MediaWiki  master
UploadBase.php
Go to the documentation of this file.
1 <?php
24 
39 abstract class UploadBase {
41  protected $mTempPath;
43  protected $tempFileObj;
44 
46  protected $mTitle = false, $mTitleError = 0;
51 
52  protected static $safeXmlEncodings = [
53  'UTF-8',
54  'ISO-8859-1',
55  'ISO-8859-2',
56  'UTF-16',
57  'UTF-32',
58  'WINDOWS-1250',
59  'WINDOWS-1251',
60  'WINDOWS-1252',
61  'WINDOWS-1253',
62  'WINDOWS-1254',
63  'WINDOWS-1255',
64  'WINDOWS-1256',
65  'WINDOWS-1257',
66  'WINDOWS-1258',
67  ];
68 
69  const SUCCESS = 0;
70  const OK = 0;
71  const EMPTY_FILE = 3;
73  const ILLEGAL_FILENAME = 5;
74  const OVERWRITE_EXISTING_FILE = 7; # Not used anymore; handled by verifyTitlePermissions()
75  const FILETYPE_MISSING = 8;
76  const FILETYPE_BADTYPE = 9;
77  const VERIFICATION_ERROR = 10;
78  const HOOK_ABORTED = 11;
79  const FILE_TOO_LARGE = 12;
81  const FILENAME_TOO_LONG = 14;
82 
88  $code_to_status = [
89  self::EMPTY_FILE => 'empty-file',
90  self::FILE_TOO_LARGE => 'file-too-large',
91  self::FILETYPE_MISSING => 'filetype-missing',
92  self::FILETYPE_BADTYPE => 'filetype-banned',
93  self::MIN_LENGTH_PARTNAME => 'filename-tooshort',
94  self::ILLEGAL_FILENAME => 'illegal-filename',
95  self::OVERWRITE_EXISTING_FILE => 'overwrite',
96  self::VERIFICATION_ERROR => 'verification-error',
97  self::HOOK_ABORTED => 'hookaborted',
98  self::WINDOWS_NONASCII_FILENAME => 'windows-nonascii-filename',
99  self::FILENAME_TOO_LONG => 'filename-toolong',
100  ];
101  if ( isset( $code_to_status[$error] ) ) {
102  return $code_to_status[$error];
103  }
104 
105  return 'unknown-error';
106  }
107 
113  public static function isEnabled() {
115 
116  if ( !$wgEnableUploads ) {
117  return false;
118  }
119 
120  # Check php's file_uploads setting
121  return wfIsHHVM() || wfIniGetBool( 'file_uploads' );
122  }
123 
132  public static function isAllowed( $user ) {
133  foreach ( [ 'upload', 'edit' ] as $permission ) {
134  if ( !$user->isAllowed( $permission ) ) {
135  return $permission;
136  }
137  }
138 
139  return true;
140  }
141 
148  public static function isThrottled( $user ) {
149  return $user->pingLimiter( 'upload' );
150  }
151 
152  // Upload handlers. Should probably just be a global.
153  private static $uploadHandlers = [ 'Stash', 'File', 'Url' ];
154 
162  public static function createFromRequest( &$request, $type = null ) {
163  $type = $type ? $type : $request->getVal( 'wpSourceType', 'File' );
164 
165  if ( !$type ) {
166  return null;
167  }
168 
169  // Get the upload class
170  $type = ucfirst( $type );
171 
172  // Give hooks the chance to handle this request
173  $className = null;
174  Hooks::run( 'UploadCreateFromRequest', [ $type, &$className ] );
175  if ( is_null( $className ) ) {
176  $className = 'UploadFrom' . $type;
177  wfDebug( __METHOD__ . ": class name: $className\n" );
178  if ( !in_array( $type, self::$uploadHandlers ) ) {
179  return null;
180  }
181  }
182 
183  // Check whether this upload class is enabled
184  if ( !call_user_func( [ $className, 'isEnabled' ] ) ) {
185  return null;
186  }
187 
188  // Check whether the request is valid
189  if ( !call_user_func( [ $className, 'isValidRequest' ], $request ) ) {
190  return null;
191  }
192 
194  $handler = new $className;
195 
196  $handler->initializeFromRequest( $request );
197 
198  return $handler;
199  }
200 
206  public static function isValidRequest( $request ) {
207  return false;
208  }
209 
210  public function __construct() {
211  }
212 
219  public function getSourceType() {
220  return null;
221  }
222 
231  public function initializePathInfo( $name, $tempPath, $fileSize, $removeTempFile = false ) {
232  $this->mDesiredDestName = $name;
233  if ( FileBackend::isStoragePath( $tempPath ) ) {
234  throw new MWException( __METHOD__ . " given storage path `$tempPath`." );
235  }
236 
237  $this->setTempFile( $tempPath, $fileSize );
238  $this->mRemoveTempFile = $removeTempFile;
239  }
240 
246  abstract public function initializeFromRequest( &$request );
247 
252  protected function setTempFile( $tempPath, $fileSize = null ) {
253  $this->mTempPath = $tempPath;
254  $this->mFileSize = $fileSize ?: null;
255  if ( strlen( $this->mTempPath ) && file_exists( $this->mTempPath ) ) {
256  $this->tempFileObj = new TempFSFile( $this->mTempPath );
257  if ( !$fileSize ) {
258  $this->mFileSize = filesize( $this->mTempPath );
259  }
260  } else {
261  $this->tempFileObj = null;
262  }
263  }
264 
269  public function fetchFile() {
270  return Status::newGood();
271  }
272 
277  public function isEmptyFile() {
278  return empty( $this->mFileSize );
279  }
280 
285  public function getFileSize() {
286  return $this->mFileSize;
287  }
288 
293  public function getTempFileSha1Base36() {
294  return FSFile::getSha1Base36FromPath( $this->mTempPath );
295  }
296 
301  public function getRealPath( $srcPath ) {
302  $repo = RepoGroup::singleton()->getLocalRepo();
303  if ( $repo->isVirtualUrl( $srcPath ) ) {
307  $tmpFile = $repo->getLocalCopy( $srcPath );
308  if ( $tmpFile ) {
309  $tmpFile->bind( $this ); // keep alive with $this
310  }
311  $path = $tmpFile ? $tmpFile->getPath() : false;
312  } else {
313  $path = $srcPath;
314  }
315 
316  return $path;
317  }
318 
323  public function verifyUpload() {
327  if ( $this->isEmptyFile() ) {
328  return [ 'status' => self::EMPTY_FILE ];
329  }
330 
334  $maxSize = self::getMaxUploadSize( $this->getSourceType() );
335  if ( $this->mFileSize > $maxSize ) {
336  return [
337  'status' => self::FILE_TOO_LARGE,
338  'max' => $maxSize,
339  ];
340  }
341 
347  $verification = $this->verifyFile();
348  if ( $verification !== true ) {
349  return [
350  'status' => self::VERIFICATION_ERROR,
351  'details' => $verification
352  ];
353  }
354 
358  $result = $this->validateName();
359  if ( $result !== true ) {
360  return $result;
361  }
362 
363  $error = '';
364  if ( !Hooks::run( 'UploadVerification',
365  [ $this->mDestName, $this->mTempPath, &$error ], '1.28' )
366  ) {
367  return [ 'status' => self::HOOK_ABORTED, 'error' => $error ];
368  }
369 
370  return [ 'status' => self::OK ];
371  }
372 
379  public function validateName() {
380  $nt = $this->getTitle();
381  if ( is_null( $nt ) ) {
382  $result = [ 'status' => $this->mTitleError ];
383  if ( $this->mTitleError == self::ILLEGAL_FILENAME ) {
384  $result['filtered'] = $this->mFilteredName;
385  }
386  if ( $this->mTitleError == self::FILETYPE_BADTYPE ) {
387  $result['finalExt'] = $this->mFinalExtension;
388  if ( count( $this->mBlackListedExtensions ) ) {
389  $result['blacklistedExt'] = $this->mBlackListedExtensions;
390  }
391  }
392 
393  return $result;
394  }
395  $this->mDestName = $this->getLocalFile()->getName();
396 
397  return true;
398  }
399 
409  protected function verifyMimeType( $mime ) {
411  if ( $wgVerifyMimeType ) {
412  wfDebug( "mime: <$mime> extension: <{$this->mFinalExtension}>\n" );
414  if ( $this->checkFileExtension( $mime, $wgMimeTypeBlacklist ) ) {
415  return [ 'filetype-badmime', $mime ];
416  }
417 
418  # Check what Internet Explorer would detect
419  $fp = fopen( $this->mTempPath, 'rb' );
420  $chunk = fread( $fp, 256 );
421  fclose( $fp );
422 
423  $magic = MimeMagic::singleton();
424  $extMime = $magic->guessTypesForExtension( $this->mFinalExtension );
425  $ieTypes = $magic->getIEMimeTypes( $this->mTempPath, $chunk, $extMime );
426  foreach ( $ieTypes as $ieType ) {
427  if ( $this->checkFileExtension( $ieType, $wgMimeTypeBlacklist ) ) {
428  return [ 'filetype-bad-ie-mime', $ieType ];
429  }
430  }
431  }
432 
433  return true;
434  }
435 
441  protected function verifyFile() {
443 
444  $status = $this->verifyPartialFile();
445  if ( $status !== true ) {
446  return $status;
447  }
448 
449  $mwProps = new MWFileProps( MimeMagic::singleton() );
450  $this->mFileProps = $mwProps->getPropsFromPath( $this->mTempPath, $this->mFinalExtension );
451  $mime = $this->mFileProps['mime'];
452 
453  if ( $wgVerifyMimeType ) {
454  # XXX: Missing extension will be caught by validateName() via getTitle()
455  if ( $this->mFinalExtension != '' && !$this->verifyExtension( $mime, $this->mFinalExtension ) ) {
456  return [ 'filetype-mime-mismatch', $this->mFinalExtension, $mime ];
457  }
458  }
459 
460  # check for htmlish code and javascript
461  if ( !$wgDisableUploadScriptChecks ) {
462  if ( $this->mFinalExtension == 'svg' || $mime == 'image/svg+xml' ) {
463  $svgStatus = $this->detectScriptInSvg( $this->mTempPath, false );
464  if ( $svgStatus !== false ) {
465  return $svgStatus;
466  }
467  }
468  }
469 
471  if ( $handler ) {
472  $handlerStatus = $handler->verifyUpload( $this->mTempPath );
473  if ( !$handlerStatus->isOK() ) {
474  $errors = $handlerStatus->getErrorsArray();
475 
476  return reset( $errors );
477  }
478  }
479 
480  $error = true;
481  Hooks::run( 'UploadVerifyFile', [ $this, $mime, &$error ] );
482  if ( $error !== true ) {
483  if ( !is_array( $error ) ) {
484  $error = [ $error ];
485  }
486  return $error;
487  }
488 
489  wfDebug( __METHOD__ . ": all clear; passing.\n" );
490 
491  return true;
492  }
493 
502  protected function verifyPartialFile() {
504 
505  # getTitle() sets some internal parameters like $this->mFinalExtension
506  $this->getTitle();
507 
508  $mwProps = new MWFileProps( MimeMagic::singleton() );
509  $this->mFileProps = $mwProps->getPropsFromPath( $this->mTempPath, $this->mFinalExtension );
510 
511  # check MIME type, if desired
512  $mime = $this->mFileProps['file-mime'];
513  $status = $this->verifyMimeType( $mime );
514  if ( $status !== true ) {
515  return $status;
516  }
517 
518  # check for htmlish code and javascript
519  if ( !$wgDisableUploadScriptChecks ) {
520  if ( self::detectScript( $this->mTempPath, $mime, $this->mFinalExtension ) ) {
521  return [ 'uploadscripted' ];
522  }
523  if ( $this->mFinalExtension == 'svg' || $mime == 'image/svg+xml' ) {
524  $svgStatus = $this->detectScriptInSvg( $this->mTempPath, true );
525  if ( $svgStatus !== false ) {
526  return $svgStatus;
527  }
528  }
529  }
530 
531  # Check for Java applets, which if uploaded can bypass cross-site
532  # restrictions.
533  if ( !$wgAllowJavaUploads ) {
534  $this->mJavaDetected = false;
535  $zipStatus = ZipDirectoryReader::read( $this->mTempPath,
536  [ $this, 'zipEntryCallback' ] );
537  if ( !$zipStatus->isOK() ) {
538  $errors = $zipStatus->getErrorsArray();
539  $error = reset( $errors );
540  if ( $error[0] !== 'zip-wrong-format' ) {
541  return $error;
542  }
543  }
544  if ( $this->mJavaDetected ) {
545  return [ 'uploadjava' ];
546  }
547  }
548 
549  # Scan the uploaded file for viruses
550  $virus = $this->detectVirus( $this->mTempPath );
551  if ( $virus ) {
552  return [ 'uploadvirus', $virus ];
553  }
554 
555  return true;
556  }
557 
563  public function zipEntryCallback( $entry ) {
564  $names = [ $entry['name'] ];
565 
566  // If there is a null character, cut off the name at it, because JDK's
567  // ZIP_GetEntry() uses strcmp() if the name hashes match. If a file name
568  // were constructed which had ".class\0" followed by a string chosen to
569  // make the hash collide with the truncated name, that file could be
570  // returned in response to a request for the .class file.
