MediaWiki  master
UploadBase.php
Go to the documentation of this file.
1 <?php
38 abstract class UploadBase {
40  protected $mTempPath;
42  protected $tempFileObj;
43 
45  protected $mTitle = false, $mTitleError = 0;
50 
51  protected static $safeXmlEncodings = [
52  'UTF-8',
53  'ISO-8859-1',
54  'ISO-8859-2',
55  'UTF-16',
56  'UTF-32',
57  'WINDOWS-1250',
58  'WINDOWS-1251',
59  'WINDOWS-1252',
60  'WINDOWS-1253',
61  'WINDOWS-1254',
62  'WINDOWS-1255',
63  'WINDOWS-1256',
64  'WINDOWS-1257',
65  'WINDOWS-1258',
66  ];
67 
68  const SUCCESS = 0;
69  const OK = 0;
70  const EMPTY_FILE = 3;
72  const ILLEGAL_FILENAME = 5;
73  const OVERWRITE_EXISTING_FILE = 7; # Not used anymore; handled by verifyTitlePermissions()
74  const FILETYPE_MISSING = 8;
75  const FILETYPE_BADTYPE = 9;
76  const VERIFICATION_ERROR = 10;
77  const HOOK_ABORTED = 11;
78  const FILE_TOO_LARGE = 12;
80  const FILENAME_TOO_LONG = 14;
81 
87  $code_to_status = [
88  self::EMPTY_FILE => 'empty-file',
89  self::FILE_TOO_LARGE => 'file-too-large',
90  self::FILETYPE_MISSING => 'filetype-missing',
91  self::FILETYPE_BADTYPE => 'filetype-banned',
92  self::MIN_LENGTH_PARTNAME => 'filename-tooshort',
93  self::ILLEGAL_FILENAME => 'illegal-filename',
94  self::OVERWRITE_EXISTING_FILE => 'overwrite',
95  self::VERIFICATION_ERROR => 'verification-error',
96  self::HOOK_ABORTED => 'hookaborted',
97  self::WINDOWS_NONASCII_FILENAME => 'windows-nonascii-filename',
98  self::FILENAME_TOO_LONG => 'filename-toolong',
99  ];
100  if ( isset( $code_to_status[$error] ) ) {
101  return $code_to_status[$error];
102  }
103 
104  return 'unknown-error';
105  }
106 
112  public static function isEnabled() {
114 
115  if ( !$wgEnableUploads ) {
116  return false;
117  }
118 
119  # Check php's file_uploads setting
120  return wfIsHHVM() || wfIniGetBool( 'file_uploads' );
121  }
122 
131  public static function isAllowed( $user ) {
132  foreach ( [ 'upload', 'edit' ] as $permission ) {
133  if ( !$user->isAllowed( $permission ) ) {
134  return $permission;
135  }
136  }
137 
138  return true;
139  }
140 
147  public static function isThrottled( $user ) {
148  return $user->pingLimiter( 'upload' );
149  }
150 
151  // Upload handlers. Should probably just be a global.
152  private static $uploadHandlers = [ 'Stash', 'File', 'Url' ];
153 
161  public static function createFromRequest( &$request, $type = null ) {
162  $type = $type ? $type : $request->getVal( 'wpSourceType', 'File' );
163 
164  if ( !$type ) {
165  return null;
166  }
167 
168  // Get the upload class
169  $type = ucfirst( $type );
170 
171  // Give hooks the chance to handle this request
172  $className = null;
173  Hooks::run( 'UploadCreateFromRequest', [ $type, &$className ] );
174  if ( is_null( $className ) ) {
175  $className = 'UploadFrom' . $type;
176  wfDebug( __METHOD__ . ": class name: $className\n" );
177  if ( !in_array( $type, self::$uploadHandlers ) ) {
178  return null;
179  }
180  }
181 
182  // Check whether this upload class is enabled
183  if ( !call_user_func( [ $className, 'isEnabled' ] ) ) {
184  return null;
185  }
186 
187  // Check whether the request is valid
188  if ( !call_user_func( [ $className, 'isValidRequest' ], $request ) ) {
189  return null;
190  }
191 
193  $handler = new $className;
194 
195  $handler->initializeFromRequest( $request );
196 
197  return $handler;
198  }
199 
205  public static function isValidRequest( $request ) {
206  return false;
207  }
208 
209  public function __construct() {
210  }
211 
218  public function getSourceType() {
219  return null;
220  }
221 
230  public function initializePathInfo( $name, $tempPath, $fileSize, $removeTempFile = false ) {
231  $this->mDesiredDestName = $name;
232  if ( FileBackend::isStoragePath( $tempPath ) ) {
233  throw new MWException( __METHOD__ . " given storage path `$tempPath`." );
234  }
235 
236  $this->setTempFile( $tempPath, $fileSize );
237  $this->mRemoveTempFile = $removeTempFile;
238  }
239 
245  abstract public function initializeFromRequest( &$request );
246 
251  protected function setTempFile( $tempPath, $fileSize = null ) {
252  $this->mTempPath = $tempPath;
253  $this->mFileSize = $fileSize ?: null;
254  if ( strlen( $this->mTempPath ) && file_exists( $this->mTempPath ) ) {
255  $this->tempFileObj = new TempFSFile( $this->mTempPath );
256  if ( !$fileSize ) {
257  $this->mFileSize = filesize( $this->mTempPath );
258  }
259  } else {
260  $this->tempFileObj = null;
261  }
262  }
263 
268  public function fetchFile() {
269  return Status::newGood();
270  }
271 
276  public function isEmptyFile() {
277  return empty( $this->mFileSize );
278  }
279 
284  public function getFileSize() {
285  return $this->mFileSize;
286  }
287 
292  public function getTempFileSha1Base36() {
293  return FSFile::getSha1Base36FromPath( $this->mTempPath );
294  }
295 
300  function getRealPath( $srcPath ) {
301  $repo = RepoGroup::singleton()->getLocalRepo();
302  if ( $repo->isVirtualUrl( $srcPath ) ) {
306  $tmpFile = $repo->getLocalCopy( $srcPath );
307  if ( $tmpFile ) {
308  $tmpFile->bind( $this ); // keep alive with $this
309  }
310  $path = $tmpFile ? $tmpFile->getPath() : false;
311  } else {
312  $path = $srcPath;
313  }
314 
315  return $path;
316  }
317 
322  public function verifyUpload() {
323 
327  if ( $this->isEmptyFile() ) {
328  return [ 'status' => self::EMPTY_FILE ];
329  }
330 
334  $maxSize = self::getMaxUploadSize( $this->getSourceType() );
335  if ( $this->mFileSize > $maxSize ) {
336  return [
337  'status' => self::FILE_TOO_LARGE,
338  'max' => $maxSize,
339  ];
340  }
341 
347  $verification = $this->verifyFile();
348  if ( $verification !== true ) {
349  return [
350  'status' => self::VERIFICATION_ERROR,
351  'details' => $verification
352  ];
353  }
354 
358  $result = $this->validateName();
359  if ( $result !== true ) {
360  return $result;
361  }
362 
363  $error = '';
364  if ( !Hooks::run( 'UploadVerification',
365  [ $this->mDestName, $this->mTempPath, &$error ], '1.28' )
366  ) {
367  return [ 'status' => self::HOOK_ABORTED, 'error' => $error ];
368  }
369 
370  return [ 'status' => self::OK ];
371  }
372 
379  public function validateName() {
380  $nt = $this->getTitle();
381  if ( is_null( $nt ) ) {
382  $result = [ 'status' => $this->mTitleError ];
383  if ( $this->mTitleError == self::ILLEGAL_FILENAME ) {
384  $result['filtered'] = $this->mFilteredName;
385  }
386  if ( $this->mTitleError == self::FILETYPE_BADTYPE ) {
387  $result['finalExt'] = $this->mFinalExtension;
388  if ( count( $this->mBlackListedExtensions ) ) {
389  $result['blacklistedExt'] = $this->mBlackListedExtensions;
390  }
391  }
392 
393  return $result;
394  }
395  $this->mDestName = $this->getLocalFile()->getName();
396 
397  return true;
398  }
399 
409  protected function verifyMimeType( $mime ) {
411  if ( $wgVerifyMimeType ) {
412  wfDebug( "mime: <$mime> extension: <{$this->mFinalExtension}>\n" );
414  if ( $this->checkFileExtension( $mime, $wgMimeTypeBlacklist ) ) {
415  return [ 'filetype-badmime', $mime ];
416  }
417 
418  # Check what Internet Explorer would detect
419  $fp = fopen( $this->mTempPath, 'rb' );
420  $chunk = fread( $fp, 256 );
421  fclose( $fp );
422 
423  $magic = MimeMagic::singleton();
424  $extMime = $magic->guessTypesForExtension( $this->mFinalExtension );
425  $ieTypes = $magic->getIEMimeTypes( $this->mTempPath, $chunk, $extMime );
426  foreach ( $ieTypes as $ieType ) {
427  if ( $this->checkFileExtension( $ieType, $wgMimeTypeBlacklist ) ) {
428  return [ 'filetype-bad-ie-mime', $ieType ];
429  }
430  }
431  }
432 
433  return true;
434  }
435 
441  protected function verifyFile() {
443 
444  $status = $this->verifyPartialFile();
445  if ( $status !== true ) {
446  return $status;
447  }
448 
449  $mwProps = new MWFileProps( MimeMagic::singleton() );
450  $this->mFileProps = $mwProps->getPropsFromPath( $this->mTempPath, $this->mFinalExtension );
451  $mime = $this->mFileProps['mime'];
452 
453  if ( $wgVerifyMimeType ) {
454  # XXX: Missing extension will be caught by validateName() via getTitle()
455  if ( $this->mFinalExtension != '' && !$this->verifyExtension( $mime, $this->mFinalExtension ) ) {
456  return [ 'filetype-mime-mismatch', $this->mFinalExtension, $mime ];
457  }
458  }
459 
460  # check for htmlish code and javascript
461  if ( !$wgDisableUploadScriptChecks ) {
462  if ( $this->mFinalExtension == 'svg' || $mime == 'image/svg+xml' ) {
463  $svgStatus = $this->detectScriptInSvg( $this->mTempPath, false );
464  if ( $svgStatus !== false ) {
465  return $svgStatus;
466  }
467  }
468  }
469 
471  if ( $handler ) {
472  $handlerStatus = $handler->verifyUpload( $this->mTempPath );
473  if ( !$handlerStatus->isOK() ) {
474  $errors = $handlerStatus->getErrorsArray();
475 
476  return reset( $errors );
477  }
478  }
479 
480  $error = true;
481  Hooks::run( 'UploadVerifyFile', [ $this, $mime, &$error ] );
482  if ( $error !== true ) {
483  if ( !is_array( $error ) ) {
484  $error = [ $error ];
485  }
486  return $error;
487  }
488 
489  wfDebug( __METHOD__ . ": all clear; passing.\n" );
490 
491  return true;
492  }
493 
502  protected function verifyPartialFile() {
504 
505  # getTitle() sets some internal parameters like $this->mFinalExtension
506  $this->getTitle();
507 
508  $mwProps = new MWFileProps( MimeMagic::singleton() );
509  $this->mFileProps = $mwProps->getPropsFromPath( $this->mTempPath, $this->mFinalExtension );
510 
511  # check MIME type, if desired
512  $mime = $this->mFileProps['file-mime'];
513  $status = $this->verifyMimeType( $mime );
514  if ( $status !== true ) {
515  return $status;
516  }
517 
518  # check for htmlish code and javascript
519  if ( !$wgDisableUploadScriptChecks ) {
520  if ( self::detectScript( $this->mTempPath, $mime, $this->mFinalExtension ) ) {
521  return [ 'uploadscripted' ];
522  }
523  if ( $this->mFinalExtension == 'svg' || $mime == 'image/svg+xml' ) {
524  $svgStatus = $this->detectScriptInSvg( $this->mTempPath, true );
525  if ( $svgStatus !== false ) {
526  return $svgStatus;
527  }
528  }
529  }
530 
531  # Check for Java applets, which if uploaded can bypass cross-site
532  # restrictions.
