfo ) {
            $this->curlOptions[CURLOPT_CAINFO] = $this->caInfo;
        }
 
        if ( $this->headersOnly ) {
            $this->curlOptions[CURLOPT_NOBODY] = true;
            $this->curlOptions[CURLOPT_HEADER] = true;
        } elseif ( $this->method == 'POST' ) {
            $this->curlOptions[CURLOPT_POST] = true;
            $postData = $this->postData;
            // Don't interpret POST parameters starting with '@' as file uploads, because this
            // makes it impossible to POST plain values starting with '@' (and causes security
            // issues potentially exposing the contents of local files).
            // The PHP manual says this option was introduced in PHP 5.5 defaults to true in PHP 5.6,
            // but we support lower versions, and the option doesn't exist in HHVM 5.6.99.
            if ( defined( 'CURLOPT_SAFE_UPLOAD' ) ) {
                $this->curlOptions[CURLOPT_SAFE_UPLOAD] = true;
            } elseif ( is_array( $postData ) ) {
                // In PHP 5.2 and later, '@' is interpreted as a file upload if POSTFIELDS
                // is an array, but not if it's a string. So convert $req['body'] to a string
                // for safety.
                $postData = wfArrayToCgi( $postData );
            }
            $this->curlOptions[CURLOPT_POSTFIELDS] = $postData;
 
            // Suppress 'Expect: 100-continue' header, as some servers
            // will reject it with a 417 and Curl won't auto retry
            // with HTTP 1.0 fallback
            $this->reqHeaders['Expect'] = '';
        } else {
            $this->curlOptions[CURLOPT_CUSTOMREQUEST] = $this->method;
        }
 
        $this->curlOptions[CURLOPT_HTTPHEADER] = $this->getHeaderList();
 
        $curlHandle = curl_init( $this->url );
 
        if ( !curl_setopt_array( $curlHandle, $this->curlOptions ) ) {
            throw new MWException( "Error setting curl options." );
        }
 
        if ( $this->followRedirects && $this->canFollowRedirects() ) {
            MediaWiki\suppressWarnings();
            if ( !curl_setopt( $curlHandle, CURLOPT_FOLLOWLOCATION, true ) ) {
                wfDebug( __METHOD__ . ": Couldn't set CURLOPT_FOLLOWLOCATION. " .
                    "Probably open_basedir is set.\n" );
                // Continue the processing. If it were in curl_setopt_array,
                // processing would have halted on its entry
            }
            MediaWiki\restoreWarnings();
        }
 
        if ( $this->profiler ) {
            $profileSection = $this->profiler->scopedProfileIn(
                __METHOD__ . '-' . $this->profileName
            );
        }
 
        $curlRes = curl_exec( $curlHandle );
        if ( curl_errno( $curlHandle ) == CURLE_OPERATION_TIMEOUTED ) {
            $this->status->fatal( 'http-timed-out', $this->url );
        } elseif ( $curlRes === false ) {
            $this->status->fatal( 'http-curl-error', curl_error( $curlHandle ) );
        } else {
            $this->headerList = explode( "\r\n", $this->headerText );
        }
 
        curl_close( $curlHandle );
 
        if ( $this->profiler ) {
            $this->profiler->scopedProfileOut( $profileSection );
        }
 
        $this->parseHeader();
        $this->setStatus();
 
        return $this->status;
    }
 
    public function canFollowRedirects() {
        $curlVersionInfo = curl_version();
        if ( $curlVersionInfo['version_number'] < 0x071304 ) {
            wfDebug( "Cannot follow redirects with libcurl < 7.19.4 due to CVE-2009-0037\n" );
            return false;
        }
 
        if ( version_compare( PHP_VERSION, '5.6.0', '<' ) ) {
            if ( strval( ini_get( 'open_basedir' ) ) !== '' ) {
                wfDebug( "Cannot follow redirects when open_basedir is set\n" );
                return false;
            }
        }
 
        return true;
    }
}
 
class PhpHttpRequest extends MWHttpRequest {
 
    private $fopenErrors = [];
 
    protected function urlToTcp( $url ) {
        $parsedUrl = parse_url( $url );
 
        return 'tcp://' . $parsedUrl['host'] . ':' . $parsedUrl['port'];
    }
 
    protected function getCertOptions() {
        $certOptions = [];
        $certLocations = [];
        if ( $this->caInfo ) {
            $certLocations = [ 'manual' => $this->caInfo ];
        } elseif ( version_compare( PHP_VERSION, '5.6.0', '<' ) ) {
            // @codingStandardsIgnoreStart Generic.Files.LineLength
            // Default locations, based on
            // https://www.happyassassin.net/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/
            // PHP 5.5 and older doesn't have any defaults, so we try to guess ourselves.
            // PHP 5.6+ gets the CA location from OpenSSL as long as it is not set manually,
            // so we should leave capath/cafile empty there.
            // @codingStandardsIgnoreEnd
            $certLocations = array_filter( [
                getenv( 'SSL_CERT_DIR' ),
                getenv( 'SSL_CERT_PATH' ),
                '/etc/pki/tls/certs/ca-bundle.crt', # Fedora et al
                '/etc/ssl/certs',  # Debian et al
                '/etc/pki/tls/certs/ca-bundle.trust.crt',
                '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem',
                '/System/Library/OpenSSL', # OSX
            ] );
        }
 
        foreach ( $certLocations as $key => $cert ) {
            if ( is_dir( $cert ) ) {
                $certOptions['capath'] = $cert;
                break;
            } elseif ( is_file( $cert ) ) {
                $certOptions['cafile'] = $cert;
                break;
            } elseif ( $key === 'manual' ) {
                // fail more loudly if a cert path was manually configured and it is not valid
                throw new DomainException( "Invalid CA info passed: $cert" );
            }
        }
 
        return $certOptions;
    }
 
    public function errorHandler( $errno, $errstr ) {
        $n = count( $this->fopenErrors ) + 1;
        $this->fopenErrors += [ "errno$n" => $errno, "errstr$n" => $errstr ];
    }
 
    public function execute() {
 
        parent::execute();
 
        if ( is_array( $this->postData ) ) {
            $this->postData = wfArrayToCgi( $this->postData );
        }
 
        if ( $this->parsedUrl['scheme'] != 'http'
            && $this->parsedUrl['scheme'] != 'https' ) {
            $this->status->fatal( 'http-invalid-scheme', $this->parsedUrl['scheme'] );
        }
 