571  $nullPos = strpos( $entry['name'], "\000" );
572  if ( $nullPos !== false ) {
573  $names[] = substr( $entry['name'], 0, $nullPos );
574  }
575 
576  // If there is a trailing slash in the file name, we have to strip it,
577  // because that's what ZIP_GetEntry() does.
578  if ( preg_grep( '!\.class/?$!', $names ) ) {
579  $this->mJavaDetected = true;
580  }
581  }
582 
592  public function verifyPermissions( $user ) {
593  return $this->verifyTitlePermissions( $user );
594  }
595 
607  public function verifyTitlePermissions( $user ) {
612  $nt = $this->getTitle();
613  if ( is_null( $nt ) ) {
614  return true;
615  }
616  $permErrors = $nt->getUserPermissionsErrors( 'edit', $user );
617  $permErrorsUpload = $nt->getUserPermissionsErrors( 'upload', $user );
618  if ( !$nt->exists() ) {
619  $permErrorsCreate = $nt->getUserPermissionsErrors( 'create', $user );
620  } else {
621  $permErrorsCreate = [];
622  }
623  if ( $permErrors || $permErrorsUpload || $permErrorsCreate ) {
624  $permErrors = array_merge( $permErrors, wfArrayDiff2( $permErrorsUpload, $permErrors ) );
625  $permErrors = array_merge( $permErrors, wfArrayDiff2( $permErrorsCreate, $permErrors ) );
626 
627  return $permErrors;
628  }
629 
630  $overwriteError = $this->checkOverwrite( $user );
631  if ( $overwriteError !== true ) {
632  return [ $overwriteError ];
633  }
634 
635  return true;
636  }
637 
645  public function checkWarnings() {
646  $warnings = [];
647 
648  $localFile = $this->getLocalFile();
649  $localFile->load( File::READ_LATEST );
650  $filename = $localFile->getName();
651  $hash = $this->getTempFileSha1Base36();
652 
653  $badFileName = $this->checkBadFileName( $filename, $this->mDesiredDestName );
654  if ( $badFileName !== null ) {
655  $warnings['badfilename'] = $badFileName;
656  }
657 
658  $unwantedFileExtensionDetails = $this->checkUnwantedFileExtensions( $this->mFinalExtension );
659  if ( $unwantedFileExtensionDetails !== null ) {
660  $warnings['filetype-unwanted-type'] = $unwantedFileExtensionDetails;
661  }
662 
663  $fileSizeWarnings = $this->checkFileSize( $this->mFileSize );
664  if ( $fileSizeWarnings ) {
665  $warnings = array_merge( $warnings, $fileSizeWarnings );
666  }
667 
668  $localFileExistsWarnings = $this->checkLocalFileExists( $localFile, $hash );
669  if ( $localFileExistsWarnings ) {
670  $warnings = array_merge( $warnings, $localFileExistsWarnings );
671  }
672 
673  if ( $this->checkLocalFileWasDeleted( $localFile ) ) {
674  $warnings['was-deleted'] = $filename;
675  }
676 
677  $dupes = $this->checkAgainstExistingDupes( $hash );
678  if ( $dupes ) {
679  $warnings['duplicate'] = $dupes;
680  }
681 
682  $archivedDupes = $this->checkAgainstArchiveDupes( $hash );
683  if ( $archivedDupes !== null ) {
684  $warnings['duplicate-archive'] = $archivedDupes;
685  }
686 
687  return $warnings;
688  }
689 
699  private function checkBadFileName( $filename, $desiredFileName ) {
700  $comparableName = str_replace( ' ', '_', $desiredFileName );
701  $comparableName = Title::capitalize( $comparableName, NS_FILE );
702 
703  if ( $desiredFileName != $filename && $comparableName != $filename ) {
704  return $filename;
705  }
706 
707  return null;
708  }
709 
718  private function checkUnwantedFileExtensions( $fileExtension ) {
720 
721  if ( $wgCheckFileExtensions ) {
722  $extensions = array_unique( $wgFileExtensions );
723  if ( !$this->checkFileExtension( $fileExtension, $extensions ) ) {
724  return [
725  $fileExtension,
726  $wgLang->commaList( $extensions ),
727  count( $extensions )
728  ];
729  }
730  }
731 
732  return null;
733  }
734 
740  private function checkFileSize( $fileSize ) {
742 
743  $warnings = [];
744 
745  if ( $wgUploadSizeWarning && ( $fileSize > $wgUploadSizeWarning ) ) {
746  $warnings['large-file'] = [ $wgUploadSizeWarning, $fileSize ];
747  }
748 
749  if ( $fileSize == 0 ) {
750  $warnings['empty-file'] = true;
751  }
752 
753  return $warnings;
754  }
755 
762  private function checkLocalFileExists( LocalFile $localFile, $hash ) {
763  $warnings = [];
764 
765  $exists = self::getExistsWarning( $localFile );
766  if ( $exists !== false ) {
767  $warnings['exists'] = $exists;
768 
769  // check if file is an exact duplicate of current file version
770  if ( $hash === $localFile->getSha1() ) {
771  $warnings['no-change'] = $localFile;
772  }
773 
774  // check if file is an exact duplicate of older versions of this file
775  $history = $localFile->getHistory();
776  foreach ( $history as $oldFile ) {
777  if ( $hash === $oldFile->getSha1() ) {
778  $warnings['duplicate-version'][] = $oldFile;
779  }
780  }
781  }
782 
783  return $warnings;
784  }
785 
786  private function checkLocalFileWasDeleted( LocalFile $localFile ) {
787  return $localFile->wasDeleted() && !$localFile->exists();
788  }
789 
795  private function checkAgainstExistingDupes( $hash ) {
796  $dupes = RepoGroup::singleton()->findBySha1( $hash );
797  $title = $this->getTitle();
798  // Remove all matches against self
799  foreach ( $dupes as $key => $dupe ) {
800  if ( $title->equals( $dupe->getTitle() ) ) {
801  unset( $dupes[$key] );
802  }
803  }
804 
805  return $dupes;
806  }
807 
814  private function checkAgainstArchiveDupes( $hash ) {
815  $archivedFile = new ArchivedFile( null, 0, '', $hash );
816  if ( $archivedFile->getID() > 0 ) {
817  if ( $archivedFile->userCan( File::DELETED_FILE ) ) {
818  return $archivedFile->getName();
819  } else {
820  return '';
821  }
822  }
823 
824  return null;
825  }
826 
840  public function performUpload( $comment, $pageText, $watch, $user, $tags = [] ) {
841  $this->getLocalFile()->load( File::READ_LATEST );
842  $props = $this->mFileProps;
843 
844  $error = null;
845  Hooks::run( 'UploadVerifyUpload', [ $this, $user, $props, $comment, $pageText, &$error ] );
846  if ( $error ) {
847  if ( !is_array( $error ) ) {
848  $error = [ $error ];
849  }
850  return call_user_func_array( 'Status::newFatal', $error );
851  }
852 
853  $status = $this->getLocalFile()->upload(
854  $this->mTempPath,
855  $comment,
856  $pageText,
858  $props,
859  false,
860  $user,
861  $tags
862  );
863 
864  if ( $status->isGood() ) {
865  if ( $watch ) {
867  $this->getLocalFile()->getTitle(),
868  $user,
870  );
871  }
872  // Avoid PHP 7.1 warning of passing $this by reference
873  $uploadBase = $this;
874  Hooks::run( 'UploadComplete', [ &$uploadBase ] );
875 
876  $this->postProcessUpload();
877  }
878 
879  return $status;
880  }
881 
887  public function postProcessUpload() {
888  }
889 
896  public function getTitle() {
897  if ( $this->mTitle !== false ) {
898  return $this->mTitle;
899  }
900  if ( !is_string( $this->mDesiredDestName ) ) {
901  $this->mTitleError = self::ILLEGAL_FILENAME;
902  $this->mTitle = null;
903 
904  return $this->mTitle;
905  }
906  /* Assume that if a user specified File:Something.jpg, this is an error
907  * and that the namespace prefix needs to be stripped of.
908  */
909  $title = Title::newFromText( $this->mDesiredDestName );
910  if ( $title && $title->getNamespace() == NS_FILE ) {
911  $this->mFilteredName = $title->getDBkey();
912  } else {
913  $this->mFilteredName = $this->mDesiredDestName;
914  }
915 
916  # oi_archive_name is max 255 bytes, which include a timestamp and an
917  # exclamation mark, so restrict file name to 240 bytes.
918  if ( strlen( $this->mFilteredName ) > 240 ) {
919  $this->mTitleError = self::FILENAME_TOO_LONG;
920  $this->mTitle = null;
921 
922  return $this->mTitle;
923  }
924 
930  $this->mFilteredName = wfStripIllegalFilenameChars( $this->mFilteredName );
931  /* Normalize to title form before we do any further processing */
932  $nt = Title::makeTitleSafe( NS_FILE, $this->mFilteredName );
933  if ( is_null( $nt ) ) {
934  $this->mTitleError = self::ILLEGAL_FILENAME;
935  $this->mTitle = null;
936 
937  return $this->mTitle;
938  }
939  $this->mFilteredName = $nt->getDBkey();
940 
945  list( $partname, $ext ) = $this->splitExtensions( $this->mFilteredName );
946 
947  if ( count( $ext ) ) {
948  $this->mFinalExtension = trim( $ext[count( $ext ) - 1] );
949  } else {
950  $this->mFinalExtension = '';
951 
952  # No extension, try guessing one
953  $magic = MimeMagic::singleton();
954  $mime = $magic->guessMimeType( $this->mTempPath );
955  if ( $mime !== 'unknown/unknown' ) {
956  # Get a space separated list of extensions
957  $extList = $magic->getExtensionsForType( $mime );
958  if ( $extList ) {
959  # Set the extension to the canonical extension
960  $this->mFinalExtension = strtok( $extList, ' ' );
961 
962  # Fix up the other variables
963  $this->mFilteredName .= ".{$this->mFinalExtension}";
964  $nt = Title::makeTitleSafe( NS_FILE, $this->mFilteredName );
966  }
967  }
968  }
969 
970  /* Don't allow users to override the blacklist (check file extension) */
973 
974  $blackListedExtensions = $this->checkFileExtensionList( $ext, $wgFileBlacklist );
975 
976  if ( $this->mFinalExtension == '' ) {
977  $this->mTitleError = self::FILETYPE_MISSING;
978  $this->mTitle = null;
979 
980  return $this->mTitle;
981  } elseif ( $blackListedExtensions ||
982  ( $wgCheckFileExtensions && $wgStrictFileExtensions &&
983  !$this->checkFileExtension( $this->mFinalExtension, $wgFileExtensions ) )
984  ) {
985  $this->mBlackListedExtensions = $blackListedExtensions;
986  $this->mTitleError = self::FILETYPE_BADTYPE;
987  $this->mTitle = null;
988 
989  return $this->mTitle;
990  }
991 
992  // Windows may be broken with special characters, see T3780
993  if ( !preg_match( '/^[\x0-\x7f]*$/', $nt->getText() )
994  && !RepoGroup::singleton()->getLocalRepo()->backendSupportsUnicodePaths()
995  ) {
996  $this->mTitleError = self::WINDOWS_NONASCII_FILENAME;
997  $this->mTitle = null;
998 
999  return $this->mTitle;
1000  }
1001 
1002  # If there was more than one "extension", reassemble the base
1003  # filename to prevent bogus complaints about length
1004  if ( count( $ext ) > 1 ) {
1005  $iterations = count( $ext ) - 1;
1006  for ( $i = 0; $i < $iterations; $i++ ) {
1007  $partname .= '.' . $ext[$i];
1008  }
1009  }
1010 
1011  if ( strlen( $partname ) < 1 ) {
1012  $this->mTitleError = self::MIN_LENGTH_PARTNAME;
1013  $this->mTitle = null;
1014 
1015  return $this->mTitle;
1016  }
1017 
1018  $this->mTitle = $nt;
1019 
1020  return $this->mTitle;
1021  }
1022 
1028  public function getLocalFile() {
1029  if ( is_null( $this->mLocalFile ) ) {
1030  $nt = $this->getTitle();
1031  $this->mLocalFile = is_null( $nt ) ? null : wfLocalFile( $nt );
1032  }
1033 
1034  return $this->mLocalFile;
1035  }
1036 
1040  public function getStashFile() {
1041  return $this->mStashFile;
1042  }
1043 
1055  public function tryStashFile( User $user, $isPartial = false ) {
1056  if ( !$isPartial ) {
1057  $error = $this->runUploadStashFileHook( $user );
1058  if ( $error ) {
1059  return call_user_func_array( 'Status::newFatal', $error );
1060  }
1061  }
1062  try {
1063  $file = $this->doStashFile( $user );
1064  return Status::newGood( $file );
1065  } catch ( UploadStashException $e ) {
1066  return Status::newFatal( 'uploadstash-exception', get_class( $e ), $e->getMessage() );
1067  }
1068  }
1069 
1074  protected function runUploadStashFileHook( User $user ) {
1075  $props = $this->mFileProps;
1076  $error = null;
1077  Hooks::run( 'UploadStashFile', [ $this, $user, $props, &$error ] );
1078  if ( $error ) {
1079  if ( !is_array( $error ) ) {
1080  $error = [ $error ];
1081  }
1082  }
1083  return $error;
1084  }
1085 
1105  public function stashFile( User $user = null ) {
1106  return $this->doStashFile( $user );
1107  }
1108 
1115  protected function doStashFile( User $user = null ) {
1116  $stash = RepoGroup::singleton()->getLocalRepo()->getUploadStash( $user );
1117  $file = $stash->stashFile( $this->mTempPath, $this->getSourceType() );
1118  $this->mStashFile = $file;
1119 
1120  return $file;
1121  }
1122 
1130  public function stashFileGetKey() {
1131  wfDeprecated( __METHOD__, '1.28' );
1132  return $this->doStashFile()->getFileKey();
1133  }
1134 
1141  public function stashSession() {
1142  wfDeprecated( __METHOD__, '1.28' );
1143  return $this->doStashFile()->getFileKey();
1144  }
1145 
1150  public function cleanupTempFile() {
1151  if ( $this->mRemoveTempFile && $this->tempFileObj ) {
1152  // Delete when all relevant TempFSFile handles go out of scope
1153  wfDebug( __METHOD__ . ": Marked temporary file '{$this->mTempPath}' for removal\n" );
1154  $this->tempFileObj->autocollect();
1155  }
1156  }
1157 
1158  public function getTempPath() {
1159  return $this->mTempPath;
1160  }
1161 
1171  public static function splitExtensions( $filename ) {
1172  $bits = explode( '.', $filename );
1173  $basename = array_shift( $bits );
1174 
1175  return [ $basename, $bits ];
1176  }
1177 
1186  public static function checkFileExtension( $ext, $list ) {
1187  return in_array( strtolower( $ext ), $list );
1188  }
1189 
1198  public static function checkFileExtensionList( $ext, $list ) {
1199  return array_intersect( array_map( 'strtolower', $ext ), $list );
1200  }
1201 
1209  public static function verifyExtension( $mime, $extension ) {
1210  $magic = MimeMagic::singleton();
1211 
1212  if ( !$mime || $mime == 'unknown' || $mime == 'unknown/unknown' ) {
1213  if ( !$magic->isRecognizableExtension( $extension ) ) {
1214  wfDebug( __METHOD__ . ": passing file with unknown detected mime type; " .