533  if ( !$wgAllowJavaUploads ) {
534  $this->mJavaDetected = false;
535  $zipStatus = ZipDirectoryReader::read( $this->mTempPath,
536  [ $this, 'zipEntryCallback' ] );
537  if ( !$zipStatus->isOK() ) {
538  $errors = $zipStatus->getErrorsArray();
539  $error = reset( $errors );
540  if ( $error[0] !== 'zip-wrong-format' ) {
541  return $error;
542  }
543  }
544  if ( $this->mJavaDetected ) {
545  return [ 'uploadjava' ];
546  }
547  }
548 
549  # Scan the uploaded file for viruses
550  $virus = $this->detectVirus( $this->mTempPath );
551  if ( $virus ) {
552  return [ 'uploadvirus', $virus ];
553  }
554 
555  return true;
556  }
557 
563  function zipEntryCallback( $entry ) {
564  $names = [ $entry['name'] ];
565 
566  // If there is a null character, cut off the name at it, because JDK's
567  // ZIP_GetEntry() uses strcmp() if the name hashes match. If a file name
568  // were constructed which had ".class\0" followed by a string chosen to
569  // make the hash collide with the truncated name, that file could be
570  // returned in response to a request for the .class file.
571  $nullPos = strpos( $entry['name'], "\000" );
572  if ( $nullPos !== false ) {
573  $names[] = substr( $entry['name'], 0, $nullPos );
574  }
575 
576  // If there is a trailing slash in the file name, we have to strip it,
577  // because that's what ZIP_GetEntry() does.
578  if ( preg_grep( '!\.class/?$!', $names ) ) {
579  $this->mJavaDetected = true;
580  }
581  }
582 
592  public function verifyPermissions( $user ) {
593  return $this->verifyTitlePermissions( $user );
594  }
595 
607  public function verifyTitlePermissions( $user ) {
612  $nt = $this->getTitle();
613  if ( is_null( $nt ) ) {
614  return true;
615  }
616  $permErrors = $nt->getUserPermissionsErrors( 'edit', $user );
617  $permErrorsUpload = $nt->getUserPermissionsErrors( 'upload', $user );
618  if ( !$nt->exists() ) {
619  $permErrorsCreate = $nt->getUserPermissionsErrors( 'create', $user );
620  } else {
621  $permErrorsCreate = [];
622  }
623  if ( $permErrors || $permErrorsUpload || $permErrorsCreate ) {
624  $permErrors = array_merge( $permErrors, wfArrayDiff2( $permErrorsUpload, $permErrors ) );
625  $permErrors = array_merge( $permErrors, wfArrayDiff2( $permErrorsCreate, $permErrors ) );
626 
627  return $permErrors;
628  }
629 
630  $overwriteError = $this->checkOverwrite( $user );
631  if ( $overwriteError !== true ) {
632  return [ $overwriteError ];
633  }
634 
635  return true;
636  }
637 
645  public function checkWarnings() {
646  global $wgLang;
647 
648  $warnings = [];
649 
650  $localFile = $this->getLocalFile();
651  $localFile->load( File::READ_LATEST );
652  $filename = $localFile->getName();
653 
658  $comparableName = str_replace( ' ', '_', $this->mDesiredDestName );
659  $comparableName = Title::capitalize( $comparableName, NS_FILE );
660 
661  if ( $this->mDesiredDestName != $filename && $comparableName != $filename ) {
662  $warnings['badfilename'] = $filename;
663  }
664 
665  // Check whether the file extension is on the unwanted list
667  if ( $wgCheckFileExtensions ) {
668  $extensions = array_unique( $wgFileExtensions );
669  if ( !$this->checkFileExtension( $this->mFinalExtension, $extensions ) ) {
670  $warnings['filetype-unwanted-type'] = [ $this->mFinalExtension,
671  $wgLang->commaList( $extensions ), count( $extensions ) ];
672  }
673  }
674 
676  if ( $wgUploadSizeWarning && ( $this->mFileSize > $wgUploadSizeWarning ) ) {
677  $warnings['large-file'] = [ $wgUploadSizeWarning, $this->mFileSize ];
678  }
679 
680  if ( $this->mFileSize == 0 ) {
681  $warnings['empty-file'] = true;
682  }
683 
684  $hash = $this->getTempFileSha1Base36();
685  $exists = self::getExistsWarning( $localFile );
686  if ( $exists !== false ) {
687  $warnings['exists'] = $exists;
688 
689  // check if file is an exact duplicate of current file version
690  if ( $hash === $localFile->getSha1() ) {
691  $warnings['no-change'] = $localFile;
692  }
693 
694  // check if file is an exact duplicate of older versions of this file
695  $history = $localFile->getHistory();
696  foreach ( $history as $oldFile ) {
697  if ( $hash === $oldFile->getSha1() ) {
698  $warnings['duplicate-version'][] = $oldFile;
699  }
700  }
701  }
702 
703  if ( $localFile->wasDeleted() && !$localFile->exists() ) {
704  $warnings['was-deleted'] = $filename;
705  }
706 
707  // Check dupes against existing files
708  $dupes = RepoGroup::singleton()->findBySha1( $hash );
709  $title = $this->getTitle();
710  // Remove all matches against self
711  foreach ( $dupes as $key => $dupe ) {
712  if ( $title->equals( $dupe->getTitle() ) ) {
713  unset( $dupes[$key] );
714  }
715  }
716  if ( $dupes ) {
717  $warnings['duplicate'] = $dupes;
718  }
719 
720  // Check dupes against archives
721  $archivedFile = new ArchivedFile( null, 0, '', $hash );
722  if ( $archivedFile->getID() > 0 ) {
723  if ( $archivedFile->userCan( File::DELETED_FILE ) ) {
724  $warnings['duplicate-archive'] = $archivedFile->getName();
725  } else {
726  $warnings['duplicate-archive'] = '';
727  }
728  }
729 
730  return $warnings;
731  }
732 
746  public function performUpload( $comment, $pageText, $watch, $user, $tags = [] ) {
747  $this->getLocalFile()->load( File::READ_LATEST );
748  $props = $this->mFileProps;
749 
750  $error = null;
751  Hooks::run( 'UploadVerifyUpload', [ $this, $user, $props, $comment, $pageText, &$error ] );
752  if ( $error ) {
753  if ( !is_array( $error ) ) {
754  $error = [ $error ];
755  }
756  return call_user_func_array( 'Status::newFatal', $error );
757  }
758 
759  $status = $this->getLocalFile()->upload(
760  $this->mTempPath,
761  $comment,
762  $pageText,
764  $props,
765  false,
766  $user,
767  $tags
768  );
769 
770  if ( $status->isGood() ) {
771  if ( $watch ) {
773  $this->getLocalFile()->getTitle(),
774  $user,
776  );
777  }
778  Hooks::run( 'UploadComplete', [ &$this ] );
779 
780  $this->postProcessUpload();
781  }
782 
783  return $status;
784  }
785 
791  public function postProcessUpload() {
792  }
793 
800  public function getTitle() {
801  if ( $this->mTitle !== false ) {
802  return $this->mTitle;
803  }
804  if ( !is_string( $this->mDesiredDestName ) ) {
805  $this->mTitleError = self::ILLEGAL_FILENAME;
806  $this->mTitle = null;
807 
808  return $this->mTitle;
809  }
810  /* Assume that if a user specified File:Something.jpg, this is an error
811  * and that the namespace prefix needs to be stripped of.
812  */
813  $title = Title::newFromText( $this->mDesiredDestName );
814  if ( $title && $title->getNamespace() == NS_FILE ) {
815  $this->mFilteredName = $title->getDBkey();
816  } else {
817  $this->mFilteredName = $this->mDesiredDestName;
818  }
819 
820  # oi_archive_name is max 255 bytes, which include a timestamp and an
821  # exclamation mark, so restrict file name to 240 bytes.