        $this->reqHeaders['Accept'] = "*/*";
        $this->reqHeaders['Connection'] = 'Close';
        if ( $this->method == 'POST' ) {
            // Required for HTTP 1.0 POSTs
            $this->reqHeaders['Content-Length'] = strlen( $this->postData );
            if ( !isset( $this->reqHeaders['Content-Type'] ) ) {
                $this->reqHeaders['Content-Type'] = "application/x-www-form-urlencoded";
            }
        }
 
        // Set up PHP stream context
        $options = [
            'http' => [
                'method' => $this->method,
                'header' => implode( "\r\n", $this->getHeaderList() ),
                'protocol_version' => '1.1',
                'max_redirects' => $this->followRedirects ? $this->maxRedirects : 0,
                'ignore_errors' => true,
                'timeout' => $this->timeout,
                // Curl options in case curlwrappers are installed
                'curl_verify_ssl_host' => $this->sslVerifyHost ? 2 : 0,
                'curl_verify_ssl_peer' => $this->sslVerifyCert,
            ],
            'ssl' => [
                'verify_peer' => $this->sslVerifyCert,
                'SNI_enabled' => true,
                'ciphers' => 'HIGH:!SSLv2:!SSLv3:-ADH:-kDH:-kECDH:-DSS',
                'disable_compression' => true,
            ],
        ];
 
        if ( $this->proxy ) {
            $options['http']['proxy'] = $this->urlToTcp( $this->proxy );
            $options['http']['request_fulluri'] = true;
        }
 
        if ( $this->postData ) {
            $options['http']['content'] = $this->postData;
        }
 
        if ( $this->sslVerifyHost ) {
            // PHP 5.6.0 deprecates CN_match, in favour of peer_name which
            // actually checks SubjectAltName properly.
            if ( version_compare( PHP_VERSION, '5.6.0', '>=' ) ) {
                $options['ssl']['peer_name'] = $this->parsedUrl['host'];
            } else {
                $options['ssl']['CN_match'] = $this->parsedUrl['host'];
            }
        }
 
        $options['ssl'] += $this->getCertOptions();
 
        $context = stream_context_create( $options );
 
        $this->headerList = [];
        $reqCount = 0;
        $url = $this->url;
 
        $result = [];
 
        if ( $this->profiler ) {
            $profileSection = $this->profiler->scopedProfileIn(
                __METHOD__ . '-' . $this->profileName
            );
        }
        do {
            $reqCount++;
            $this->fopenErrors = [];
            set_error_handler( [ $this, 'errorHandler' ] );
            $fh = fopen( $url, "r", false, $context );
            restore_error_handler();
 
            if ( !$fh ) {
                // HACK for instant commons.
                // If we are contacting (commons|upload).wikimedia.org
                // try again with CN_match for en.wikipedia.org
                // as php does not handle SubjectAltName properly
                // prior to "peer_name" option in php 5.6
                if ( isset( $options['ssl']['CN_match'] )
                    && ( $options['ssl']['CN_match'] === 'commons.wikimedia.org'
                        || $options['ssl']['CN_match'] === 'upload.wikimedia.org' )
                ) {
                    $options['ssl']['CN_match'] = 'en.wikipedia.org';
                    $context = stream_context_create( $options );
                    continue;
                }
                break;
            }
 
            $result = stream_get_meta_data( $fh );
            $this->headerList = $result['wrapper_data'];
            $this->parseHeader();
 
            if ( !$this->followRedirects ) {
                break;
            }
 
            # Handle manual redirection
            if ( !$this->isRedirect() || $reqCount > $this->maxRedirects ) {
                break;
            }
            # Check security of URL
            $url = $this->getResponseHeader( "Location" );
 
            if ( !Http::isValidURI( $url ) ) {
                wfDebug( __METHOD__ . ": insecure redirection\n" );
                break;
            }
        } while ( true );
        if ( $this->profiler ) {
            $this->profiler->scopedProfileOut( $profileSection );
        }
 
        $this->setStatus();
 
        if ( $fh === false ) {
            if ( $this->fopenErrors ) {
                LoggerFactory::getInstance( 'http' )->warning( __CLASS__
                    . ': error opening connection: {errstr1}', $this->fopenErrors );
            }
            $this->status->fatal( 'http-request-error' );
            return $this->status;
        }
 
        if ( $result['timed_out'] ) {
            $this->status->fatal( 'http-timed-out', $this->url );
            return $this->status;
        }
 
        // If everything went OK, or we received some error code
        // get the response body content.
        if ( $this->status->isOK() || (int)$this->respStatus >= 300 ) {
            while ( !feof( $fh ) ) {
                $buf = fread( $fh, 8192 );
 
                if ( $buf === false ) {
                    $this->status->fatal( 'http-read-error' );
                    break;
                }
 
                if ( strlen( $buf ) ) {
                    call_user_func( $this->callback, $fh, $buf );
                }
            }
        }
        fclose( $fh );
 
        return $this->status;
    }
}