1215  "unrecognized extension '$extension', can't verify\n" );
1216 
1217  return true;
1218  } else {
1219  wfDebug( __METHOD__ . ": rejecting file with unknown detected mime type; " .
1220  "recognized extension '$extension', so probably invalid file\n" );
1221 
1222  return false;
1223  }
1224  }
1225 
1226  $match = $magic->isMatchingExtension( $extension, $mime );
1227 
1228  if ( $match === null ) {
1229  if ( $magic->getTypesForExtension( $extension ) !== null ) {
1230  wfDebug( __METHOD__ . ": No extension known for $mime, but we know a mime for $extension\n" );
1231 
1232  return false;
1233  } else {
1234  wfDebug( __METHOD__ . ": no file extension known for mime type $mime, passing file\n" );
1235 
1236  return true;
1237  }
1238  } elseif ( $match === true ) {
1239  wfDebug( __METHOD__ . ": mime type $mime matches extension $extension, passing file\n" );
1240 
1242  return true;
1243  } else {
1244  wfDebug( __METHOD__
1245  . ": mime type $mime mismatches file extension $extension, rejecting file\n" );
1246 
1247  return false;
1248  }
1249  }
1250 
1262  public static function detectScript( $file, $mime, $extension ) {
1264 
1265  # ugly hack: for text files, always look at the entire file.
1266  # For binary field, just check the first K.
1267 
1268  if ( strpos( $mime, 'text/' ) === 0 ) {
1269  $chunk = file_get_contents( $file );
1270  } else {
1271  $fp = fopen( $file, 'rb' );
1272  $chunk = fread( $fp, 1024 );
1273  fclose( $fp );
1274  }
1275 
1276  $chunk = strtolower( $chunk );
1277 
1278  if ( !$chunk ) {
1279  return false;
1280  }
1281 
1282  # decode from UTF-16 if needed (could be used for obfuscation).
1283  if ( substr( $chunk, 0, 2 ) == "\xfe\xff" ) {
1284  $enc = 'UTF-16BE';
1285  } elseif ( substr( $chunk, 0, 2 ) == "\xff\xfe" ) {
1286  $enc = 'UTF-16LE';
1287  } else {
1288  $enc = null;
1289  }
1290 
1291  if ( $enc ) {
1292  $chunk = iconv( $enc, "ASCII//IGNORE", $chunk );
1293  }
1294 
1295  $chunk = trim( $chunk );
1296 
1298  wfDebug( __METHOD__ . ": checking for embedded scripts and HTML stuff\n" );
1299 
1300  # check for HTML doctype
1301  if ( preg_match( "/<!DOCTYPE *X?HTML/i", $chunk ) ) {
1302  return true;
1303  }
1304 
1305  // Some browsers will interpret obscure xml encodings as UTF-8, while
1306  // PHP/expat will interpret the given encoding in the xml declaration (T49304)
1307  if ( $extension == 'svg' || strpos( $mime, 'image/svg' ) === 0 ) {
1308  if ( self::checkXMLEncodingMissmatch( $file ) ) {
1309  return true;
1310  }
1311  }
1312 
1328  $tags = [
1329  '<a href',
1330  '<body',
1331  '<head',
1332  '<html', # also in safari
1333  '<img',
1334  '<pre',
1335  '<script', # also in safari
1336  '<table'
1337  ];
1338 
1339  if ( !$wgAllowTitlesInSVG && $extension !== 'svg' && $mime !== 'image/svg' ) {
1340  $tags[] = '<title';
1341  }
1342 
1343  foreach ( $tags as $tag ) {
1344  if ( false !== strpos( $chunk, $tag ) ) {
1345  wfDebug( __METHOD__ . ": found something that may make it be mistaken for html: $tag\n" );
1346 
1347  return true;
1348  }
1349  }
1350 
1351  /*
1352  * look for JavaScript
1353  */
1354 
1355  # resolve entity-refs to look at attributes. may be harsh on big files... cache result?
1356  $chunk = Sanitizer::decodeCharReferences( $chunk );
1357 
1358  # look for script-types
1359  if ( preg_match( '!type\s*=\s*[\'"]?\s*(?:\w*/)?(?:ecma|java)!sim', $chunk ) ) {
1360  wfDebug( __METHOD__ . ": found script types\n" );
1361 
1362  return true;
1363  }
1364 
1365  # look for html-style script-urls
1366  if ( preg_match( '!(?:href|src|data)\s*=\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) ) {
1367  wfDebug( __METHOD__ . ": found html-style script urls\n" );
1368 
1369  return true;
1370  }
1371 
1372  # look for css-style script-urls
1373  if ( preg_match( '!url\s*\(\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) ) {
1374  wfDebug( __METHOD__ . ": found css-style script urls\n" );
1375 
1376  return true;
1377  }
1378 
1379  wfDebug( __METHOD__ . ": no scripts found\n" );
1380 
1381  return false;
1382  }
1383 
1391  public static function checkXMLEncodingMissmatch( $file ) {
1393  $contents = file_get_contents( $file, false, null, -1, $wgSVGMetadataCutoff );
1394  $encodingRegex = '!encoding[ \t\n\r]*=[ \t\n\r]*[\'"](.*?)[\'"]!si';
1395 
1396  if ( preg_match( "!<\?xml\b(.*?)\?>!si", $contents, $matches ) ) {
1397  if ( preg_match( $encodingRegex, $matches[1], $encMatch )
1398  && !in_array( strtoupper( $encMatch[1] ), self::$safeXmlEncodings )
1399  ) {
1400  wfDebug( __METHOD__ . ": Found unsafe XML encoding '{$encMatch[1]}'\n" );
1401 
1402  return true;
1403  }
1404  } elseif ( preg_match( "!<\?xml\b!si", $contents ) ) {
1405  // Start of XML declaration without an end in the first $wgSVGMetadataCutoff
1406  // bytes. There shouldn't be a legitimate reason for this to happen.
1407  wfDebug( __METHOD__ . ": Unmatched XML declaration start\n" );
1408 
1409  return true;
1410  } elseif ( substr( $contents, 0, 4 ) == "\x4C\x6F\xA7\x94" ) {
1411  // EBCDIC encoded XML
1412  wfDebug( __METHOD__ . ": EBCDIC Encoded XML\n" );
1413 
1414  return true;
1415  }
1416 
1417  // It's possible the file is encoded with multi-byte encoding, so re-encode attempt to
1418  // detect the encoding in case is specifies an encoding not whitelisted in self::$safeXmlEncodings
1419  $attemptEncodings = [ 'UTF-16', 'UTF-16BE', 'UTF-32', 'UTF-32BE' ];
1420  foreach ( $attemptEncodings as $encoding ) {
1421  MediaWiki\suppressWarnings();
1422  $str = iconv( $encoding, 'UTF-8', $contents );
1423  MediaWiki\restoreWarnings();
1424  if ( $str != '' && preg_match( "!<\?xml\b(.*?)\?>!si", $str, $matches ) ) {
1425  if ( preg_match( $encodingRegex, $matches[1], $encMatch )
1426  && !in_array( strtoupper( $encMatch[1] ), self::$safeXmlEncodings )
1427  ) {
1428  wfDebug( __METHOD__ . ": Found unsafe XML encoding '{$encMatch[1]}'\n" );
1429 
1430  return true;
1431  }
1432  } elseif ( $str != '' && preg_match( "!<\?xml\b!si", $str ) ) {
1433  // Start of XML declaration without an end in the first $wgSVGMetadataCutoff
1434  // bytes. There shouldn't be a legitimate reason for this to happen.
1435  wfDebug( __METHOD__ . ": Unmatched XML declaration start\n" );
1436 
1437  return true;
1438  }
1439  }
1440 
1441  return false;
1442  }
1443 
1449  protected function detectScriptInSvg( $filename, $partial ) {
1450  $this->mSVGNSError = false;
1451  $check = new XmlTypeCheck(
1452  $filename,
1453  [ $this, 'checkSvgScriptCallback' ],
1454  true,
1455  [
1456  'processing_instruction_handler' => 'UploadBase::checkSvgPICallback',
1457  'external_dtd_handler' => 'UploadBase::checkSvgExternalDTD',
1458  ]
1459  );
1460  if ( $check->wellFormed !== true ) {
1461  // Invalid xml (T60553)
1462  // But only when non-partial (T67724)
1463  return $partial ? false : [ 'uploadinvalidxml' ];
1464  } elseif ( $check->filterMatch ) {
1465  if ( $this->mSVGNSError ) {
1466  return [ 'uploadscriptednamespace', $this->mSVGNSError ];
1467  }
1468 
1469  return $check->filterMatchType;
1470  }
1471 
1472  return false;
1473  }
1474 
1481  public static function checkSvgPICallback( $target, $data ) {
1482  // Don't allow external stylesheets (T59550)
1483  if ( preg_match( '/xml-stylesheet/i', $target ) ) {
1484  return [ 'upload-scripted-pi-callback' ];
1485  }
1486 
1487  return false;
1488  }
1489 
1501  public static function checkSvgExternalDTD( $type, $publicId, $systemId ) {
1502  // This doesn't include the XHTML+MathML+SVG doctype since we don't
1503  // allow XHTML anyways.
1504  $allowedDTDs = [
1505  'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd',
1506  'http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd',
1507  'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-basic.dtd',
1508  'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd',
1509  // https://phabricator.wikimedia.org/T168856
1510  'http://www.w3.org/TR/2001/PR-SVG-20010719/DTD/svg10.dtd',
1511  ];
1512  if ( $type !== 'PUBLIC'
1513  || !in_array( $systemId, $allowedDTDs )
1514  || strpos( $publicId, "-//W3C//" ) !== 0
1515  ) {
1516  return [ 'upload-scripted-dtd' ];
1517  }
1518  return false;
1519  }
1520 
1528  public function checkSvgScriptCallback( $element, $attribs, $data = null ) {
1529  list( $namespace, $strippedElement ) = $this->splitXmlNamespace( $element );
1530 
1531  // We specifically don't include:
1532  // http://www.w3.org/1999/xhtml (T62771)
1533  static $validNamespaces = [
1534  '',
1535  'adobe:ns:meta/',
1536  'http://creativecommons.org/ns#',
1537  'http://inkscape.sourceforge.net/dtd/sodipodi-0.dtd',
1538  'http://ns.adobe.com/adobeillustrator/10.0/',
1539  'http://ns.adobe.com/adobesvgviewerextensions/3.0/',
1540  'http://ns.adobe.com/extensibility/1.0/',
1541  'http://ns.adobe.com/flows/1.0/',
1542  'http://ns.adobe.com/illustrator/1.0/',
1543  'http://ns.adobe.com/imagereplacement/1.0/',
1544  'http://ns.adobe.com/pdf/1.3/',
1545  'http://ns.adobe.com/photoshop/1.0/',
1546  'http://ns.adobe.com/saveforweb/1.0/',
1547  'http://ns.adobe.com/variables/1.0/',
1548  'http://ns.adobe.com/xap/1.0/',
1549  'http://ns.adobe.com/xap/1.0/g/',
1550  'http://ns.adobe.com/xap/1.0/g/img/',
1551  'http://ns.adobe.com/xap/1.0/mm/',
1552  'http://ns.adobe.com/xap/1.0/rights/',
1553  'http://ns.adobe.com/xap/1.0/stype/dimensions#',
1554  'http://ns.adobe.com/xap/1.0/stype/font#',
1555  'http://ns.adobe.com/xap/1.0/stype/manifestitem#',
1556  'http://ns.adobe.com/xap/1.0/stype/resourceevent#',
1557  'http://ns.adobe.com/xap/1.0/stype/resourceref#',
1558  'http://ns.adobe.com/xap/1.0/t/pg/',
1559  'http://purl.org/dc/elements/1.1/',
1560  'http://purl.org/dc/elements/1.1',
1561  'http://schemas.microsoft.com/visio/2003/svgextensions/',
1562  'http://sodipodi.sourceforge.net/dtd/sodipodi-0.dtd',
1563  'http://taptrix.com/inkpad/svg_extensions',
1564  'http://web.resource.org/cc/',
1565  'http://www.freesoftware.fsf.org/bkchem/cdml',
1566  'http://www.inkscape.org/namespaces/inkscape',
1567  'http://www.opengis.net/gml',
1568  'http://www.w3.org/1999/02/22-rdf-syntax-ns#',
1569  'http://www.w3.org/2000/svg',
1570  'http://www.w3.org/tr/rec-rdf-syntax/',
1571  'http://www.w3.org/2000/01/rdf-schema#',
1572  ];
1573 
1574  // Inkscape mangles namespace definitions created by Adobe Illustrator.