822  if ( strlen( $this->mFilteredName ) > 240 ) {
823  $this->mTitleError = self::FILENAME_TOO_LONG;
824  $this->mTitle = null;
825 
826  return $this->mTitle;
827  }
828 
834  $this->mFilteredName = wfStripIllegalFilenameChars( $this->mFilteredName );
835  /* Normalize to title form before we do any further processing */
836  $nt = Title::makeTitleSafe( NS_FILE, $this->mFilteredName );
837  if ( is_null( $nt ) ) {
838  $this->mTitleError = self::ILLEGAL_FILENAME;
839  $this->mTitle = null;
840 
841  return $this->mTitle;
842  }
843  $this->mFilteredName = $nt->getDBkey();
844 
849  list( $partname, $ext ) = $this->splitExtensions( $this->mFilteredName );
850 
851  if ( count( $ext ) ) {
852  $this->mFinalExtension = trim( $ext[count( $ext ) - 1] );
853  } else {
854  $this->mFinalExtension = '';
855 
856  # No extension, try guessing one
857  $magic = MimeMagic::singleton();
858  $mime = $magic->guessMimeType( $this->mTempPath );
859  if ( $mime !== 'unknown/unknown' ) {
860  # Get a space separated list of extensions
861  $extList = $magic->getExtensionsForType( $mime );
862  if ( $extList ) {
863  # Set the extension to the canonical extension
864  $this->mFinalExtension = strtok( $extList, ' ' );
865 
866  # Fix up the other variables
867  $this->mFilteredName .= ".{$this->mFinalExtension}";
868  $nt = Title::makeTitleSafe( NS_FILE, $this->mFilteredName );
870  }
871  }
872  }
873 
874  /* Don't allow users to override the blacklist (check file extension) */
877 
878  $blackListedExtensions = $this->checkFileExtensionList( $ext, $wgFileBlacklist );
879 
880  if ( $this->mFinalExtension == '' ) {
881  $this->mTitleError = self::FILETYPE_MISSING;
882  $this->mTitle = null;
883 
884  return $this->mTitle;
885  } elseif ( $blackListedExtensions ||
886  ( $wgCheckFileExtensions && $wgStrictFileExtensions &&
887  !$this->checkFileExtension( $this->mFinalExtension, $wgFileExtensions ) )
888  ) {
889  $this->mBlackListedExtensions = $blackListedExtensions;
890  $this->mTitleError = self::FILETYPE_BADTYPE;
891  $this->mTitle = null;
892 
893  return $this->mTitle;
894  }
895 
896  // Windows may be broken with special characters, see bug 1780
897  if ( !preg_match( '/^[\x0-\x7f]*$/', $nt->getText() )
898  && !RepoGroup::singleton()->getLocalRepo()->backendSupportsUnicodePaths()
899  ) {
900  $this->mTitleError = self::WINDOWS_NONASCII_FILENAME;
901  $this->mTitle = null;
902 
903  return $this->mTitle;
904  }
905 
906  # If there was more than one "extension", reassemble the base
907  # filename to prevent bogus complaints about length
908  if ( count( $ext ) > 1 ) {
909  $iterations = count( $ext ) - 1;
910  for ( $i = 0; $i < $iterations; $i++ ) {
911  $partname .= '.' . $ext[$i];
912  }
913  }
914 
915  if ( strlen( $partname ) < 1 ) {
916  $this->mTitleError = self::MIN_LENGTH_PARTNAME;
917  $this->mTitle = null;
918 
919  return $this->mTitle;
920  }
921 
922  $this->mTitle = $nt;
923 
924  return $this->mTitle;
925  }
926 
932  public function getLocalFile() {
933  if ( is_null( $this->mLocalFile ) ) {
934  $nt = $this->getTitle();
935  $this->mLocalFile = is_null( $nt ) ? null : wfLocalFile( $nt );
936  }
937 
938  return $this->mLocalFile;
939  }
940 
944  public function getStashFile() {
945  return $this->mStashFile;
946  }
947 
959  public function tryStashFile( User $user, $isPartial = false ) {
960  if ( !$isPartial ) {
961  $error = $this->runUploadStashFileHook( $user );
962  if ( $error ) {
963  return call_user_func_array( 'Status::newFatal', $error );
964  }
965  }
966  try {
967  $file = $this->doStashFile( $user );
968  return Status::newGood( $file );
969  } catch ( UploadStashException $e ) {
970  return Status::newFatal( 'uploadstash-exception', get_class( $e ), $e->getMessage() );
971  }
972  }
973 
978  protected function runUploadStashFileHook( User $user ) {
979  $props = $this->mFileProps;
980  $error = null;
981  Hooks::run( 'UploadStashFile', [ $this, $user, $props, &$error ] );
982  if ( $error ) {
983  if ( !is_array( $error ) ) {
984  $error = [ $error ];
985  }
986  }
987  return $error;
988  }
989 
1009  public function stashFile( User $user = null ) {
1010  return $this->doStashFile( $user );
1011  }
1012 
1019  protected function doStashFile( User $user = null ) {
1020  $stash = RepoGroup::singleton()->getLocalRepo()->getUploadStash( $user );
1021  $file = $stash->stashFile( $this->mTempPath, $this->getSourceType() );
1022  $this->mStashFile = $file;
1023 
1024  return $file;
1025  }
1026 
1034  public function stashFileGetKey() {
1035  wfDeprecated( __METHOD__, '1.28' );
1036  return $this->doStashFile()->getFileKey();
1037  }
1038 
1045  public function stashSession() {
1046  wfDeprecated( __METHOD__, '1.28' );
1047  return $this->doStashFile()->getFileKey();
1048  }
1049 
1054  public function cleanupTempFile() {
1055  if ( $this->mRemoveTempFile && $this->tempFileObj ) {
1056  // Delete when all relevant TempFSFile handles go out of scope
1057  wfDebug( __METHOD__ . ": Marked temporary file '{$this->mTempPath}' for removal\n" );
1058  $this->tempFileObj->autocollect();
1059  }
1060  }
1061 
1062  public function getTempPath() {
1063  return $this->mTempPath;
1064  }
1065 
1075  public static function splitExtensions( $filename ) {
1076  $bits = explode( '.', $filename );
1077  $basename = array_shift( $bits );
1078 
1079  return [ $basename, $bits ];
1080  }
1081 
1090  public static function checkFileExtension( $ext, $list ) {
1091  return in_array( strtolower( $ext ), $list );
1092  }
1093 
1102  public static function checkFileExtensionList( $ext, $list ) {
1103  return array_intersect( array_map( 'strtolower', $ext ), $list );
1104  }
1105 
1113  public static function verifyExtension( $mime, $extension ) {
1114  $magic = MimeMagic::singleton();
1115 
1116  if ( !$mime || $mime == 'unknown' || $mime == 'unknown/unknown' ) {
1117  if ( !$magic->isRecognizableExtension( $extension ) ) {
1118  wfDebug( __METHOD__ . ": passing file with unknown detected mime type; " .
1119  "unrecognized extension '$extension', can't verify\n" );
1120 
1121  return true;
1122  } else {
1123  wfDebug( __METHOD__ . ": rejecting file with unknown detected mime type; " .
1124  "recognized extension '$extension', so probably invalid file\n" );
1125 
1126  return false;
1127  }
1128  }
1129 
1130  $match = $magic->isMatchingExtension( $extension, $mime );
1131 
1132  if ( $match === null ) {
1133  if ( $magic->getTypesForExtension( $extension ) !== null ) {
1134  wfDebug( __METHOD__ . ": No extension known for $mime, but we know a mime for $extension\n" );
1135 
1136  return false;
1137  } else {
1138  wfDebug( __METHOD__ . ": no file extension known for mime type $mime, passing file\n" );
1139 
1140  return true;
1141  }
1142  } elseif ( $match === true ) {
1143  wfDebug( __METHOD__ . ": mime type $mime matches extension $extension, passing file\n" );
1144 
1146  return true;
1147  } else {
1148  wfDebug( __METHOD__
1149  . ": mime type $mime mismatches file extension $extension, rejecting file\n" );
1150 
1151  return false;
1152  }
1153  }
1154 
1166  public static function detectScript( $file, $mime, $extension ) {
1168 
1169  # ugly hack: for text files, always look at the entire file.
1170  # For binary field, just check the first K.
1171 
1172  if ( strpos( $mime, 'text/' ) === 0 ) {
1173  $chunk = file_get_contents( $file );
1174  } else {
1175  $fp = fopen( $file, 'rb' );
1176  $chunk = fread( $fp, 1024 );
1177  fclose( $fp );
1178  }
1179 
1180  $chunk = strtolower( $chunk );
1181 
1182  if ( !$chunk ) {
1183  return false;
1184  }
1185 
1186  # decode from UTF-16 if needed (could be used for obfuscation).
1187  if ( substr( $chunk, 0, 2 ) == "\xfe\xff" ) {
1188  $enc = 'UTF-16BE';
1189  } elseif ( substr( $chunk, 0, 2 ) == "\xff\xfe" ) {
1190  $enc = 'UTF-16LE';
1191  } else {
1192  $enc = null;
1193  }
1194 
1195  if ( $enc ) {
1196  $chunk = iconv( $enc, "ASCII//IGNORE", $chunk );
1197  }
1198 
1199  $chunk = trim( $chunk );
1200 
1202  wfDebug( __METHOD__ . ": checking for embedded scripts and HTML stuff\n" );
1203 
1204  # check for HTML doctype
1205  if ( preg_match( "/<!DOCTYPE *X?HTML/i", $chunk ) ) {
1206  return true;
1207  }
1208 
1209  // Some browsers will interpret obscure xml encodings as UTF-8, while
1210  // PHP/expat will interpret the given encoding in the xml declaration (bug 47304)
1211  if ( $extension == 'svg' || strpos( $mime, 'image/svg' ) === 0 ) {
1212  if ( self::checkXMLEncodingMissmatch( $file ) ) {
1213  return true;
1214  }
1215  }
1216 
1232  $tags = [
1233  '<a href',
1234  '<body',
1235  '<head',
1236  '<html', # also in safari
1237  '<img',
1238  '<pre',
1239  '<script', # also in safari
1240  '<table'
1241  ];
1242 
1243  if ( !$wgAllowTitlesInSVG && $extension !== 'svg' && $mime !== 'image/svg' ) {
1244  $tags[] = '<title';
1245  }
1246 
1247  foreach ( $tags as $tag ) {
1248  if ( false !== strpos( $chunk, $tag ) ) {
1249  wfDebug( __METHOD__ . ": found something that may make it be mistaken for html: $tag\n" );
1250 
1251  return true;
1252  }
1253  }
1254 
1255  /*
1256  * look for JavaScript
1257  */
1258 
1259  # resolve entity-refs to look at attributes. may be harsh on big files... cache result?
1260  $chunk = Sanitizer::decodeCharReferences( $chunk );
1261 
1262  # look for script-types
1263  if ( preg_match( '!type\s*=\s*[\'"]?\s*(?:\w*/)?(?:ecma|java)!sim', $chunk ) ) {
1264  wfDebug( __METHOD__ . ": found script types\n" );
1265 
1266  return true;
1267  }
1268 
1269  # look for html-style script-urls
1270  if ( preg_match( '!(?:href|src|data)\s*=\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) ) {
1271  wfDebug( __METHOD__ . ": found html-style script urls\n" );
1272 
1273  return true;
1274  }
1275 
1276  # look for css-style script-urls
1277  if ( preg_match( '!url\s*\(\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) ) {
1278  wfDebug( __METHOD__ . ": found css-style script urls\n" );
1279 
1280  return true;
1281  }
1282 
1283  wfDebug( __METHOD__ . ": no scripts found\n" );
1284 
1285  return false;
1286  }
1287 
1295  public static function checkXMLEncodingMissmatch( $file ) {
1297  $contents = file_get_contents( $file, false, null, -1, $wgSVGMetadataCutoff );
1298  $encodingRegex = '!encoding[ \t\n\r]*=[ \t\n\r]*[\'"](.*?)[\'"]!si';
1299 
1300  if ( preg_match( "!<\?xml\b(.*?)\?>!si", $contents, $matches ) ) {
1301  if ( preg_match( $encodingRegex, $matches[1], $encMatch )
1302  && !in_array( strtoupper( $encMatch[1] ), self::$safeXmlEncodings )
1303  ) {
1304  wfDebug( __METHOD__ . ": Found unsafe XML encoding '{$encMatch[1]}'\n" );
1305 
1306  return true;
1307  }
1308  } elseif ( preg_match( "!<\?xml\b!si", $contents ) ) {
1309  // Start of XML declaration without an end in the first $wgSVGMetadataCutoff
1310  // bytes. There shouldn't be a legitimate reason for this to happen.
1311  wfDebug( __METHOD__ . ": Unmatched XML declaration start\n" );
1312 
1313  return true;
1314  } elseif ( substr( $contents, 0, 4 ) == "\x4C\x6F\xA7\x94" ) {
1315  // EBCDIC encoded XML
1316  wfDebug( __METHOD__ . ": EBCDIC Encoded XML\n" );
1317 
1318  return true;
1319  }
1320 
1321  // It's possible the file is encoded with multi-byte encoding, so re-encode attempt to
1322  // detect the encoding in case is specifies an encoding not whitelisted in self::$safeXmlEncodings
1323  $attemptEncodings = [ 'UTF-16', 'UTF-16BE', 'UTF-32', 'UTF-32BE' ];
1324  foreach ( $attemptEncodings as $encoding ) {
1325  MediaWiki\suppressWarnings();
1326  $str = iconv( $encoding, 'UTF-8', $contents );
1327  MediaWiki\restoreWarnings();
1328  if ( $str != '' && preg_match( "!<\?xml\b(.*?)\?>!si", $str, $matches ) ) {
1329  if ( preg_match( $encodingRegex, $matches[1], $encMatch )
1330  && !in_array( strtoupper( $encMatch[1] ), self::$safeXmlEncodings )
1331  ) {
1332  wfDebug( __METHOD__ . ": Found unsafe XML encoding '{$encMatch[1]}'\n" );
1333 
1334  return true;
1335  }
1336  } elseif ( $str != '' && preg_match( "!<\?xml\b!si", $str ) ) {
1337  // Start of XML declaration without an end in the first $wgSVGMetadataCutoff
1338  // bytes. There shouldn't be a legitimate reason for this to happen.
1339  wfDebug( __METHOD__ . ": Unmatched XML declaration start\n" );
1340 
1341  return true;
1342  }
1343  }
1344 
1345  return false;
1346  }
1347 
1353  protected function detectScriptInSvg( $filename, $partial ) {
1354  $this->mSVGNSError = false;
1355  $check = new XmlTypeCheck(
1356  $filename,
1357  [ $this, 'checkSvgScriptCallback' ],
1358  true,
1359  [ 'processing_instruction_handler' => 'UploadBase::checkSvgPICallback' ]
1360  );
1361  if ( $check->wellFormed !== true ) {
1362  // Invalid xml (bug 58553)
1363  // But only when non-partial (bug 65724)
1364  return $partial ? false : [ 'uploadinvalidxml' ];
1365  } elseif ( $check->filterMatch ) {
1366  if ( $this->mSVGNSError ) {
1367  return [ 'uploadscriptednamespace', $this->mSVGNSError ];
1368  }
1369 
1370  return $check->filterMatchType;
1371  }
1372 
1373  return false;
1374  }
1375 
1382  public static function checkSvgPICallback( $target, $data ) {
1383  // Don't allow external stylesheets (bug 57550)
1384  if ( preg_match( '/xml-stylesheet/i', $target ) ) {
1385  return [ 'upload-scripted-pi-callback' ];
1386  }
1387 
1388  return false;
1389  }
1390 
1397  public function checkSvgScriptCallback( $element, $attribs, $data = null ) {
1398 
1399  list( $namespace, $strippedElement ) = $this->splitXmlNamespace( $element );
1400 
1401  // We specifically don't include:
1402  // http://www.w3.org/1999/xhtml (bug 60771)
1403  static $validNamespaces = [
1404  '',
1405  'adobe:ns:meta/',
1406  'http://creativecommons.org/ns#',
1407  'http://inkscape.sourceforge.net/dtd/sodipodi-0.dtd',
1408  'http://ns.adobe.com/adobeillustrator/10.0/',
1409  'http://ns.adobe.com/adobesvgviewerextensions/3.0/',
1410  'http://ns.adobe.com/extensibility/1.0/',
1411  'http://ns.adobe.com/flows/1.0/',
1412  'http://ns.adobe.com/illustrator/1.0/',
1413  'http://ns.adobe.com/imagereplacement/1.0/',
1414  'http://ns.adobe.com/pdf/1.3/',
1415  'http://ns.adobe.com/photoshop/1.0/',
1416  'http://ns.adobe.com/saveforweb/1.0/',
1417  'http://ns.adobe.com/variables/1.0/',
1418  'http://ns.adobe.com/xap/1.0/',
1419  'http://ns.adobe.com/xap/1.0/g/',
1420  'http://ns.adobe.com/xap/1.0/g/img/',
1421  'http://ns.adobe.com/xap/1.0/mm/',
1422  'http://ns.adobe.com/xap/1.0/rights/',
1423  'http://ns.adobe.com/xap/1.0/stype/dimensions#',
1424  'http://ns.adobe.com/xap/1.0/stype/font#',
1425  'http://ns.adobe.com/xap/1.0/stype/manifestitem#',
1426  'http://ns.adobe.com/xap/1.0/stype/resourceevent#',
1427  'http://ns.adobe.com/xap/1.0/stype/resourceref#',
1428  'http://ns.adobe.com/xap/1.0/t/pg/',
1429  'http://purl.org/dc/elements/1.1/',
1430  'http://purl.org/dc/elements/1.1',
1431  'http://schemas.microsoft.com/visio/2003/svgextensions/',
1432  'http://sodipodi.sourceforge.net/dtd/sodipodi-0.dtd',
1433  'http://taptrix.com/inkpad/svg_extensions',
1434  'http://web.resource.org/cc/',
1435  'http://www.freesoftware.fsf.org/bkchem/cdml',
1436  'http://www.inkscape.org/namespaces/inkscape',
1437  'http://www.opengis.net/gml',
1438  'http://www.w3.org/1999/02/22-rdf-syntax-ns#',
1439  'http://www.w3.org/2000/svg',
1440  'http://www.w3.org/tr/rec-rdf-syntax/',
1441  ];
1442 
1443  // Inkscape mangles namespace definitions created by Adobe Illustrator.
1444  // This is nasty but harmless. (T144827)
1445  $isBuggyInkscape = preg_match( '/^&(#38;)*ns_[a-z_]+;$/', $namespace );
1446 
1447  if ( !( $isBuggyInkscape || in_array( $namespace, $validNamespaces ) ) ) {
1448  wfDebug( __METHOD__ . ": Non-svg namespace '$namespace' in uploaded file.\n" );
1450  $this->mSVGNSError = $namespace;
1451 
1452  return true;
1453  }
1454 
1455  /*
1456  * check for elements that can contain javascript
1457  */
1458  if ( $strippedElement == 'script' ) {
1459  wfDebug( __METHOD__ . ": Found script element '$element' in uploaded file.\n" );
1460 
1461  return [ 'uploaded-script-svg', $strippedElement ];
1462  }
1463 
1464  # e.g., <svg xmlns="http://www.w3.org/2000/svg">
1465  # <handler xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load">alert(1)</handler> </svg>
1466  if ( $strippedElement == 'handler' ) {
1467  wfDebug( __METHOD__ . ": Found scriptable element '$element' in uploaded file.\n" );
1468 
1469  return [ 'uploaded-script-svg', $strippedElement ];
1470  }
1471 
1472  # SVG reported in Feb '12 that used xml:stylesheet to generate javascript block
1473  if ( $strippedElement == 'stylesheet' ) {
1474  wfDebug( __METHOD__ . ": Found scriptable element '$element' in uploaded file.\n" );
1475 
1476  return [ 'uploaded-script-svg', $strippedElement ];
1477  }
1478 
1479  # Block iframes, in case they pass the namespace check
1480  if ( $strippedElement == 'iframe' ) {
1481  wfDebug( __METHOD__ . ": iframe in uploaded file.\n" );
1482 
1483  return [ 'uploaded-script-svg', $strippedElement ];
1484  }
1485 
1486  # Check <style> css
1487  if ( $strippedElement == 'style'
1488  && self::checkCssFragment( Sanitizer::normalizeCss( $data ) )
1489  ) {
1490  wfDebug( __METHOD__ . ": hostile css in style element.\n" );
1491  return [ 'uploaded-hostile-svg' ];
1492  }
1493 
1494  foreach ( $attribs as $attrib => $value ) {
1495  $stripped = $this->stripXmlNamespace( $attrib );
1496  $value = strtolower( $value );
1497 
1498  if ( substr( $stripped, 0, 2 ) == 'on' ) {
1499  wfDebug( __METHOD__
1500  . ": Found event-handler attribute '$attrib'='$value' in uploaded file.\n" );
1501 
1502  return [ 'uploaded-event-handler-on-svg', $attrib, $value ];
1503  }
1504 
1505  # Do not allow relative links, or unsafe url schemas.
1506  # For <a> tags, only data:, http: and https: and same-document
1507  # fragment links are allowed. For all other tags, only data:
1508  # and fragment are allowed.
1509  if ( $stripped == 'href'
1510  && $value !== ''
1511  && strpos( $value, 'data:' ) !== 0
1512  && strpos( $value, '#' ) !== 0
1513  ) {
1514  if ( !( $strippedElement === 'a'
1515  && preg_match( '!^https?://!i', $value ) )
1516  ) {
1517  wfDebug( __METHOD__ . ": Found href attribute <$strippedElement "
1518  . "'$attrib'='$value' in uploaded file.\n" );
1519 
1520  return [ 'uploaded-href-attribute-svg', $strippedElement, $attrib, $value ];
1521  }
1522  }
1523 
1524  # only allow data: targets that should be safe. This prevents vectors like,
1525  # image/svg, text/xml, application/xml, and text/html, which can contain scripts
1526  if ( $stripped == 'href' && strncasecmp( 'data:', $value, 5 ) === 0 ) {
1527  // rfc2397 parameters. This is only slightly slower than (;[\w;]+)*.