1575  // This is nasty but harmless. (T144827)
1576  $isBuggyInkscape = preg_match( '/^&(#38;)*ns_[a-z_]+;$/', $namespace );
1577 
1578  if ( !( $isBuggyInkscape || in_array( $namespace, $validNamespaces ) ) ) {
1579  wfDebug( __METHOD__ . ": Non-svg namespace '$namespace' in uploaded file.\n" );
1581  $this->mSVGNSError = $namespace;
1582 
1583  return true;
1584  }
1585 
1586  /*
1587  * check for elements that can contain javascript
1588  */
1589  if ( $strippedElement == 'script' ) {
1590  wfDebug( __METHOD__ . ": Found script element '$element' in uploaded file.\n" );
1591 
1592  return [ 'uploaded-script-svg', $strippedElement ];
1593  }
1594 
1595  # e.g., <svg xmlns="http://www.w3.org/2000/svg">
1596  # <handler xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load">alert(1)</handler> </svg>
1597  if ( $strippedElement == 'handler' ) {
1598  wfDebug( __METHOD__ . ": Found scriptable element '$element' in uploaded file.\n" );
1599 
1600  return [ 'uploaded-script-svg', $strippedElement ];
1601  }
1602 
1603  # SVG reported in Feb '12 that used xml:stylesheet to generate javascript block
1604  if ( $strippedElement == 'stylesheet' ) {
1605  wfDebug( __METHOD__ . ": Found scriptable element '$element' in uploaded file.\n" );
1606 
1607  return [ 'uploaded-script-svg', $strippedElement ];
1608  }
1609 
1610  # Block iframes, in case they pass the namespace check
1611  if ( $strippedElement == 'iframe' ) {
1612  wfDebug( __METHOD__ . ": iframe in uploaded file.\n" );
1613 
1614  return [ 'uploaded-script-svg', $strippedElement ];
1615  }
1616 
1617  # Check <style> css
1618  if ( $strippedElement == 'style'
1619  && self::checkCssFragment( Sanitizer::normalizeCss( $data ) )
1620  ) {
1621  wfDebug( __METHOD__ . ": hostile css in style element.\n" );
1622  return [ 'uploaded-hostile-svg' ];
1623  }
1624 
1625  foreach ( $attribs as $attrib => $value ) {
1626  $stripped = $this->stripXmlNamespace( $attrib );
1627  $value = strtolower( $value );
1628 
1629  if ( substr( $stripped, 0, 2 ) == 'on' ) {
1630  wfDebug( __METHOD__
1631  . ": Found event-handler attribute '$attrib'='$value' in uploaded file.\n" );
1632 
1633  return [ 'uploaded-event-handler-on-svg', $attrib, $value ];
1634  }
1635 
1636  # Do not allow relative links, or unsafe url schemas.
1637  # For <a> tags, only data:, http: and https: and same-document
1638  # fragment links are allowed. For all other tags, only data:
1639  # and fragment are allowed.
1640  if ( $stripped == 'href'
1641  && $value !== ''
1642  && strpos( $value, 'data:' ) !== 0
1643  && strpos( $value, '#' ) !== 0
1644  ) {
1645  if ( !( $strippedElement === 'a'
1646  && preg_match( '!^https?://!i', $value ) )
1647  ) {
1648  wfDebug( __METHOD__ . ": Found href attribute <$strippedElement "
1649  . "'$attrib'='$value' in uploaded file.\n" );
1650 
1651  return [ 'uploaded-href-attribute-svg', $strippedElement, $attrib, $value ];
1652  }
1653  }
1654 
1655  # only allow data: targets that should be safe. This prevents vectors like,
1656  # image/svg, text/xml, application/xml, and text/html, which can contain scripts
1657  if ( $stripped == 'href' && strncasecmp( 'data:', $value, 5 ) === 0 ) {
1658  // rfc2397 parameters. This is only slightly slower than (;[\w;]+)*.
1659  // @codingStandardsIgnoreStart Generic.Files.LineLength
1660  $parameters = '(?>;[a-zA-Z0-9\!#$&\'*+.^_`{|}~-]+=(?>[a-zA-Z0-9\!#$&\'*+.^_`{|}~-]+|"(?>[\0-\x0c\x0e-\x21\x23-\x5b\x5d-\x7f]+|\\\\[\0-\x7f])*"))*(?:;base64)?';
1661  // @codingStandardsIgnoreEnd
1662 
1663  if ( !preg_match( "!^data:\s*image/(gif|jpeg|jpg|png)$parameters,!i", $value ) ) {
1664  wfDebug( __METHOD__ . ": Found href to unwhitelisted data: uri "
1665  . "\"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" );
1666  return [ 'uploaded-href-unsafe-target-svg', $strippedElement, $attrib, $value ];
1667  }
1668  }
1669 
1670  # Change href with animate from (http://html5sec.org/#137).
1671  if ( $stripped === 'attributename'
1672  && $strippedElement === 'animate'
1673  && $this->stripXmlNamespace( $value ) == 'href'
1674  ) {
1675  wfDebug( __METHOD__ . ": Found animate that might be changing href using from "
1676  . "\"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" );
1677 
1678  return [ 'uploaded-animate-svg', $strippedElement, $attrib, $value ];
1679  }
1680 
1681  # use set/animate to add event-handler attribute to parent
1682  if ( ( $strippedElement == 'set' || $strippedElement == 'animate' )
1683  && $stripped == 'attributename'
1684  && substr( $value, 0, 2 ) == 'on'
1685  ) {
1686  wfDebug( __METHOD__ . ": Found svg setting event-handler attribute with "
1687  . "\"<$strippedElement $stripped='$value'...\" in uploaded file.\n" );
1688 
1689  return [ 'uploaded-setting-event-handler-svg', $strippedElement, $stripped, $value ];
1690  }
1691 
1692  # use set to add href attribute to parent element
1693  if ( $strippedElement == 'set'
1694  && $stripped == 'attributename'
1695  && strpos( $value, 'href' ) !== false
1696  ) {
1697  wfDebug( __METHOD__ . ": Found svg setting href attribute '$value' in uploaded file.\n" );
1698 
1699  return [ 'uploaded-setting-href-svg' ];
1700  }
1701 
1702  # use set to add a remote / data / script target to an element
1703  if ( $strippedElement == 'set'
1704  && $stripped == 'to'
1705  && preg_match( '!(http|https|data|script):!sim', $value )
1706  ) {
1707  wfDebug( __METHOD__ . ": Found svg setting attribute to '$value' in uploaded file.\n" );
1708 
1709  return [ 'uploaded-wrong-setting-svg', $value ];
1710  }
1711 
1712  # use handler attribute with remote / data / script
1713  if ( $stripped == 'handler' && preg_match( '!(http|https|data|script):!sim', $value ) ) {
1714  wfDebug( __METHOD__ . ": Found svg setting handler with remote/data/script "
1715  . "'$attrib'='$value' in uploaded file.\n" );
1716 
1717  return [ 'uploaded-setting-handler-svg', $attrib, $value ];
1718  }
1719 
1720  # use CSS styles to bring in remote code
1721  if ( $stripped == 'style'
1722  && self::checkCssFragment( Sanitizer::normalizeCss( $value ) )
1723  ) {
1724  wfDebug( __METHOD__ . ": Found svg setting a style with "
1725  . "remote url '$attrib'='$value' in uploaded file.\n" );
1726  return [ 'uploaded-remote-url-svg', $attrib, $value ];
1727  }
1728 
1729  # Several attributes can include css, css character escaping isn't allowed
1730  $cssAttrs = [ 'font', 'clip-path', 'fill', 'filter', 'marker',
1731  'marker-end', 'marker-mid', 'marker-start', 'mask', 'stroke' ];
1732  if ( in_array( $stripped, $cssAttrs )
1733  && self::checkCssFragment( $value )
1734  ) {
1735  wfDebug( __METHOD__ . ": Found svg setting a style with "
1736  . "remote url '$attrib'='$value' in uploaded file.\n" );
1737  return [ 'uploaded-remote-url-svg', $attrib, $value ];
1738  }
1739 
1740  # image filters can pull in url, which could be svg that executes scripts
1741  if ( $strippedElement == 'image'
1742  && $stripped == 'filter'
1743  && preg_match( '!url\s*\(!sim', $value )
1744  ) {
1745  wfDebug( __METHOD__ . ": Found image filter with url: "
1746  . "\"<$strippedElement $stripped='$value'...\" in uploaded file.\n" );
1747 
1748  return [ 'uploaded-image-filter-svg', $strippedElement, $stripped, $value ];
1749  }
1750  }
1751 
1752  return false; // No scripts detected
1753  }
1754 
1762  private static function checkCssFragment( $value ) {
1763  # Forbid external stylesheets, for both reliability and to protect viewer's privacy
1764  if ( stripos( $value, '@import' ) !== false ) {
1765  return true;
1766  }
1767 
1768  # We allow @font-face to embed fonts with data: urls, so we snip the string
1769  # 'url' out so this case won't match when we check for urls below
1770  $pattern = '!(@font-face\s*{[^}]*src:)url(\("data:;base64,)!im';
1771  $value = preg_replace( $pattern, '$1$2', $value );
1772 
1773  # Check for remote and executable CSS. Unlike in Sanitizer::checkCss, the CSS
1774  # properties filter and accelerator don't seem to be useful for xss in SVG files.
1775  # Expression and -o-link don't seem to work either, but filtering them here in case.
1776  # Additionally, we catch remote urls like url("http:..., url('http:..., url(http:...,
1777  # but not local ones such as url("#..., url('#..., url(#....
1778  if ( preg_match( '!expression
1779  | -o-link\s*:
1780  | -o-link-source\s*:
1781  | -o-replace\s*:!imx', $value ) ) {
1782  return true;
1783  }
1784 
1785  if ( preg_match_all(
1786  "!(\s*(url|image|image-set)\s*\(\s*[\"']?\s*[^#]+.*?\))!sim",
1787  $value,
1788  $matches
1789  ) !== 0
1790  ) {
1791  # TODO: redo this in one regex. Until then, url("#whatever") matches the first
1792  foreach ( $matches[1] as $match ) {
1793  if ( !preg_match( "!\s*(url|image|image-set)\s*\(\s*(#|'#|\"#)!im", $match ) ) {
1794  return true;
1795  }
1796  }
1797  }
1798 
1799  if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ) {
1800  return true;
1801  }
1802 
1803  return false;
1804  }
1805 
1811  private static function splitXmlNamespace( $element ) {
1812  // 'http://www.w3.org/2000/svg:script' -> [ 'http://www.w3.org/2000/svg', 'script' ]
1813  $parts = explode( ':', strtolower( $element ) );
1814  $name = array_pop( $parts );
1815  $ns = implode( ':', $parts );
1816 
1817  return [ $ns, $name ];
1818  }
1819 
1824  private function stripXmlNamespace( $name ) {
1825  // 'http://www.w3.org/2000/svg:script' -> 'script'
1826  $parts = explode( ':', strtolower( $name ) );
1827 
1828  return array_pop( $parts );
1829  }
1830 
1841  public static function detectVirus( $file ) {
1843 
1844  if ( !$wgAntivirus ) {
1845  wfDebug( __METHOD__ . ": virus scanner disabled\n" );
1846 
1847  return null;
1848  }
1849 
1850  if ( !$wgAntivirusSetup[$wgAntivirus] ) {
1851  wfDebug( __METHOD__ . ": unknown virus scanner: $wgAntivirus\n" );
1852  $wgOut->wrapWikiMsg( "<div class=\"error\">\n$1\n</div>",
1853  [ 'virus-badscanner', $wgAntivirus ] );
1854 
1855  return wfMessage( 'virus-unknownscanner' )->text() . " $wgAntivirus";
1856  }
1857 
1858  # look up scanner configuration
1859  $command = $wgAntivirusSetup[$wgAntivirus]['command'];
1860  $exitCodeMap = $wgAntivirusSetup[$wgAntivirus]['codemap'];
1861  $msgPattern = isset( $wgAntivirusSetup[$wgAntivirus]['messagepattern'] ) ?