1528  // @codingStandardsIgnoreStart Generic.Files.LineLength
1529  $parameters = '(?>;[a-zA-Z0-9\!#$&\'*+.^_`{|}~-]+=(?>[a-zA-Z0-9\!#$&\'*+.^_`{|}~-]+|"(?>[\0-\x0c\x0e-\x21\x23-\x5b\x5d-\x7f]+|\\\\[\0-\x7f])*"))*(?:;base64)?';
1530  // @codingStandardsIgnoreEnd
1531 
1532  if ( !preg_match( "!^data:\s*image/(gif|jpeg|jpg|png)$parameters,!i", $value ) ) {
1533  wfDebug( __METHOD__ . ": Found href to unwhitelisted data: uri "
1534  . "\"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" );
1535  return [ 'uploaded-href-unsafe-target-svg', $strippedElement, $attrib, $value ];
1536  }
1537  }
1538 
1539  # Change href with animate from (http://html5sec.org/#137).
1540  if ( $stripped === 'attributename'
1541  && $strippedElement === 'animate'
1542  && $this->stripXmlNamespace( $value ) == 'href'
1543  ) {
1544  wfDebug( __METHOD__ . ": Found animate that might be changing href using from "
1545  . "\"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" );
1546 
1547  return [ 'uploaded-animate-svg', $strippedElement, $attrib, $value ];
1548  }
1549 
1550  # use set/animate to add event-handler attribute to parent
1551  if ( ( $strippedElement == 'set' || $strippedElement == 'animate' )
1552  && $stripped == 'attributename'
1553  && substr( $value, 0, 2 ) == 'on'
1554  ) {
1555  wfDebug( __METHOD__ . ": Found svg setting event-handler attribute with "
1556  . "\"<$strippedElement $stripped='$value'...\" in uploaded file.\n" );
1557 
1558  return [ 'uploaded-setting-event-handler-svg', $strippedElement, $stripped, $value ];
1559  }
1560 
1561  # use set to add href attribute to parent element
1562  if ( $strippedElement == 'set'
1563  && $stripped == 'attributename'
1564  && strpos( $value, 'href' ) !== false
1565  ) {
1566  wfDebug( __METHOD__ . ": Found svg setting href attribute '$value' in uploaded file.\n" );
1567 
1568  return [ 'uploaded-setting-href-svg' ];
1569  }
1570 
1571  # use set to add a remote / data / script target to an element
1572  if ( $strippedElement == 'set'
1573  && $stripped == 'to'
1574  && preg_match( '!(http|https|data|script):!sim', $value )
1575  ) {
1576  wfDebug( __METHOD__ . ": Found svg setting attribute to '$value' in uploaded file.\n" );
1577 
1578  return [ 'uploaded-wrong-setting-svg', $value ];
1579  }
1580 
1581  # use handler attribute with remote / data / script
1582  if ( $stripped == 'handler' && preg_match( '!(http|https|data|script):!sim', $value ) ) {
1583  wfDebug( __METHOD__ . ": Found svg setting handler with remote/data/script "
1584  . "'$attrib'='$value' in uploaded file.\n" );
1585 
1586  return [ 'uploaded-setting-handler-svg', $attrib, $value ];
1587  }
1588 
1589  # use CSS styles to bring in remote code
1590  if ( $stripped == 'style'
1591  && self::checkCssFragment( Sanitizer::normalizeCss( $value ) )
1592  ) {
1593  wfDebug( __METHOD__ . ": Found svg setting a style with "
1594  . "remote url '$attrib'='$value' in uploaded file.\n" );
1595  return [ 'uploaded-remote-url-svg', $attrib, $value ];
1596  }
1597 
1598  # Several attributes can include css, css character escaping isn't allowed
1599  $cssAttrs = [ 'font', 'clip-path', 'fill', 'filter', 'marker',
1600  'marker-end', 'marker-mid', 'marker-start', 'mask', 'stroke' ];
1601  if ( in_array( $stripped, $cssAttrs )
1602  && self::checkCssFragment( $value )
1603  ) {
1604  wfDebug( __METHOD__ . ": Found svg setting a style with "
1605  . "remote url '$attrib'='$value' in uploaded file.\n" );
1606  return [ 'uploaded-remote-url-svg', $attrib, $value ];
1607  }
1608 
1609  # image filters can pull in url, which could be svg that executes scripts
1610  if ( $strippedElement == 'image'
1611  && $stripped == 'filter'
1612  && preg_match( '!url\s*\(!sim', $value )
1613  ) {
1614  wfDebug( __METHOD__ . ": Found image filter with url: "
1615  . "\"<$strippedElement $stripped='$value'...\" in uploaded file.\n" );
1616 
1617  return [ 'uploaded-image-filter-svg', $strippedElement, $stripped, $value ];
1618  }
1619  }
1620 
1621  return false; // No scripts detected
1622  }
1623 
1631  private static function checkCssFragment( $value ) {
1632 
1633  # Forbid external stylesheets, for both reliability and to protect viewer's privacy
1634  if ( stripos( $value, '@import' ) !== false ) {
1635  return true;
1636  }
1637 
1638  # We allow @font-face to embed fonts with data: urls, so we snip the string
1639  # 'url' out so this case won't match when we check for urls below
1640  $pattern = '!(@font-face\s*{[^}]*src:)url(\("data:;base64,)!im';
1641  $value = preg_replace( $pattern, '$1$2', $value );
1642 
1643  # Check for remote and executable CSS. Unlike in Sanitizer::checkCss, the CSS
1644  # properties filter and accelerator don't seem to be useful for xss in SVG files.
1645  # Expression and -o-link don't seem to work either, but filtering them here in case.
1646  # Additionally, we catch remote urls like url("http:..., url('http:..., url(http:...,
1647  # but not local ones such as url("#..., url('#..., url(#....
1648  if ( preg_match( '!expression
1649  | -o-link\s*:
1650  | -o-link-source\s*:
1651  | -o-replace\s*:!imx', $value ) ) {
1652  return true;
1653  }
1654 
1655  if ( preg_match_all(
1656  "!(\s*(url|image|image-set)\s*\(\s*[\"']?\s*[^#]+.*?\))!sim",
1657  $value,
1658  $matches
1659  ) !== 0
1660  ) {
1661  # TODO: redo this in one regex. Until then, url("#whatever") matches the first
1662  foreach ( $matches[1] as $match ) {
1663  if ( !preg_match( "!\s*(url|image|image-set)\s*\(\s*(#|'#|\"#)!im", $match ) ) {
1664  return true;
1665  }
1666  }
1667  }
1668 
1669  if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ) {
1670  return true;
1671  }
1672 
1673  return false;
1674  }
1675 
1681  private static function splitXmlNamespace( $element ) {
1682  // 'http://www.w3.org/2000/svg:script' -> [ 'http://www.w3.org/2000/svg', 'script' ]
1683  $parts = explode( ':', strtolower( $element ) );
1684  $name = array_pop( $parts );
1685  $ns = implode( ':', $parts );
1686 
1687  return [ $ns, $name ];
1688  }
1689 
1694  private function stripXmlNamespace( $name ) {
1695  // 'http://www.w3.org/2000/svg:script' -> 'script'
1696  $parts = explode( ':', strtolower( $name ) );
1697 
1698  return array_pop( $parts );
1699  }
1700 
1711  public static function detectVirus( $file ) {
1713 
1714  if ( !$wgAntivirus ) {
1715  wfDebug( __METHOD__ . ": virus scanner disabled\n" );
1716 
1717  return null;
1718  }
1719 
1720  if ( !$wgAntivirusSetup[$wgAntivirus] ) {
1721  wfDebug( __METHOD__ . ": unknown virus scanner: $wgAntivirus\n" );
1722  $wgOut->wrapWikiMsg( "<div class=\"error\">\n$1\n</div>",
1723  [ 'virus-badscanner', $wgAntivirus ] );
1724 
1725  return wfMessage( 'virus-unknownscanner' )->text() . " $wgAntivirus";
1726  }
1727 
1728  # look up scanner configuration
1729  $command = $wgAntivirusSetup[$wgAntivirus]['command'];
1730  $exitCodeMap = $wgAntivirusSetup[$wgAntivirus]['codemap'];
1731  $msgPattern = isset( $wgAntivirusSetup[$wgAntivirus]['messagepattern'] ) ?
1732  $wgAntivirusSetup[$wgAntivirus]['messagepattern'] : null;
1733 
1734  if ( strpos( $command, "%f" ) === false ) {
1735  # simple pattern: append file to scan
1736  $command .= " " . wfEscapeShellArg( $file );
1737  } else {
1738  # complex pattern: replace "%f" with file to scan
1739  $command = str_replace( "%f", wfEscapeShellArg( $file ), $command );
1740  }
1741 
1742  wfDebug( __METHOD__ . ": running virus scan: $command \n" );
1743 
1744  # execute virus scanner
1745  $exitCode = false;
1746 
1747  # NOTE: there's a 50 line workaround to make stderr redirection work on windows, too.
1748  # that does not seem to be worth the pain.
1749  # Ask me (Duesentrieb) about it if it's ever needed.
1750  $output = wfShellExecWithStderr( $command, $exitCode );
1751 
1752  # map exit code to AV_xxx constants.
1753  $mappedCode = $exitCode;
1754  if ( $exitCodeMap ) {
1755  if ( isset( $exitCodeMap[$exitCode] ) ) {
1756  $mappedCode = $exitCodeMap[$exitCode];
1757  } elseif ( isset( $exitCodeMap["*"] ) ) {
1758  $mappedCode = $exitCodeMap["*"];
1759  }
1760  }
1761 
1762  /* NB: AV_NO_VIRUS is 0 but AV_SCAN_FAILED is false,
1763  * so we need the strict equalities === and thus can't use a switch here
1764  */
1765  if ( $mappedCode === AV_SCAN_FAILED ) {
1766  # scan failed (code was mapped to false by $exitCodeMap)
1767  wfDebug( __METHOD__ . ": failed to scan $file (code $exitCode).\n" );
1768 
1769  $output = $wgAntivirusRequired
1770  ? wfMessage( 'virus-scanfailed', [ $exitCode ] )->text()
1771  : null;
1772  } elseif ( $mappedCode === AV_SCAN_ABORTED ) {
1773  # scan failed because filetype is unknown (probably imune)
1774  wfDebug( __METHOD__ . ": unsupported file type $file (code $exitCode).\n" );
1775  $output = null;
1776  } elseif ( $mappedCode === AV_NO_VIRUS ) {
1777  # no virus found
1778  wfDebug( __METHOD__ . ": file passed virus scan.\n" );
1779  $output = false;
1780  } else {
1781  $output = trim( $output );
1782 
1783  if ( !$output ) {
1784  $output = true; # if there's no output, return true
1785  } elseif ( $msgPattern ) {
1786  $groups = [];
1787  if ( preg_match( $msgPattern, $output, $groups ) ) {
1788  if ( $groups[1] ) {
1789  $output = $groups[1];
1790  }
1791  }
1792  }
1793 
1794  wfDebug( __METHOD__ . ": FOUND VIRUS! scanner feedback: $output \n" );
1795  }
1796 
1797  return $output;
1798  }
1799 
1808  private function checkOverwrite( $user ) {
1809  // First check whether the local file can be overwritten
1810  $file = $this->getLocalFile();
1811  $file->load( File::READ_LATEST );
1812  if ( $file->exists() ) {
1813  if ( !self::userCanReUpload( $user, $file ) ) {
1814  return [ 'fileexists-forbidden', $file->getName() ];
1815  } else {
1816  return true;
1817  }
1818  }
1819 
1820  /* Check shared conflicts: if the local file does not exist, but
1821  * wfFindFile finds a file, it exists in a shared repository.