1862  $wgAntivirusSetup[$wgAntivirus]['messagepattern'] : null;
1863 
1864  if ( strpos( $command, "%f" ) === false ) {
1865  # simple pattern: append file to scan
1866  $command .= " " . wfEscapeShellArg( $file );
1867  } else {
1868  # complex pattern: replace "%f" with file to scan
1869  $command = str_replace( "%f", wfEscapeShellArg( $file ), $command );
1870  }
1871 
1872  wfDebug( __METHOD__ . ": running virus scan: $command \n" );
1873 
1874  # execute virus scanner
1875  $exitCode = false;
1876 
1877  # NOTE: there's a 50 line workaround to make stderr redirection work on windows, too.
1878  # that does not seem to be worth the pain.
1879  # Ask me (Duesentrieb) about it if it's ever needed.
1880  $output = wfShellExecWithStderr( $command, $exitCode );
1881 
1882  # map exit code to AV_xxx constants.
1883  $mappedCode = $exitCode;
1884  if ( $exitCodeMap ) {
1885  if ( isset( $exitCodeMap[$exitCode] ) ) {
1886  $mappedCode = $exitCodeMap[$exitCode];
1887  } elseif ( isset( $exitCodeMap["*"] ) ) {
1888  $mappedCode = $exitCodeMap["*"];
1889  }
1890  }
1891 
1892  /* NB: AV_NO_VIRUS is 0 but AV_SCAN_FAILED is false,
1893  * so we need the strict equalities === and thus can't use a switch here
1894  */
1895  if ( $mappedCode === AV_SCAN_FAILED ) {
1896  # scan failed (code was mapped to false by $exitCodeMap)
1897  wfDebug( __METHOD__ . ": failed to scan $file (code $exitCode).\n" );
1898 
1899  $output = $wgAntivirusRequired
1900  ? wfMessage( 'virus-scanfailed', [ $exitCode ] )->text()
1901  : null;
1902  } elseif ( $mappedCode === AV_SCAN_ABORTED ) {
1903  # scan failed because filetype is unknown (probably imune)
1904  wfDebug( __METHOD__ . ": unsupported file type $file (code $exitCode).\n" );
1905  $output = null;
1906  } elseif ( $mappedCode === AV_NO_VIRUS ) {
1907  # no virus found
1908  wfDebug( __METHOD__ . ": file passed virus scan.\n" );
1909  $output = false;
1910  } else {
1911  $output = trim( $output );
1912 
1913  if ( !$output ) {
1914  $output = true; # if there's no output, return true
1915  } elseif ( $msgPattern ) {
1916  $groups = [];
1917  if ( preg_match( $msgPattern, $output, $groups ) ) {
1918  if ( $groups[1] ) {
1919  $output = $groups[1];
1920  }
1921  }
1922  }
1923 
1924  wfDebug( __METHOD__ . ": FOUND VIRUS! scanner feedback: $output \n" );
1925  }
1926 
1927  return $output;
1928  }
1929 
1938  private function checkOverwrite( $user ) {
1939  // First check whether the local file can be overwritten
1940  $file = $this->getLocalFile();
1941  $file->load( File::READ_LATEST );
1942  if ( $file->exists() ) {
1943  if ( !self::userCanReUpload( $user, $file ) ) {
1944  return [ 'fileexists-forbidden', $file->getName() ];
1945  } else {
1946  return true;
1947  }
1948  }
1949 
1950  /* Check shared conflicts: if the local file does not exist, but
1951  * wfFindFile finds a file, it exists in a shared repository.
1952  */
1953  $file = wfFindFile( $this->getTitle(), [ 'latest' => true ] );
1954  if ( $file && !$user->isAllowed( 'reupload-shared' ) ) {
1955  return [ 'fileexists-shared-forbidden', $file->getName() ];
1956  }
1957 
1958  return true;
1959  }
1960 
1968  public static function userCanReUpload( User $user, File $img ) {
1969  if ( $user->isAllowed( 'reupload' ) ) {
1970  return true; // non-conditional
1971  } elseif ( !$user->isAllowed( 'reupload-own' ) ) {
1972  return false;
1973  }
1974 
1975  if ( !( $img instanceof LocalFile ) ) {
1976  return false;
1977  }
1978 
1979  $img->load();
1980 
1981  return $user->getId() == $img->getUser( 'id' );
1982  }
1983 
1995  public static function getExistsWarning( $file ) {
1996  if ( $file->exists() ) {
1997  return [ 'warning' => 'exists', 'file' => $file ];
1998  }
1999 
2000  if ( $file->getTitle()->getArticleID() ) {
2001  return [ 'warning' => 'page-exists', 'file' => $file ];
2002  }
2003 
2004  if ( strpos( $file->getName(), '.' ) == false ) {
2005  $partname = $file->getName();
2006  $extension = '';
2007  } else {
2008  $n = strrpos( $file->getName(), '.' );
2009  $extension = substr( $file->getName(), $n + 1 );
2010  $partname = substr( $file->getName(), 0, $n );
2011  }
2012  $normalizedExtension = File::normalizeExtension( $extension );
2013 
2014  if ( $normalizedExtension != $extension ) {
2015  // We're not using the normalized form of the extension.
2016  // Normal form is lowercase, using most common of alternate
2017  // extensions (eg 'jpg' rather than 'JPEG').
2018 
2019  // Check for another file using the normalized form...
2020  $nt_lc = Title::makeTitle( NS_FILE, "{$partname}.{$normalizedExtension}" );
2021  $file_lc = wfLocalFile( $nt_lc );
2022 
2023  if ( $file_lc->exists() ) {
2024  return [
2025  'warning' => 'exists-normalized',
2026  'file' => $file,
2027  'normalizedFile' => $file_lc
2028  ];
2029  }
2030  }
2031 
2032  // Check for files with the same name but a different extension
2033  $similarFiles = RepoGroup::singleton()->getLocalRepo()->findFilesByPrefix(
2034  "{$partname}.", 1 );
2035  if ( count( $similarFiles ) ) {
2036  return [
2037  'warning' => 'exists-normalized',
2038  'file' => $file,
2039  'normalizedFile' => $similarFiles[0],
2040  ];
2041  }
2042 
2043  if ( self::isThumbName( $file->getName() ) ) {
2044  # Check for filenames like 50px- or 180px-, these are mostly thumbnails
2045  $nt_thb = Title::newFromText(
2046  substr( $partname, strpos( $partname, '-' ) + 1 ) . '.' . $extension,
2047  NS_FILE
2048  );
2049  $file_thb = wfLocalFile( $nt_thb );
2050  if ( $file_thb->exists() ) {
2051  return [
2052  'warning' => 'thumb',
2053  'file' => $file,
2054  'thumbFile' => $file_thb
2055  ];
2056  } else {
2057  // File does not exist, but we just don't like the name
2058  return [
2059  'warning' => 'thumb-name',
2060  'file' => $file,
2061  'thumbFile' => $file_thb
2062  ];
2063  }
2064  }
2065 
2066  foreach ( self::getFilenamePrefixBlacklist() as $prefix ) {
2067  if ( substr( $partname, 0, strlen( $prefix ) ) == $prefix ) {
2068  return [
2069  'warning' => 'bad-prefix',
2070  'file' => $file,
2071  'prefix' => $prefix
2072  ];
2073  }
2074  }
2075 
2076  return false;
2077  }
2078 
2084  public static function isThumbName( $filename ) {
2085  $n = strrpos( $filename, '.' );
2086  $partname = $n ? substr( $filename, 0, $n ) : $filename;
2087 
2088  return (
2089  substr( $partname, 3, 3 ) == 'px-' ||
2090  substr( $partname, 2, 3 ) == 'px-'
2091  ) &&
2092  preg_match( "/[0-9]{2}/", substr( $partname, 0, 2 ) );
2093  }
2094 
2100  public static function getFilenamePrefixBlacklist() {
2101  $blacklist = [];
2102  $message = wfMessage( 'filename-prefix-blacklist' )->inContentLanguage();
2103  if ( !$message->isDisabled() ) {
2104  $lines = explode( "\n", $message->plain() );
2105  foreach ( $lines as $line ) {
2106  // Remove comment lines
2107  $comment = substr( trim( $line ), 0, 1 );
2108  if ( $comment == '#' || $comment == '' ) {
2109  continue;
2110  }
2111  // Remove additional comments after a prefix
2112  $comment = strpos( $line, '#' );
2113  if ( $comment > 0 ) {
2114  $line = substr( $line, 0, $comment - 1 );
2115  }
2116  $blacklist[] = trim( $line );
2117  }
2118  }
2119 
2120  return $blacklist;
2121  }
2122 
2134  public function getImageInfo( $result ) {
2135  $localFile = $this->getLocalFile();
2136  $stashFile = $this->getStashFile();
2137  // Calling a different API module depending on whether the file was stashed is less than optimal.
2138  // In fact, calling API modules here at all is less than optimal. Maybe it should be refactored.
2139  if ( $stashFile ) {
2141  $info = ApiQueryStashImageInfo::getInfo( $stashFile, array_flip( $imParam ), $result );
2142  } else {
2144  $info = ApiQueryImageInfo::getInfo( $localFile, array_flip( $imParam ), $result );
2145  }
2146 
2147  return $info;
2148  }
2149 
2154  public function convertVerifyErrorToStatus( $error ) {
2155  $code = $error['status'];
2156  unset( $code['status'] );
2157 
2158  return Status::newFatal( $this->getVerificationErrorCode( $code ), $error );
2159  }
2160 
2168  public static function getMaxUploadSize( $forType = null ) {
2170 
2171  if ( is_array( $wgMaxUploadSize ) ) {
2172  if ( !is_null( $forType ) && isset( $wgMaxUploadSize[$forType] ) ) {
2173  return $wgMaxUploadSize[$forType];
2174  } else {
2175  return $wgMaxUploadSize['*'];
2176  }
2177  } else {
2178  return intval( $wgMaxUploadSize );
2179  }
2180  }
2181 
2189  public static function getMaxPhpUploadSize() {
2190  $phpMaxFileSize = wfShorthandToInteger(
2191  ini_get( 'upload_max_filesize' ) ?: ini_get( 'hhvm.server.upload.upload_max_file_size' ),
2192  PHP_INT_MAX
2193  );
2194  $phpMaxPostSize = wfShorthandToInteger(
2195  ini_get( 'post_max_size' ) ?: ini_get( 'hhvm.server.max_post_size' ),
2196  PHP_INT_MAX
2197  ) ?: PHP_INT_MAX;
2198  return min( $phpMaxFileSize, $phpMaxPostSize );
2199  }
2200 
2210  public static function getSessionStatus( User $user, $statusKey ) {
2211  $cache = MediaWikiServices::getInstance()->getMainObjectStash();
2212  $key = $cache->makeKey( 'uploadstatus', $user->getId() ?: md5( $user->getName() ), $statusKey );
2213 
2214  return $cache->get( $key );
2215  }
2216 
2227  public static function setSessionStatus( User $user, $statusKey, $value ) {
2228  $cache = MediaWikiServices::getInstance()->getMainObjectStash();
2229  $key = $cache->makeKey( 'uploadstatus', $user->getId() ?: md5( $user->getName() ), $statusKey );
2230 
2231  if ( $value === false ) {
2232  $cache->delete( $key );
2233  } else {
2234  $cache->set( $key, $value, $cache::TTL_DAY );
2235  }
2236  }
2237 }
$wgStrictFileExtensions
If this is turned off, users may override the warning for files not covered by $wgFileExtensions.
checkSvgScriptCallback($element, $attribs, $data=null)
static checkFileExtensionList($ext, $list)
Perform case-insensitive match against a list of file extensions.
getImageInfo($result)
Gets image info about the file just uploaded.
getVerificationErrorCode($error)
Definition: UploadBase.php:87
null means default in associative array form
Definition: hooks.txt:1966
exists()
canRender inherited
Definition: LocalFile.php:874
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
static read($fileName, $callback, $options=[])
Read a ZIP file and call a function for each file discovered in it.
const FILENAME_TOO_LONG
Definition: UploadBase.php:81
$wgSVGMetadataCutoff
Don't read SVG metadata beyond this point.
$wgDisableUploadScriptChecks
Setting this to true will disable the upload system's checks for HTML/JavaScript. ...
magic word the default is to use $key to get the and $key value or $key value text $key value html to format the value $key
Definition: hooks.txt:2556
tryStashFile(User $user, $isPartial=false)
Like stashFile(), but respects extensions' wishes to prevent the stashing.
wfIsHHVM()
Check if we are running under HHVM.
const SUCCESS
Definition: UploadBase.php:69
static createFromRequest(&$request, $type=null)
Create a form of UploadBase depending on wpSourceType and initializes it.
Definition: UploadBase.php:162
static isAllowed($user)
Returns true if the user can use this upload module or else a string identifying the missing permissi...
Definition: UploadBase.php:132
wfShorthandToInteger($string= '', $default=-1)
Converts shorthand byte notation to integer form.
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for use
getHistory($limit=null, $start=null, $end=null, $inc=true)
purgeDescription inherited
Definition: LocalFile.php:1070
static singleton()
Get an instance of this class.
Definition: MimeMagic.php:33
div flags Integer display flags(NO_ACTION_LINK, NO_EXTRA_USER_LINKS) 'LogException'returning false will NOT prevent logging $e
Definition: hooks.txt:2142
static newFatal($message)
Factory function for fatal errors.