1822  */
1823  $file = wfFindFile( $this->getTitle(), [ 'latest' => true ] );
1824  if ( $file && !$user->isAllowed( 'reupload-shared' ) ) {
1825  return [ 'fileexists-shared-forbidden', $file->getName() ];
1826  }
1827 
1828  return true;
1829  }
1830 
1838  public static function userCanReUpload( User $user, File $img ) {
1839  if ( $user->isAllowed( 'reupload' ) ) {
1840  return true; // non-conditional
1841  } elseif ( !$user->isAllowed( 'reupload-own' ) ) {
1842  return false;
1843  }
1844 
1845  if ( !( $img instanceof LocalFile ) ) {
1846  return false;
1847  }
1848 
1849  $img->load();
1850 
1851  return $user->getId() == $img->getUser( 'id' );
1852  }
1853 
1865  public static function getExistsWarning( $file ) {
1866  if ( $file->exists() ) {
1867  return [ 'warning' => 'exists', 'file' => $file ];
1868  }
1869 
1870  if ( $file->getTitle()->getArticleID() ) {
1871  return [ 'warning' => 'page-exists', 'file' => $file ];
1872  }
1873 
1874  if ( strpos( $file->getName(), '.' ) == false ) {
1875  $partname = $file->getName();
1876  $extension = '';
1877  } else {
1878  $n = strrpos( $file->getName(), '.' );
1879  $extension = substr( $file->getName(), $n + 1 );
1880  $partname = substr( $file->getName(), 0, $n );
1881  }
1882  $normalizedExtension = File::normalizeExtension( $extension );
1883 
1884  if ( $normalizedExtension != $extension ) {
1885  // We're not using the normalized form of the extension.
1886  // Normal form is lowercase, using most common of alternate
1887  // extensions (eg 'jpg' rather than 'JPEG').
1888 
1889  // Check for another file using the normalized form...
1890  $nt_lc = Title::makeTitle( NS_FILE, "{$partname}.{$normalizedExtension}" );
1891  $file_lc = wfLocalFile( $nt_lc );
1892 
1893  if ( $file_lc->exists() ) {
1894  return [
1895  'warning' => 'exists-normalized',
1896  'file' => $file,
1897  'normalizedFile' => $file_lc
1898  ];
1899  }
1900  }
1901 
1902  // Check for files with the same name but a different extension
1903  $similarFiles = RepoGroup::singleton()->getLocalRepo()->findFilesByPrefix(
1904  "{$partname}.", 1 );
1905  if ( count( $similarFiles ) ) {
1906  return [
1907  'warning' => 'exists-normalized',
1908  'file' => $file,
1909  'normalizedFile' => $similarFiles[0],
1910  ];
1911  }
1912 
1913  if ( self::isThumbName( $file->getName() ) ) {
1914  # Check for filenames like 50px- or 180px-, these are mostly thumbnails
1915  $nt_thb = Title::newFromText(
1916  substr( $partname, strpos( $partname, '-' ) + 1 ) . '.' . $extension,
1917  NS_FILE
1918  );
1919  $file_thb = wfLocalFile( $nt_thb );
1920  if ( $file_thb->exists() ) {
1921  return [
1922  'warning' => 'thumb',
1923  'file' => $file,
1924  'thumbFile' => $file_thb
1925  ];
1926  } else {
1927  // File does not exist, but we just don't like the name
1928  return [
1929  'warning' => 'thumb-name',
1930  'file' => $file,
1931  'thumbFile' => $file_thb
1932  ];
1933  }
1934  }
1935 
1936  foreach ( self::getFilenamePrefixBlacklist() as $prefix ) {
1937  if ( substr( $partname, 0, strlen( $prefix ) ) == $prefix ) {
1938  return [
1939  'warning' => 'bad-prefix',
1940  'file' => $file,
1941  'prefix' => $prefix
1942  ];
1943  }
1944  }
1945 
1946  return false;
1947  }
1948 
1954  public static function isThumbName( $filename ) {
1955  $n = strrpos( $filename, '.' );
1956  $partname = $n ? substr( $filename, 0, $n ) : $filename;
1957 
1958  return (
1959  substr( $partname, 3, 3 ) == 'px-' ||
1960  substr( $partname, 2, 3 ) == 'px-'
1961  ) &&
1962  preg_match( "/[0-9]{2}/", substr( $partname, 0, 2 ) );
1963  }
1964 
1970  public static function getFilenamePrefixBlacklist() {
1971  $blacklist = [];
1972  $message = wfMessage( 'filename-prefix-blacklist' )->inContentLanguage();
1973  if ( !$message->isDisabled() ) {
1974  $lines = explode( "\n", $message->plain() );
1975  foreach ( $lines as $line ) {
1976  // Remove comment lines
1977  $comment = substr( trim( $line ), 0, 1 );
1978  if ( $comment == '#' || $comment == '' ) {
1979  continue;
1980  }
1981  // Remove additional comments after a prefix
1982  $comment = strpos( $line, '#' );
1983  if ( $comment > 0 ) {
1984  $line = substr( $line, 0, $comment - 1 );
1985  }
1986  $blacklist[] = trim( $line );
1987  }
1988  }
1989 
1990  return $blacklist;
1991  }
1992 
2004  public function getImageInfo( $result ) {
2005  $localFile = $this->getLocalFile();
2006  $stashFile = $this->getStashFile();
2007  // Calling a different API module depending on whether the file was stashed is less than optimal.
2008  // In fact, calling API modules here at all is less than optimal. Maybe it should be refactored.
2009  if ( $stashFile ) {
2011  $info = ApiQueryStashImageInfo::getInfo( $stashFile, array_flip( $imParam ), $result );
2012  } else {
2014  $info = ApiQueryImageInfo::getInfo( $localFile, array_flip( $imParam ), $result );
2015  }
2016 
2017  return $info;
2018  }
2019 
2024  public function convertVerifyErrorToStatus( $error ) {
2025  $code = $error['status'];
2026  unset( $code['status'] );
2027 
2028  return Status::newFatal( $this->getVerificationErrorCode( $code ), $error );
2029  }
2030 
2038  public static function getMaxUploadSize( $forType = null ) {
2040 
2041  if ( is_array( $wgMaxUploadSize ) ) {
2042  if ( !is_null( $forType ) && isset( $wgMaxUploadSize[$forType] ) ) {
2043  return $wgMaxUploadSize[$forType];
2044  } else {
2045  return $wgMaxUploadSize['*'];
2046  }
2047  } else {
2048  return intval( $wgMaxUploadSize );
2049  }
2050  }
2051 
2059  public static function getMaxPhpUploadSize() {
2060  $phpMaxFileSize = wfShorthandToInteger(
2061  ini_get( 'upload_max_filesize' ) ?: ini_get( 'hhvm.server.upload.upload_max_file_size' ),
2062  PHP_INT_MAX
2063  );
2064  $phpMaxPostSize = wfShorthandToInteger(
2065  ini_get( 'post_max_size' ) ?: ini_get( 'hhvm.server.max_post_size' ),
2066  PHP_INT_MAX
2067  ) ?: PHP_INT_MAX;
2068  return min( $phpMaxFileSize, $phpMaxPostSize );
2069  }
2070 
2080  public static function getSessionStatus( User $user, $statusKey ) {
2081  $key = wfMemcKey( 'uploadstatus', $user->getId() ?: md5( $user->getName() ), $statusKey );
2082 
2083  return ObjectCache::getMainStashInstance()->get( $key );
2084  }
2085 
2096  public static function setSessionStatus( User $user, $statusKey, $value ) {
2097  $key = wfMemcKey( 'uploadstatus', $user->getId() ?: md5( $user->getName() ), $statusKey );
2098 
2100  if ( $value === false ) {
2101  $cache->delete( $key );
2102  } else {
2103  $cache->set( $key, $value, $cache::TTL_DAY );
2104  }
2105  }
2106 }
$wgStrictFileExtensions
If this is turned off, users may override the warning for files not covered by $wgFileExtensions.
checkSvgScriptCallback($element, $attribs, $data=null)
static checkFileExtensionList($ext, $list)
Perform case-insensitive match against a list of file extensions.
#define the
table suitable for use with IDatabase::select()
getImageInfo($result)
Gets image info about the file just uploaded.
getVerificationErrorCode($error)
Definition: UploadBase.php:86
null means default in associative array form
Definition: hooks.txt:1932
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
static read($fileName, $callback, $options=[])
Read a ZIP file and call a function for each file discovered in it.
const FILENAME_TOO_LONG
Definition: UploadBase.php:80
$wgSVGMetadataCutoff
Don't read SVG metadata beyond this point.
$wgDisableUploadScriptChecks
Setting this to true will disable the upload system's checks for HTML/JavaScript. ...
magic word the default is to use $key to get the and $key value or $key value text $key value html to format the value $key
Definition: hooks.txt:2489
tryStashFile(User $user, $isPartial=false)
Like stashFile(), but respects extensions' wishes to prevent the stashing.
Definition: UploadBase.php:959
wfIsHHVM()
Check if we are running under HHVM.
const SUCCESS
Definition: UploadBase.php:68
static createFromRequest(&$request, $type=null)
Create a form of UploadBase depending on wpSourceType and initializes it.
Definition: UploadBase.php:161
static isAllowed($user)
Returns true if the user can use this upload module or else a string identifying the missing permissi...
Definition: UploadBase.php:131
wfShorthandToInteger($string= '', $default=-1)
Converts shorthand byte notation to integer form.
static singleton()
Get an instance of this class.
Definition: MimeMagic.php:33
div flags Integer display flags(NO_ACTION_LINK, NO_EXTRA_USER_LINKS) 'LogException'returning false will NOT prevent logging $e
Definition: hooks.txt:2098
static newFatal($message)
Factory function for fatal errors.