Definition: StatusValue.php:68
$command
Definition: cdb.php:64
static checkFileExtension($ext, $list)
Perform case-insensitive match against a list of file extensions.
globals txt Globals are evil The original MediaWiki code relied on globals for processing context far too often MediaWiki development since then has been a story of slowly moving context out of global variables and into objects Storing processing context in object member variables allows those objects to be reused in a much more flexible way Consider the elegance of
database rows
Definition: globals.txt:10
const DELETE_SOURCE
Definition: File.php:66
static getSessionStatus(User $user, $statusKey)
Get the current status of a chunked upload (used for polling)
static configuration should be added through ResourceLoaderGetConfigVars instead can be used to get the real title after the basic globals have been set but before ordinary actions take place $output
Definition: hooks.txt:2199
const OVERWRITE_EXISTING_FILE
Definition: UploadBase.php:74
static $safeXmlEncodings
Definition: UploadBase.php:52
static isValidRequest($request)
Check whether a request if valid for this handler.
Definition: UploadBase.php:206
This class is used to hold the location and do limited manipulation of files stored temporarily (this...
Definition: TempFSFile.php:30
you don t have to do a grep find to see where the $wgReverseTitle variable is used
Definition: hooks.txt:115
null for the local wiki Added in
Definition: hooks.txt:1582
has been added to your &Future changes to this page and its associated Talk page will be listed there
$value
const AV_NO_VIRUS
Definition: Defines.php:112
verifyPermissions($user)
Alias for verifyTitlePermissions.
Definition: UploadBase.php:592
checkLocalFileExists(LocalFile $localFile, $hash)
Definition: UploadBase.php:762
if($ext== 'php'||$ext== 'php5') $mime
Definition: router.php:65
stripXmlNamespace($name)
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency MediaWikiServices
Definition: injection.txt:23
static splitXmlNamespace($element)
Divide the element name passed by the xml parser to the callback into URI and prifix.
static newFromText($text, $defaultNamespace=NS_MAIN)
Create a new Title from text, such as what one would find in a link.
Definition: Title.php:268
const ILLEGAL_FILENAME
Definition: UploadBase.php:73
isEmptyFile()
Return true if the file is empty.
Definition: UploadBase.php:277
const AV_SCAN_FAILED
Definition: Defines.php:115
string $mTempPath
Local file system path to the file to upload (or a local copy)
Definition: UploadBase.php:41
target page
when a variable name is used in a it is silently declared as a new local masking the global
Definition: design.txt:93
when a variable name is used in a function
Definition: design.txt:93
wfLocalFile($title)
Get an object referring to a locally registered file.
$wgAllowJavaUploads
Allow Java archive uploads.
wfStripIllegalFilenameChars($name)
Replace all invalid characters with '-'.
static checkSvgPICallback($target, $data)
Callback to filter SVG Processing Instructions.
checkBadFileName($filename, $desiredFileName)
Check whether the resulting filename is different from the desired one, but ignore things like ucfirs...
Definition: UploadBase.php:699
getName()
Get the user name, or the IP of an anonymous user.
Definition: User.php:2251
verifyMimeType($mime)
Verify the MIME type.
Definition: UploadBase.php:409
wfArrayDiff2($a, $b)
Like array_diff( $a, $b ) except that it works with two-dimensional arrays.
wfDebug($text, $dest= 'all', array $context=[])
Sends a line to the debug log if enabled or, optionally, to a comment in output.
const AV_SCAN_ABORTED
Definition: Defines.php:114
static getMaxUploadSize($forType=null)
Get the MediaWiki maximum uploaded file size for given type of upload, based on $wgMaxUploadSize.
const DELETED_FILE
Definition: File.php:53
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as $wgLang
Definition: design.txt:56
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message.Please note the header message cannot receive/use parameters. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item.Return false to stop further processing of the tag $reader:XMLReader object $logInfo:Array of information 'ImportHandlePageXMLTag':When parsing a XML tag in a page.Return false to stop further processing of the tag $reader:XMLReader object &$pageInfo:Array of information 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision.Return false to stop further processing of the tag $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information 'ImportHandleToplevelXMLTag':When parsing a top level XML tag.Return false to stop further processing of the tag $reader:XMLReader object 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload.Return false to stop further processing of the tag $reader:XMLReader object $revisionInfo:Array of information 'ImportLogInterwikiLink':Hook to change the interwiki link used in log entries and edit summaries for transwiki imports.&$fullInterwikiPrefix:Interwiki prefix, may contain colons.&$pageTitle:String that contains page title. 'ImportSources':Called when reading from the $wgImportSources configuration variable.Can be used to lazy-load the import sources list.&$importSources:The value of $wgImportSources.Modify as necessary.See the comment in DefaultSettings.php for the detail of how to structure this array. 'InfoAction':When building information to display on the action=info page.$context:IContextSource object &$pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect.&$title:Title object for the current page &$request:WebRequest &$ignoreRedirect:boolean to skip redirect check &$target:Title/string of redirect target &$article:Article object 'InternalParseBeforeLinks':during Parser's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InternalParseBeforeSanitize':during Parser's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings.Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not.Return true without providing an interwiki to continue interwiki search.$prefix:interwiki prefix we are looking for.&$iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InvalidateEmailComplete':Called after a user's email has been invalidated successfully.$user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification.Callee may modify $url and $query, URL will be constructed as $url.$query &$url:URL to index.php &$query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) &$article:article(object) being checked 'IsTrustedProxy':Override the result of IP::isTrustedProxy() &$ip:IP being check &$result:Change this value to override the result of IP::isTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from &$allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of Sanitizer::validateEmail(), for instance to return false if the domain name doesn't match your organization.$addr:The e-mail address entered by the user &$result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user &$result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we're looking for a messages file for &$file:The messages file path, you can override this to change the location. 'LanguageGetMagic':DEPRECATED!Use $magicWords in a file listed in $wgExtensionMessagesFiles instead.Use this to define synonyms of magic words depending of the language &$magicExtensions:associative array of magic words synonyms $lang:language code(string) 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces.Do not use this hook to add namespaces.Use CanonicalNamespaces for that.&$namespaces:Array of namespaces indexed by their numbers 'LanguageGetSpecialPageAliases':DEPRECATED!Use $specialPageAliases in a file listed in $wgExtensionMessagesFiles instead.Use to define aliases of special pages names depending of the language &$specialPageAliases:associative array of magic words synonyms $lang:language code(string) 'LanguageGetTranslatedLanguageNames':Provide translated language names.&$names:array of language code=> language name $code:language of the preferred translations 'LanguageLinks':Manipulate a page's language links.This is called in various places to allow extensions to define the effective language links for a page.$title:The page's Title.&$links:Array with elements of the form"language:title"in the order that they will be output.&$linkFlags:Associative array mapping prefixed links to arrays of flags.Currently unused, but planned to provide support for marking individual language links in the UI, e.g.for featured articles. 'LanguageSelector':Hook to change the language selector available on a page.$out:The output page.$cssClassName:CSS class name of the language selector. 'LinkBegin':DEPRECATED!Use HtmlPageLinkRendererBegin instead.Used when generating internal and interwiki links in Linker::link(), before processing starts.Return false to skip default processing and return $ret.See documentation for Linker::link() for details on the expected meanings of parameters.$skin:the Skin object $target:the Title that the link is pointing to &$html:the contents that the< a > tag should have(raw HTML) $result
Definition: hooks.txt:1964
setTempFile($tempPath, $fileSize=null)
Definition: UploadBase.php:252
verifyPartialFile()
A verification routine suitable for partial files.
Definition: UploadBase.php:502
$wgCheckFileExtensions
This is a flag to determine whether or not to check file extensions on upload.
static decodeCharReferences($text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string...
Definition: Sanitizer.php:1639
$wgEnableUploads
Uploads have to be specially set up to be secure.
static isThumbName($filename)
Helper function that checks whether the filename looks like a thumbnail.
static isThrottled($user)
Returns true if the user has surpassed the upload rate limit, false otherwise.
Definition: UploadBase.php:148
Class representing a row of the 'filearchive' table.
wasDeleted()
Was this file ever deleted from the wiki?
Definition: File.php:1892
zipEntryCallback($entry)
Callback for ZipDirectoryReader to detect Java class files.
Definition: UploadBase.php:563
$wgAntivirusRequired
Determines if a failed virus scan (AV_SCAN_FAILED) will cause the file to be rejected.
We ve cleaned up the code here by removing clumps of infrequently used code and moving them off somewhere else It s much easier for someone working with this code to see what s _really_ going and make changes or fix bugs In we can take all the code that deals with the little used title reversing we can concentrate it all in an extension file
Definition: hooks.txt:91
getTempFileSha1Base36()
Get the base 36 SHA1 of the file.
Definition: UploadBase.php:293
stashFileGetKey()
Stash a file in a temporary directory, returning a key which can be used to find the file again...
UploadBase and subclasses are the backend of MediaWiki's file uploads.
Definition: UploadBase.php:39
checkAgainstExistingDupes($hash)
Definition: UploadBase.php:795
either a unescaped string or a HtmlArmor object after in associative array form externallinks including delete and has completed for all link tables whether this was an auto creation default is conds Array Extra conditions for the No matching items in log is displayed if loglist is empty msgKey Array If you want a nice box with a set this to the key of the message First element is the message additional optional elements are parameters for the key that are processed with wfMessage() -> params() ->parseAsBlock()-offset Set to overwrite offset parameter in $wgRequest set to ''to unsetoffset-wrap String Wrap the message in html(usually something like"&lt
wfIniGetBool($setting)
Safety wrapper around ini_get() for boolean settings.
static singleton()
Get a RepoGroup instance.
Definition: RepoGroup.php:59
fetchFile()
Fetch the file.
Definition: UploadBase.php:269
static isStoragePath($path)
Check if a given path is a "mwstore://" path.
stashSession()
alias for stashFileGetKey, for backwards compatibility
postProcessUpload()
Perform extra steps after a successful upload.
Definition: UploadBase.php:887
static getPropertyNames($filter=[])
Returns all possible parameters to iiprop.
$cache
Definition: mcc.php:33
const IGNORE_USER_RIGHTS
Definition: User.php:88
static doWatch(Title $title, User $user, $checkRights=User::CHECK_USER_RIGHTS)
Watch a page.
getTitle()
Returns the title of the file to be uploaded.
Definition: UploadBase.php:896
performUpload($comment, $pageText, $watch, $user, $tags=[])
Really perform the upload.
Definition: UploadBase.php:840
wfDeprecated($function, $version=false, $component=false, $callerOffset=2)
Throws a warning that $function is deprecated.
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
Definition: hooks.txt:1966
static detectVirus($file)
Generic wrapper function for a virus scanner program.
static splitExtensions($filename)
Split a file into a base name and all dot-delimited 'extensions' on the end.
static makeTitleSafe($ns, $title, $fragment= '', $interwiki= '')
Create a new Title from a namespace index and a DB key.
Definition: Title.php:557
cleanupTempFile()
If we've modified the upload file we need to manually remove it on exit to clean up.
getSourceType()
Returns the upload type.
Definition: UploadBase.php:219
const FILE_TOO_LARGE
Definition: UploadBase.php:79
checkUnwantedFileExtensions($fileExtension)
Definition: UploadBase.php:718
namespace and then decline to actually register it file or subcat img or subcat $title
Definition: hooks.txt:933
static newGood($value=null)
Factory function for good results.
Definition: StatusValue.php:81
checkWarnings()
Check for non fatal problems with the file.
Definition: UploadBase.php:645
initializeFromRequest(&$request)
Initialize from a WebRequest.
verifyUpload()
Verify whether the upload is sane.
Definition: UploadBase.php:323
const MIN_LENGTH_PARTNAME
Definition: UploadBase.php:72
static run($event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:203
getFileSize()
Return the file size.
Definition: UploadBase.php:285
const NS_FILE
Definition: Defines.php:71
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for and distribution as defined by Sections through of this document Licensor shall mean the copyright owner or entity authorized by the copyright owner that is granting the License Legal Entity shall mean the union of the acting entity and all other entities that control are controlled by or are under common control with that entity For the purposes of this definition control direct or to cause the direction or management of such whether by contract or including but not limited to software source documentation and configuration files Object form shall mean any form resulting from mechanical transformation or translation of a Source including but not limited to compiled object generated and conversions to other media types Work shall mean the work of whether in Source or Object made available under the as indicated by a copyright notice that is included in or attached to the whether in Source or Object that is based or other modifications as a an original work of authorship For the purposes of this Derivative Works shall not include works that remain separable or merely the Work and Derivative Works thereof Contribution shall mean any work of including the original version of the Work and any modifications or additions to that Work or Derivative Works that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner For the purposes of this submitted means any form of or written communication sent to the Licensor or its including but not limited to communication on electronic mailing source code control and issue tracking systems that are managed by
static getSha1Base36FromPath($path)
Get a SHA-1 hash of a file in the local filesystem, in base-36 lower case encoding, zero padded to 31 digits.
Definition: FSFile.php:218
const VERIFICATION_ERROR
Definition: UploadBase.php:77
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
static isEnabled()
Returns true if uploads are enabled.
Definition: UploadBase.php:113
doStashFile(User $user=null)
Implementation for stashFile() and tryStashFile().
validateName()
Verify that the name is valid and, if necessary, that we can overwrite.
Definition: UploadBase.php:379
const FILETYPE_BADTYPE
Definition: UploadBase.php:76
$wgMaxUploadSize
Max size for uploads, in bytes.
getLocalFile()
Return the local file and initializes if necessary.
$wgAntivirusSetup
Configuration for different virus scanners.
const FILETYPE_MISSING
Definition: UploadBase.php:75
static normalizeCss($value)
Normalize CSS into a format we can easily search for hostile input.