Definition: StatusValue.php:63
$command
Definition: cdb.php:65
static checkFileExtension($ext, $list)
Perform case-insensitive match against a list of file extensions.
globals txt Globals are evil The original MediaWiki code relied on globals for processing context far too often MediaWiki development since then has been a story of slowly moving context out of global variables and into objects Storing processing context in object member variables allows those objects to be reused in a much more flexible way Consider the elegance of
database rows
Definition: globals.txt:10
const DELETE_SOURCE
Definition: File.php:65
static getSessionStatus(User $user, $statusKey)
Get the current status of a chunked upload (used for polling)
const OVERWRITE_EXISTING_FILE
Definition: UploadBase.php:73
static $safeXmlEncodings
Definition: UploadBase.php:51
static isValidRequest($request)
Check whether a request if valid for this handler.
Definition: UploadBase.php:205
This class is used to hold the location and do limited manipulation of files stored temporarily (this...
Definition: TempFSFile.php:30
$comment
null for the local wiki Added in
Definition: hooks.txt:1551
has been added to your &Future changes to this page and its associated Talk page will be listed there
$value
const AV_NO_VIRUS
Definition: Defines.php:105
verifyPermissions($user)
Alias for verifyTitlePermissions.
Definition: UploadBase.php:592
if($ext== 'php'||$ext== 'php5') $mime
Definition: router.php:65
stripXmlNamespace($name)
static splitXmlNamespace($element)
Divide the element name passed by the xml parser to the callback into URI and prifix.
static getMainStashInstance()
Get the cache object for the main stash.
static newFromText($text, $defaultNamespace=NS_MAIN)
Create a new Title from text, such as what one would find in a link.
Definition: Title.php:262
const ILLEGAL_FILENAME
Definition: UploadBase.php:72
isEmptyFile()
Return true if the file is empty.
Definition: UploadBase.php:276
const AV_SCAN_FAILED
Definition: Defines.php:108
string $mTempPath
Local file system path to the file to upload (or a local copy)
Definition: UploadBase.php:40
when a variable name is used in a it is silently declared as a new local masking the global
Definition: design.txt:93
when a variable name is used in a function
Definition: design.txt:93
wfLocalFile($title)
Get an object referring to a locally registered file.
$wgAllowJavaUploads
Allow Java archive uploads.
wfStripIllegalFilenameChars($name)
Replace all invalid characters with '-'.
static checkSvgPICallback($target, $data)
Callback to filter SVG Processing Instructions.
getName()
Get the user name, or the IP of an anonymous user.
Definition: User.php:2140
verifyMimeType($mime)
Verify the MIME type.
Definition: UploadBase.php:409
wfArrayDiff2($a, $b)
Like array_diff( $a, $b ) except that it works with two-dimensional arrays.
wfDebug($text, $dest= 'all', array $context=[])
Sends a line to the debug log if enabled or, optionally, to a comment in output.
const AV_SCAN_ABORTED
Definition: Defines.php:107
static getMaxUploadSize($forType=null)
Get the MediaWiki maximum uploaded file size for given type of upload, based on $wgMaxUploadSize.
const DELETED_FILE
Definition: File.php:52
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as $wgLang
Definition: design.txt:56
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message.Please note the header message cannot receive/use parameters. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item.Return false to stop further processing of the tag $reader:XMLReader object $logInfo:Array of information 'ImportHandlePageXMLTag':When parsing a XML tag in a page.Return false to stop further processing of the tag $reader:XMLReader object &$pageInfo:Array of information 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision.Return false to stop further processing of the tag $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information 'ImportHandleToplevelXMLTag':When parsing a top level XML tag.Return false to stop further processing of the tag $reader:XMLReader object 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload.Return false to stop further processing of the tag $reader:XMLReader object $revisionInfo:Array of information 'ImportLogInterwikiLink':Hook to change the interwiki link used in log entries and edit summaries for transwiki imports.&$fullInterwikiPrefix:Interwiki prefix, may contain colons.&$pageTitle:String that contains page title. 'ImportSources':Called when reading from the $wgImportSources configuration variable.Can be used to lazy-load the import sources list.&$importSources:The value of $wgImportSources.Modify as necessary.See the comment in DefaultSettings.php for the detail of how to structure this array. 'InfoAction':When building information to display on the action=info page.$context:IContextSource object &$pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect.&$title:Title object for the current page &$request:WebRequest &$ignoreRedirect:boolean to skip redirect check &$target:Title/string of redirect target &$article:Article object 'InternalParseBeforeLinks':during Parser's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InternalParseBeforeSanitize':during Parser's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings.Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not.Return true without providing an interwiki to continue interwiki search.$prefix:interwiki prefix we are looking for.&$iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InvalidateEmailComplete':Called after a user's email has been invalidated successfully.$user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification.Callee may modify $url and $query, URL will be constructed as $url.$query &$url:URL to index.php &$query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) &$article:article(object) being checked 'IsTrustedProxy':Override the result of IP::isTrustedProxy() &$ip:IP being check &$result:Change this value to override the result of IP::isTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from &$allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of Sanitizer::validateEmail(), for instance to return false if the domain name doesn't match your organization.$addr:The e-mail address entered by the user &$result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user &$result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we're looking for a messages file for &$file:The messages file path, you can override this to change the location. 'LanguageGetMagic':DEPRECATED!Use $magicWords in a file listed in $wgExtensionMessagesFiles instead.Use this to define synonyms of magic words depending of the language &$magicExtensions:associative array of magic words synonyms $lang:language code(string) 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces.Do not use this hook to add namespaces.Use CanonicalNamespaces for that.&$namespaces:Array of namespaces indexed by their numbers 'LanguageGetSpecialPageAliases':DEPRECATED!Use $specialPageAliases in a file listed in $wgExtensionMessagesFiles instead.Use to define aliases of special pages names depending of the language &$specialPageAliases:associative array of magic words synonyms $lang:language code(string) 'LanguageGetTranslatedLanguageNames':Provide translated language names.&$names:array of language code=> language name $code:language of the preferred translations 'LanguageLinks':Manipulate a page's language links.This is called in various places to allow extensions to define the effective language links for a page.$title:The page's Title.&$links:Array with elements of the form"language:title"in the order that they will be output.&$linkFlags:Associative array mapping prefixed links to arrays of flags.Currently unused, but planned to provide support for marking individual language links in the UI, e.g.for featured articles. 'LanguageSelector':Hook to change the language selector available on a page.$out:The output page.$cssClassName:CSS class name of the language selector. 'LinkBegin':DEPRECATED!Use HtmlPageLinkRendererBegin instead.Used when generating internal and interwiki links in Linker::link(), before processing starts.Return false to skip default processing and return $ret.See documentation for Linker::link() for details on the expected meanings of parameters.$skin:the Skin object $target:the Title that the link is pointing to &$html:the contents that the< a > tag should have(raw HTML) $result
Definition: hooks.txt:1930
setTempFile($tempPath, $fileSize=null)
Definition: UploadBase.php:251
verifyPartialFile()
A verification routine suitable for partial files.
Definition: UploadBase.php:502
$wgCheckFileExtensions
This is a flag to determine whether or not to check file extensions on upload.
static decodeCharReferences($text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string...
Definition: Sanitizer.php:1500
$wgEnableUploads
Uploads have to be specially set up to be secure.
static isThumbName($filename)
Helper function that checks whether the filename looks like a thumbnail.
static isThrottled($user)
Returns true if the user has surpassed the upload rate limit, false otherwise.
Definition: UploadBase.php:147
Class representing a row of the 'filearchive' table.
zipEntryCallback($entry)
Callback for ZipDirectoryReader to detect Java class files.
Definition: UploadBase.php:563
$wgAntivirusRequired
Determines if a failed virus scan (AV_SCAN_FAILED) will cause the file to be rejected.
We ve cleaned up the code here by removing clumps of infrequently used code and moving them off somewhere else It s much easier for someone working with this code to see what s _really_ going and make changes or fix bugs In we can take all the code that deals with the little used title reversing we can concentrate it all in an extension file
Definition: hooks.txt:93
getTempFileSha1Base36()
Get the base 36 SHA1 of the file.
Definition: UploadBase.php:292
stashFileGetKey()
Stash a file in a temporary directory, returning a key which can be used to find the file again...
UploadBase and subclasses are the backend of MediaWiki's file uploads.
Definition: UploadBase.php:38
either a unescaped string or a HtmlArmor object after in associative array form externallinks including delete and has completed for all link tables whether this was an auto creation default is conds Array Extra conditions for the No matching items in log is displayed if loglist is empty msgKey Array If you want a nice box with a set this to the key of the message First element is the message additional optional elements are parameters for the key that are processed with wfMessage() -> params() ->parseAsBlock()-offset Set to overwrite offset parameter in $wgRequest set to ''to unsetoffset-wrap String Wrap the message in html(usually something like"&lt
wfIniGetBool($setting)
Safety wrapper around ini_get() for boolean settings.
static singleton()
Get a RepoGroup instance.
Definition: RepoGroup.php:59
fetchFile()
Fetch the file.
Definition: UploadBase.php:268
static isStoragePath($path)
Check if a given path is a "mwstore://" path.
stashSession()
alias for stashFileGetKey, for backwards compatibility
postProcessUpload()
Perform extra steps after a successful upload.
Definition: UploadBase.php:791
static getPropertyNames($filter=[])
Returns all possible parameters to iiprop.
$cache
Definition: mcc.php:33
const IGNORE_USER_RIGHTS
Definition: User.php:85
static doWatch(Title $title, User $user, $checkRights=User::CHECK_USER_RIGHTS)
Watch a page.
getTitle()
Returns the title of the file to be uploaded.
Definition: UploadBase.php:800
performUpload($comment, $pageText, $watch, $user, $tags=[])
Really perform the upload.
Definition: UploadBase.php:746
wfDeprecated($function, $version=false, $component=false, $callerOffset=2)
Throws a warning that $function is deprecated.
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
Definition: hooks.txt:1932
static detectVirus($file)
Generic wrapper function for a virus scanner program.
static splitExtensions($filename)
Split a file into a base name and all dot-delimited 'extensions' on the end.
static makeTitleSafe($ns, $title, $fragment= '', $interwiki= '')
Create a new Title from a namespace index and a DB key.
Definition: Title.php:535
cleanupTempFile()
If we've modified the upload file we need to manually remove it on exit to clean up.
you don t have to do a grep find to see where the $wgReverseTitle variable is used
Definition: hooks.txt:117
getSourceType()
Returns the upload type.
Definition: UploadBase.php:218
const FILE_TOO_LARGE
Definition: UploadBase.php:78
namespace and then decline to actually register it file or subcat img or subcat $title
Definition: hooks.txt:957
static newGood($value=null)
Factory function for good results.
Definition: StatusValue.php:76
checkWarnings()
Check for non fatal problems with the file.
Definition: UploadBase.php:645
initializeFromRequest(&$request)
Initialize from a WebRequest.
verifyUpload()
Verify whether the upload is sane.