Definition: Sanitizer.php:923
$wgFileExtensions
This is the list of preferred extensions for uploading files.
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
static getFilenamePrefixBlacklist()
Get a list of blacklisted filename prefixes from [[MediaWiki:Filename-prefix-blacklist]].
$wgUploadSizeWarning
Warn if uploaded files are larger than this (in bytes), or false to disable.
verifyTitlePermissions($user)
Check whether the user can edit, upload and create the image.
Definition: UploadBase.php:607
$lines
Definition: router.php:67
const HOOK_ABORTED
Definition: UploadBase.php:78
checkAgainstArchiveDupes($hash)
Definition: UploadBase.php:814
stashFile(User $user=null)
If the user does not supply all necessary information in the first upload form submission (either by ...
getId()
Get the user's ID.
Definition: User.php:2226
static verifyExtension($mime, $extension)
Checks if the MIME type of the uploaded file matches the file extension.
detectScriptInSvg($filename, $partial)
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output modifiable & $code
Definition: hooks.txt:782
static detectScript($file, $mime, $extension)
Heuristic for detecting files that could contain JavaScript instructions or things that may look like...
convertVerifyErrorToStatus($error)
$line
Definition: cdb.php:58
static $uploadHandlers
Definition: UploadBase.php:153
const WINDOWS_NONASCII_FILENAME
Definition: UploadBase.php:80
static checkSvgExternalDTD($type, $publicId, $systemId)
Verify that DTD urls referenced are only the standard dtds.
static getHandler($type)
Get a MediaHandler for a given MIME type from the instance cache.
checkFileSize($fileSize)
Definition: UploadBase.php:740
Class to represent a local file in the wiki's own database.
Definition: LocalFile.php:45
MimeMagic helper wrapper.
Definition: MWFileProps.php:28
Allows to change the fields on the form that will be generated $name
Definition: hooks.txt:302
$wgAllowTitlesInSVG
Disallow element in SVG files. </div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l01153">DefaultSettings.php:1153</a></div></div> <div class="ttc" id="classUploadBase_html_abaddaebc8a45879bc55291f21c9a4633"><div class="ttname"><a href="classUploadBase.html#abaddaebc8a45879bc55291f21c9a4633">UploadBase\checkXMLEncodingMissmatch</a></div><div class="ttdeci">static checkXMLEncodingMissmatch($file)</div><div class="ttdoc">Check a whitelist of xml encodings that are known not to be interpreted differently by the server's x...</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l01391">UploadBase.php:1391</a></div></div> <div class="ttc" id="GlobalFunctions_8php_html_a781ca00c48d9c5cbd509c282a244c022"><div class="ttname"><a href="GlobalFunctions_8php.html#a781ca00c48d9c5cbd509c282a244c022">wfEscapeShellArg</a></div><div class="ttdeci">wfEscapeShellArg()</div><div class="ttdoc">Version of escapeshellarg() that works better on Windows. </div><div class="ttdef"><b>Definition:</b> <a href="GlobalFunctions_8php_source.html#l02247">GlobalFunctions.php:2247</a></div></div> <div class="ttc" id="hooks_8txt_html_a0568e0b981de231e4b0068d6ecaea6ca"><div class="ttname"><a href="hooks_8txt.html#a0568e0b981de231e4b0068d6ecaea6ca">$status</a></div><div class="ttdeci">Status::newGood()`to allow deletion, and then`return false`from the hook function.Ensure you consume the 'ChangeTagAfterDelete'hook to carry out custom deletion actions.$tag:name of the tag $user:user initiating the action &$status:Status object.See above. 'ChangeTagsListActive':Allows you to nominate which of the tags your extension uses are in active use.&$tags:list of all active tags.Append to this array. 'ChangeTagsAfterUpdateTags':Called after tags have been updated with the ChangeTags::updateTags function.Params:$addedTags:tags effectively added in the update $removedTags:tags effectively removed in the update $prevTags:tags that were present prior to the update $rc_id:recentchanges table id $rev_id:revision table id $log_id:logging table id $params:tag params $rc:RecentChange being tagged when the tagging accompanies the action or null $user:User who performed the tagging when the tagging is subsequent to the action or null 'ChangeTagsAllowedAdd':Called when checking if a user can add tags to a change.&$allowedTags:List of all the tags the user is allowed to add.Any tags the user wants to add($addTags) that are not in this array will cause it to fail.You may add or remove tags to this array as required.$addTags:List of tags user intends to add.$user:User who is adding the tags. 'ChangeUserGroups':Called before user groups are changed.$performer:The User who will perform the change $user:The User whose groups will be changed &$add:The groups that will be added &$remove:The groups that will be removed 'Collation::factory':Called if $wgCategoryCollation is an unknown collation.$collationName:Name of the collation in question &$collationObject:Null.Replace with a subclass of the Collation class that implements the collation given in $collationName. 'ConfirmEmailComplete':Called after a user's email has been confirmed successfully.$user:user(object) whose email is being confirmed 'ContentAlterParserOutput':Modify parser output for a given content object.Called by Content::getParserOutput after parsing has finished.Can be used for changes that depend on the result of the parsing but have to be done before LinksUpdate is called(such as adding tracking categories based on the rendered HTML).$content:The Content to render $title:Title of the page, as context $parserOutput:ParserOutput to manipulate 'ContentGetParserOutput':Customize parser output for a given content object, called by AbstractContent::getParserOutput.May be used to override the normal model-specific rendering of page content.$content:The Content to render $title:Title of the page, as context $revId:The revision ID, as context $options:ParserOptions for rendering.To avoid confusing the parser cache, the output can only depend on parameters provided to this hook function, not on global state.$generateHtml:boolean, indicating whether full HTML should be generated.If false, generation of HTML may be skipped, but other information should still be present in the ParserOutput object.&$output:ParserOutput, to manipulate or replace 'ContentHandlerDefaultModelFor':Called when the default content model is determined for a given title.May be used to assign a different model for that title.$title:the Title in question &$model:the model name.Use with CONTENT_MODEL_XXX constants. 'ContentHandlerForModelID':Called when a ContentHandler is requested for a given content model name, but no entry for that model exists in $wgContentHandlers.Note:if your extension implements additional models via this hook, please use GetContentModels hook to make them known to core.$modeName:the requested content model name &$handler:set this to a ContentHandler object, if desired. 'ContentModelCanBeUsedOn':Called to determine whether that content model can be used on a given page.This is especially useful to prevent some content models to be used in some special location.$contentModel:ID of the content model in question $title:the Title in question.&$ok:Output parameter, whether it is OK to use $contentModel on $title.Handler functions that modify $ok should generally return false to prevent further hooks from further modifying $ok. 'ContribsPager::getQueryInfo':Before the contributions query is about to run &$pager:Pager object for contributions &$queryInfo:The query for the contribs Pager 'ContribsPager::reallyDoQuery':Called before really executing the query for My Contributions &$data:an array of results of all contribs queries $pager:The ContribsPager object hooked into $offset:Index offset, inclusive $limit:Exact query limit $descending:Query direction, false for ascending, true for descending 'ContributionsLineEnding':Called before a contributions HTML line is finished $page:SpecialPage object for contributions &$ret:the HTML line $row:the DB row for this line &$classes:the classes to add to the surrounding< li > &$attribs:associative array of other HTML attributes for the< li > element.Currently only data attributes reserved to MediaWiki are allowed(see Sanitizer::isReservedDataAttribute). 'ContributionsToolLinks':Change tool links above Special:Contributions $id:User identifier $title:User page title &$tools:Array of tool links $specialPage:SpecialPage instance for context and services.Can be either SpecialContributions or DeletedContributionsPage.Extensions should type hint against a generic SpecialPage though. 'ConvertContent':Called by AbstractContent::convert when a conversion to another content model is requested.Handler functions that modify $result should generally return false to disable further attempts at conversion.$content:The Content object to be converted.$toModel:The ID of the content model to convert to.$lossy:boolean indicating whether lossy conversion is allowed.&$result:Output parameter, in case the handler function wants to provide a converted Content object.Note that $result->getContentModel() must return $toModel. 'CustomEditor':When invoking the page editor Return true to allow the normal editor to be used, or false if implementing a custom editor, e.g.for a special namespace, etc.$article:Article being edited $user:User performing the edit 'DatabaseOraclePostInit':Called after initialising an Oracle database $db:the DatabaseOracle object 'DeletedContribsPager::reallyDoQuery':Called before really executing the query for Special:DeletedContributions Similar to ContribsPager::reallyDoQuery &$data:an array of results of all contribs queries $pager:The DeletedContribsPager object hooked into $offset:Index offset, inclusive $limit:Exact query limit $descending:Query direction, false for ascending, true for descending 'DeletedContributionsLineEnding':Called before a DeletedContributions HTML line is finished.Similar to ContributionsLineEnding $page:SpecialPage object for DeletedContributions &$ret:the HTML line $row:the DB row for this line &$classes:the classes to add to the surrounding< li > &$attribs:associative array of other HTML attributes for the< li > element.Currently only data attributes reserved to MediaWiki are allowed(see Sanitizer::isReservedDataAttribute). 'DifferenceEngineAfterLoadNewText':called in DifferenceEngine::loadNewText() after the new revision's content has been loaded into the class member variable $differenceEngine->mNewContent but before returning true from this function.$differenceEngine:DifferenceEngine object 'DifferenceEngineLoadTextAfterNewContentIsLoaded':called in DifferenceEngine::loadText() after the new revision's content has been loaded into the class member variable $differenceEngine->mNewContent but before checking if the variable's value is null.This hook can be used to inject content into said class member variable.$differenceEngine:DifferenceEngine object 'DifferenceEngineMarkPatrolledLink':Allows extensions to change the"mark as patrolled"link which is shown both on the diff header as well as on the bottom of a page, usually wrapped in a span element which has class="patrollink".$differenceEngine:DifferenceEngine object &$markAsPatrolledLink:The"mark as patrolled"link HTML(string) $rcid:Recent change ID(rc_id) for this change(int) 'DifferenceEngineMarkPatrolledRCID':Allows extensions to possibly change the rcid parameter.For example the rcid might be set to zero due to the user being the same as the performer of the change but an extension might still want to show it under certain conditions.&$rcid:rc_id(int) of the change or 0 $differenceEngine:DifferenceEngine object $change:RecentChange object $user:User object representing the current user 'DifferenceEngineNewHeader':Allows extensions to change the $newHeader variable, which contains information about the new revision, such as the revision's author, whether the revision was marked as a minor edit or not, etc.$differenceEngine:DifferenceEngine object &$newHeader:The string containing the various#mw-diff-otitle[1-5] divs, which include things like revision author info, revision comment, RevisionDelete link and more $formattedRevisionTools:Array containing revision tools, some of which may have been injected with the DiffRevisionTools hook $nextlink:String containing the link to the next revision(if any) $status</div><div class="ttdef"><b>Definition:</b> <a href="hooks_8txt_source.html#l01246">hooks.txt:1246</a></div></div> <div class="ttc" id="classUploadBase_html_a087aa90b972383fc6af7f66cd82667b3"><div class="ttname"><a href="classUploadBase.html#a087aa90b972383fc6af7f66cd82667b3">UploadBase\checkCssFragment</a></div><div class="ttdeci">static checkCssFragment($value)</div><div class="ttdoc">Check a block of CSS or CSS fragment for anything that looks like it is bringing in remote code...</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l01762">UploadBase.php:1762</a></div></div> <div class="ttc" id="classXmlTypeCheck_html"><div class="ttname"><a href="classXmlTypeCheck.html">XmlTypeCheck</a></div><div class="ttdef"><b>Definition:</b> <a href="XmlTypeCheck_8php_source.html#l00028">XmlTypeCheck.php:28</a></div></div> <div class="ttc" id="classUploadBase_html_af2f0fc4c8dea6e705323620b5337cae5"><div class="ttname"><a href="classUploadBase.html#af2f0fc4c8dea6e705323620b5337cae5">UploadBase\getMaxPhpUploadSize</a></div><div class="ttdeci">static getMaxPhpUploadSize()</div><div class="ttdoc">Get the PHP maximum uploaded file size, based on ini settings. </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l02189">UploadBase.php:2189</a></div></div> <div class="ttc" id="Setup_8php_html_a42b1168a7e1606df23cc6419aa411e78"><div class="ttname"><a href="Setup_8php.html#a42b1168a7e1606df23cc6419aa411e78">$wgOut</a></div><div class="ttdeci">$wgOut</div><div class="ttdef"><b>Definition:</b> <a href="Setup_8php_source.html#l00819">Setup.php:819</a></div></div> <div class="ttc" id="classUploadBase_html_af9702f03fda4170d5debce1bc23c65b8"><div class="ttname"><a href="classUploadBase.html#af9702f03fda4170d5debce1bc23c65b8">UploadBase\setSessionStatus</a></div><div class="ttdeci">static setSessionStatus(User $user, $statusKey, $value)</div><div class="ttdoc">Set the current status of a chunked upload (used for polling) </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l02227">UploadBase.php:2227</a></div></div> <div class="ttc" id="NoLocalSettings_8php_html_a0a4baf0b22973c07685c3981f0d17fc4"><div class="ttname"><a href="NoLocalSettings_8php.html#a0a4baf0b22973c07685c3981f0d17fc4">$path</a></div><div class="ttdeci">$path</div><div class="ttdef"><b>Definition:</b> <a href="NoLocalSettings_8php_source.html#l00026">NoLocalSettings.php:26</a></div></div> <div class="ttc" id="classUploadBase_html_a39347cf74d116df59f2fe0344bfaac91"><div class="ttname"><a href="classUploadBase.html#a39347cf74d116df59f2fe0344bfaac91">UploadBase\$mBlackListedExtensions</a></div><div class="ttdeci">$mBlackListedExtensions</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00049">UploadBase.php:49</a></div></div> <div class="ttc" id="classUploadBase_html_aef55162125a82f0247397621735daca1"><div class="ttname"><a href="classUploadBase.html#aef55162125a82f0247397621735daca1">UploadBase\$tempFileObj</a></div><div class="ttdeci">TempFSFile null $tempFileObj</div><div class="ttdoc">Wrapper to handle deleting the temp file. </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00043">UploadBase.php:43</a></div></div> <div class="ttc" id="classUploadBase_html_af4a23e145883030bffcb842cbf6c897a"><div class="ttname"><a href="classUploadBase.html#af4a23e145883030bffcb842cbf6c897a">UploadBase\$mFileSize</a></div><div class="ttdeci">$mFileSize</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00048">UploadBase.php:48</a></div></div> <div class="ttc" id="hooks_8txt_html_ae55f6a597c457cd31e064490cae16f0a"><div class="ttname"><a href="hooks_8txt.html#ae55f6a597c457cd31e064490cae16f0a">$handler</a></div><div class="ttdeci">this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output modifiable modifiable after all normalizations have been except for the $wgMaxImageArea check set to true or false to override the $wgMaxImageArea check result gives extension the possibility to transform it themselves $handler</div><div class="ttdef"><b>Definition:</b> <a href="hooks_8txt_source.html#l00782">hooks.txt:782</a></div></div> <div class="ttc" id="DefaultSettings_8php_html_acb268f4a51af8c4bf404f8b4379176d0"><div class="ttname"><a href="DefaultSettings_8php.html#acb268f4a51af8c4bf404f8b4379176d0">$wgMimeTypeBlacklist</a></div><div class="ttdeci">$wgMimeTypeBlacklist</div><div class="ttdoc">Files with these MIME types will never be allowed as uploads if $wgVerifyMimeType is enabled...</div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l00888">DefaultSettings.php:888</a></div></div> <div class="ttc" id="GlobalFunctions_8php_html_ae0675d4e55228eaad7607df946396cb4"><div class="ttname"><a href="GlobalFunctions_8php.html#ae0675d4e55228eaad7607df946396cb4">wfShellExecWithStderr</a></div><div class="ttdeci">wfShellExecWithStderr($cmd, &$retval=null, $environ=[], $limits=[])</div><div class="ttdoc">Execute a shell command, returning both stdout and stderr. </div><div class="ttdef"><b>Definition:</b> <a href="GlobalFunctions_8php_source.html#l02339">GlobalFunctions.php:2339</a></div></div> <div class="ttc" id="classUploadBase_html_a515d712e20d4ed2cee1b9f23637401ad"><div class="ttname"><a href="classUploadBase.html#a515d712e20d4ed2cee1b9f23637401ad">UploadBase\verifyFile</a></div><div class="ttdeci">verifyFile()</div><div class="ttdoc">Verifies that it's ok to include the uploaded file. </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00441">UploadBase.php:441</a></div></div> <div class="ttc" id="classUploadBase_html_a97839fdd914750ecd650fd3a045f36f8"><div class="ttname"><a href="classUploadBase.html#a97839fdd914750ecd650fd3a045f36f8">UploadBase\OK</a></div><div class="ttdeci">const OK</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00070">UploadBase.php:70</a></div></div> <div class="ttc" id="DefaultSettings_8php_html_a75612877f528cecdb711d45fa25588ee"><div class="ttname"><a href="DefaultSettings_8php.html#a75612877f528cecdb711d45fa25588ee">$wgVerifyMimeType</a></div><div class="ttdeci">$wgVerifyMimeType</div><div class="ttdoc">Determines if the MIME type of uploaded files should be checked. </div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l01307">DefaultSettings.php:1307</a></div></div> <div class="ttc" id="hooks_8txt_html_a1a5e48c4e4feac127181f418a6652ea7"><div class="ttname"><a href="hooks_8txt.html#a1a5e48c4e4feac127181f418a6652ea7">own</a></div><div class="ttdeci">this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist Do not use this to implement individual filters if they are compatible with the ChangesListFilter and ChangesListFilterGroup structure use sub classes of those in conjunction with the ChangesListSpecialPageStructuredFilters hook This hook can be used to implement filters that do not implement that or custom behavior that is not an individual filter e g Watchlist and Watchlist you will want to construct new ChangesListBooleanFilter or ChangesListStringOptionsFilter objects When constructing you specify which group they belong to You can reuse existing or create your own(ChangesListBooleanFilterGroup or ChangesListStringOptionsFilterGroup).If you create new groups</div></div> <div class="ttc" id="DefaultSettings_8php_html_a8775ad8dc715863ccf18c544d305670a"><div class="ttname"><a href="DefaultSettings_8php.html#a8775ad8dc715863ccf18c544d305670a">$wgFileBlacklist</a></div><div class="ttdeci">$wgFileBlacklist</div><div class="ttdoc">Files with these extensions will never be allowed as uploads. </div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l00874">DefaultSettings.php:874</a></div></div> <div class="ttc" id="hooks_8txt_html_a245ae562529560eee6531450075549b9"><div class="ttname"><a href="hooks_8txt.html#a245ae562529560eee6531450075549b9">$request</a></div><div class="ttdeci">do that in ParserLimitReportFormat instead use this to modify the parameters of the image all existing parser cache entries will be invalid To avoid you ll need to handle that somehow(e.g.with the RejectParserCacheValue hook) because MediaWiki won't do it for you.&$defaults also a ContextSource after deleting those rows but within the same transaction you ll probably need to make sure the header is varied on $request</div><div class="ttdef"><b>Definition:</b> <a href="hooks_8txt_source.html#l02582">hooks.txt:2582</a></div></div> <div class="ttc" id="classApiQueryImageInfo_html_a611c5e450f742dfa90aa802bf5b86c34"><div class="ttname"><a href="classApiQueryImageInfo.html#a611c5e450f742dfa90aa802bf5b86c34">ApiQueryImageInfo\getInfo</a></div><div class="ttdeci">static getInfo($file, $prop, $result, $thumbParams=null, $opts=false)</div><div class="ttdoc">Get result information for an image revision. </div><div class="ttdef"><b>Definition:</b> <a href="ApiQueryImageInfo_8php_source.html#l00375">ApiQueryImageInfo.php:375</a></div></div> <div class="ttc" id="classUploadBase_html_aaf9222d1c1e2cea503ffed7044ee01af"><div class="ttname"><a href="classUploadBase.html#aaf9222d1c1e2cea503ffed7044ee01af">UploadBase\$mLocalFile</a></div><div class="ttdeci">$mLocalFile</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00048">UploadBase.php:48</a></div></div> <div class="ttc" id="classUploadBase_html_a149edc19abce49ba9de3521a7ea14dc8"><div class="ttname"><a href="classUploadBase.html#a149edc19abce49ba9de3521a7ea14dc8">UploadBase\EMPTY_FILE</a></div><div class="ttdeci">const EMPTY_FILE</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00071">UploadBase.php:71</a></div></div> <div class="ttc" id="classTitle_html_ae89bd391627ac34c9f943a1607f15928"><div class="ttname"><a href="classTitle.html#ae89bd391627ac34c9f943a1607f15928">Title\makeTitle</a></div><div class="ttdeci">static makeTitle($ns, $title, $fragment= '', $interwiki= '')</div><div class="ttdoc">Create a new Title from a namespace index and a DB key. </div><div class="ttdef"><b>Definition:</b> <a href="Title_8php_source.html#l00529">Title.php:529</a></div></div> <div class="ttc" id="namespaceMWException_html"><div class="ttname"><a href="namespaceMWException.html">MWException</a></div></div> <div class="ttc" id="classTitle_html_a20fdcacfb6f560717c2036d5113cf228"><div class="ttname"><a href="classTitle.html#a20fdcacfb6f560717c2036d5113cf228">Title\capitalize</a></div><div class="ttdeci">static capitalize($text, $ns=NS_MAIN)</div><div class="ttdoc">Capitalize a text string for a title if it belongs to a namespace that capitalizes. </div><div class="ttdef"><b>Definition:</b> <a href="Title_8php_source.html#l03490">Title.php:3490</a></div></div> <div class="ttc" id="classUploadBase_html_abc8a8f8b5f21f8a5dd84279978f471e1"><div class="ttname"><a href="classUploadBase.html#abc8a8f8b5f21f8a5dd84279978f471e1">UploadBase\getTempPath</a></div><div class="ttdeci">getTempPath()</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l01158">UploadBase.php:1158</a></div></div> <div class="ttc" id="hooks_8txt_html_af0fa32055c317f280a9f115e8eaf592a"><div class="ttname"><a href="hooks_8txt.html#af0fa32055c317f280a9f115e8eaf592a">$user</a></div><div class="ttdeci">please add to it if you re going to add events to the MediaWiki code where normally authentication against an external auth plugin would be creating a local account $user</div><div class="ttdef"><b>Definition:</b> <a href="hooks_8txt_source.html#l00244">hooks.txt:244</a></div></div> <div class="ttc" id="classUploadBase_html_ac4c983c0bf5a4b1ade041fcb17d54339"><div class="ttname"><a href="classUploadBase.html#ac4c983c0bf5a4b1ade041fcb17d54339">UploadBase\checkLocalFileWasDeleted</a></div><div class="ttdeci">checkLocalFileWasDeleted(LocalFile $localFile)</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00786">UploadBase.php:786</a></div></div> <div class="ttc" id="classUploadBase_html_ad537badf14243a64cb5331bafd563244"><div class="ttname"><a href="classUploadBase.html#ad537badf14243a64cb5331bafd563244">UploadBase\getRealPath</a></div><div class="ttdeci">getRealPath($srcPath)</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00301">UploadBase.php:301</a></div></div> <div class="ttc" id="classUploadBase_html_a1b77c2db3cddd7ad587aed7464524301"><div class="ttname"><a href="classUploadBase.html#a1b77c2db3cddd7ad587aed7464524301">UploadBase\initializePathInfo</a></div><div class="ttdeci">initializePathInfo($name, $tempPath, $fileSize, $removeTempFile=false)</div><div class="ttdoc">Initialize the path information. </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00231">UploadBase.php:231</a></div></div> <div class="ttc" id="namespaceUser_html"><div class="ttname"><a href="namespaceUser.html">User</a></div></div> <div class="ttc" id="classUploadBase_html_af6c491d0a6ef8295e6030d1ca60dcbcc"><div class="ttname"><a href="classUploadBase.html#af6c491d0a6ef8295e6030d1ca60dcbcc">UploadBase\checkOverwrite</a></div><div class="ttdeci">checkOverwrite($user)</div><div class="ttdoc">Check if there's an overwrite conflict and, if so, if restrictions forbid this user from performing t...</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l01938">UploadBase.php:1938</a></div></div> <div class="ttc" id="DefaultSettings_8php_html_a01c3b237a8adaa3513c952ea52cf6410"><div class="ttname"><a href="DefaultSettings_8php.html#a01c3b237a8adaa3513c952ea52cf6410">$wgAntivirus</a></div><div class="ttdeci">$wgAntivirus</div><div class="ttdoc">Internal name of virus scanner. </div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l01248">DefaultSettings.php:1248</a></div></div> <div class="ttc" id="classUploadBase_html_a76651d9c2b11bd0dc7967c0e5c7e9a35"><div class="ttname"><a href="classUploadBase.html#a76651d9c2b11bd0dc7967c0e5c7e9a35">UploadBase\$mRemoveTempFile</a></div><div class="ttdeci">$mRemoveTempFile</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00045">UploadBase.php:45</a></div></div> <div class="ttc" id="NoLocalSettings_8php_html_ae9c29842f430802929abcf142683912c"><div class="ttname"><a href="NoLocalSettings_8php.html#ae9c29842f430802929abcf142683912c">$matches</a></div><div class="ttdeci">$matches</div><div class="ttdef"><b>Definition:</b> <a href="NoLocalSettings_8php_source.html#l00024">NoLocalSettings.php:24</a></div></div> <div class="ttc" id="classUploadBase_html_a40e2f0618fea100cfccce200ec9f2389"><div class="ttname"><a href="classUploadBase.html#a40e2f0618fea100cfccce200ec9f2389">UploadBase\runUploadStashFileHook</a></div><div class="ttdeci">runUploadStashFileHook(User $user)</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l01074">UploadBase.php:1074</a></div></div> </div><!-- fragment --></div><!-- contents --> </div><!-- doc-content --> <!-- start footer part --> <div id="nav-path" class="navpath"><!-- id is needed for treeview function! --> <ul> <li class="navelem"><a class="el" href="dir_b0f92a87ee026d34ca8fad24187d57bf.html">includes</a></li><li class="navelem"><a class="el" href="dir_0b10f6acd4741c83db7478a14749b164.html">upload</a></li><li class="navelem"><a class="el" href="UploadBase_8php.html">UploadBase.php</a></li> <li class="footer">Generated on Sat Oct 21 2017 00:32:32 for MediaWiki by <a href="http://www.doxygen.org/index.html"> <img class="footer" src="doxygen.png" alt="doxygen"/></a> 1.8.8 </li> </ul> </div> </body> </html>