Definition: UploadBase.php:322
const MIN_LENGTH_PARTNAME
Definition: UploadBase.php:71
static run($event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:131
getFileSize()
Return the file size.
Definition: UploadBase.php:284
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist e g Watchlist removed from all revisions and log entries to which it was applied This gives extensions a chance to take it off their books $tag
Definition: hooks.txt:1011
const NS_FILE
Definition: Defines.php:62
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for and distribution as defined by Sections through of this document Licensor shall mean the copyright owner or entity authorized by the copyright owner that is granting the License Legal Entity shall mean the union of the acting entity and all other entities that control are controlled by or are under common control with that entity For the purposes of this definition control direct or to cause the direction or management of such whether by contract or including but not limited to software source documentation and configuration files Object form shall mean any form resulting from mechanical transformation or translation of a Source including but not limited to compiled object generated and conversions to other media types Work shall mean the work of whether in Source or Object made available under the as indicated by a copyright notice that is included in or attached to the whether in Source or Object that is based or other modifications as a an original work of authorship For the purposes of this Derivative Works shall not include works that remain separable or merely the Work and Derivative Works thereof Contribution shall mean any work of including the original version of the Work and any modifications or additions to that Work or Derivative Works that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner For the purposes of this submitted means any form of or written communication sent to the Licensor or its including but not limited to communication on electronic mailing source code control and issue tracking systems that are managed by
static getSha1Base36FromPath($path)
Get a SHA-1 hash of a file in the local filesystem, in base-36 lower case encoding, zero padded to 31 digits.
Definition: FSFile.php:218
const VERIFICATION_ERROR
Definition: UploadBase.php:76
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output modifiable & $code
Definition: hooks.txt:806
static isEnabled()
Returns true if uploads are enabled.
Definition: UploadBase.php:112
please add to it if you re going to add events to the MediaWiki code where normally authentication against an external auth plugin would be creating a local account $user
Definition: hooks.txt:242
doStashFile(User $user=null)
Implementation for stashFile() and tryStashFile().
validateName()
Verify that the name is valid and, if necessary, that we can overwrite.
Definition: UploadBase.php:379
const FILETYPE_BADTYPE
Definition: UploadBase.php:75
$wgMaxUploadSize
Max size for uploads, in bytes.
getLocalFile()
Return the local file and initializes if necessary.
Definition: UploadBase.php:932
$wgAntivirusSetup
Configuration for different virus scanners.
const FILETYPE_MISSING
Definition: UploadBase.php:74
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist e g Watchlist removed from all revisions and log entries to which it was applied This gives extensions a chance to take it off their books as the deletion has already been partly carried out by this point or something similar the user will be unable to create the tag set and then return false from the hook function Ensure you consume the ChangeTagAfterDelete hook to carry out custom deletion actions as context called by AbstractContent::getParserOutput May be used to override the normal model specific rendering of page content as context as context the output can only depend on parameters provided to this hook not on global state indicating whether full HTML should be generated If generation of HTML may be but other information should still be present in the ParserOutput object & $output
Definition: hooks.txt:1050
do that in ParserLimitReportFormat instead use this to modify the parameters of the image and a DIV can begin in one section and end in another Make sure your code can handle that case gracefully See the EditSectionClearerLink extension for an example zero but section is usually empty its values are the globals values before the output is cached my talk my contributions etc etc otherwise the built in rate limiting checks are if enabled allows for interception of redirect as a string mapping parameter names to values & $type
Definition: hooks.txt:2506
static normalizeCss($value)
Normalize CSS into a format we can easily search for hostile input.
Definition: Sanitizer.php:893
$wgFileExtensions
This is the list of preferred extensions for uploading files.
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
static getFilenamePrefixBlacklist()
Get a list of blacklisted filename prefixes from [[MediaWiki:Filename-prefix-blacklist]].
$wgUploadSizeWarning
Warn if uploaded files are larger than this (in bytes), or false to disable.
verifyTitlePermissions($user)
Check whether the user can edit, upload and create the image.
Definition: UploadBase.php:607
$lines
Definition: router.php:67
const HOOK_ABORTED
Definition: UploadBase.php:77
error also a ContextSource you ll probably need to make sure the header is varied on $request
Definition: hooks.txt:2582
stashFile(User $user=null)
If the user does not supply all necessary information in the first upload form submission (either by ...
getId()
Get the user's ID.
Definition: User.php:2115
static verifyExtension($mime, $extension)
Checks if the MIME type of the uploaded file matches the file extension.
detectScriptInSvg($filename, $partial)
static detectScript($file, $mime, $extension)
Heuristic for detecting files that could contain JavaScript instructions or things that may look like...
convertVerifyErrorToStatus($error)
$line
Definition: cdb.php:59
static $uploadHandlers
Definition: UploadBase.php:152
const WINDOWS_NONASCII_FILENAME
Definition: UploadBase.php:79
static getHandler($type)
Get a MediaHandler for a given MIME type from the instance cache.
MimeMagic helper wrapper.
Definition: MWFileProps.php:28
$wgAllowTitlesInSVG
Disallow element in SVG files. </div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l01135">DefaultSettings.php:1135</a></div></div> <div class="ttc" id="hooks_8txt_html_a0b018fe38437255d3b25310ce15bf028"><div class="ttname"><a href="hooks_8txt.html#a0b018fe38437255d3b25310ce15bf028">$status</a></div><div class="ttdeci">this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist e g Watchlist removed from all revisions and log entries to which it was applied This gives extensions a chance to take it off their books as the deletion has already been partly carried out by this point or something similar the user will be unable to create the tag set $status</div><div class="ttdef"><b>Definition:</b> <a href="hooks_8txt_source.html#l01050">hooks.txt:1050</a></div></div> <div class="ttc" id="classUploadBase_html_abaddaebc8a45879bc55291f21c9a4633"><div class="ttname"><a href="classUploadBase.html#abaddaebc8a45879bc55291f21c9a4633">UploadBase\checkXMLEncodingMissmatch</a></div><div class="ttdeci">static checkXMLEncodingMissmatch($file)</div><div class="ttdoc">Check a whitelist of xml encodings that are known not to be interpreted differently by the server's x...</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l01295">UploadBase.php:1295</a></div></div> <div class="ttc" id="GlobalFunctions_8php_html_a781ca00c48d9c5cbd509c282a244c022"><div class="ttname"><a href="GlobalFunctions_8php.html#a781ca00c48d9c5cbd509c282a244c022">wfEscapeShellArg</a></div><div class="ttdeci">wfEscapeShellArg()</div><div class="ttdoc">Version of escapeshellarg() that works better on Windows. </div><div class="ttdef"><b>Definition:</b> <a href="GlobalFunctions_8php_source.html#l02210">GlobalFunctions.php:2210</a></div></div> <div class="ttc" id="classUploadBase_html_a087aa90b972383fc6af7f66cd82667b3"><div class="ttname"><a href="classUploadBase.html#a087aa90b972383fc6af7f66cd82667b3">UploadBase\checkCssFragment</a></div><div class="ttdeci">static checkCssFragment($value)</div><div class="ttdoc">Check a block of CSS or CSS fragment for anything that looks like it is bringing in remote code...</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l01631">UploadBase.php:1631</a></div></div> <div class="ttc" id="classXmlTypeCheck_html"><div class="ttname"><a href="classXmlTypeCheck.html">XmlTypeCheck</a></div><div class="ttdef"><b>Definition:</b> <a href="XmlTypeCheck_8php_source.html#l00028">XmlTypeCheck.php:28</a></div></div> <div class="ttc" id="classUploadBase_html_af2f0fc4c8dea6e705323620b5337cae5"><div class="ttname"><a href="classUploadBase.html#af2f0fc4c8dea6e705323620b5337cae5">UploadBase\getMaxPhpUploadSize</a></div><div class="ttdeci">static getMaxPhpUploadSize()</div><div class="ttdoc">Get the PHP maximum uploaded file size, based on ini settings. </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l02059">UploadBase.php:2059</a></div></div> <div class="ttc" id="GlobalFunctions_8php_html_a77dd228704cc6c8c9293b2846b348a95"><div class="ttname"><a href="GlobalFunctions_8php.html#a77dd228704cc6c8c9293b2846b348a95">wfMemcKey</a></div><div class="ttdeci">wfMemcKey()</div><div class="ttdoc">Make a cache key for the local wiki. </div><div class="ttdef"><b>Definition:</b> <a href="GlobalFunctions_8php_source.html#l02976">GlobalFunctions.php:2976</a></div></div> <div class="ttc" id="Setup_8php_html_a42b1168a7e1606df23cc6419aa411e78"><div class="ttname"><a href="Setup_8php.html#a42b1168a7e1606df23cc6419aa411e78">$wgOut</a></div><div class="ttdeci">$wgOut</div><div class="ttdef"><b>Definition:</b> <a href="Setup_8php_source.html#l00816">Setup.php:816</a></div></div> <div class="ttc" id="classUploadBase_html_af9702f03fda4170d5debce1bc23c65b8"><div class="ttname"><a href="classUploadBase.html#af9702f03fda4170d5debce1bc23c65b8">UploadBase\setSessionStatus</a></div><div class="ttdeci">static setSessionStatus(User $user, $statusKey, $value)</div><div class="ttdoc">Set the current status of a chunked upload (used for polling) </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l02096">UploadBase.php:2096</a></div></div> <div class="ttc" id="NoLocalSettings_8php_html_a0a4baf0b22973c07685c3981f0d17fc4"><div class="ttname"><a href="NoLocalSettings_8php.html#a0a4baf0b22973c07685c3981f0d17fc4">$path</a></div><div class="ttdeci">$path</div><div class="ttdef"><b>Definition:</b> <a href="NoLocalSettings_8php_source.html#l00026">NoLocalSettings.php:26</a></div></div> <div class="ttc" id="importImages_8php_html_a78dd0f5a8f983099dc6499a2d7cdf7aa"><div class="ttname"><a href="importImages_8php.html#a78dd0f5a8f983099dc6499a2d7cdf7aa">$extensions</a></div><div class="ttdeci">$extensions</div><div class="ttdef"><b>Definition:</b> <a href="importImages_8php_source.html#l00069">importImages.php:69</a></div></div> <div class="ttc" id="classUploadBase_html_a39347cf74d116df59f2fe0344bfaac91"><div class="ttname"><a href="classUploadBase.html#a39347cf74d116df59f2fe0344bfaac91">UploadBase\$mBlackListedExtensions</a></div><div class="ttdeci">$mBlackListedExtensions</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00048">UploadBase.php:48</a></div></div> <div class="ttc" id="classUploadBase_html_aef55162125a82f0247397621735daca1"><div class="ttname"><a href="classUploadBase.html#aef55162125a82f0247397621735daca1">UploadBase\$tempFileObj</a></div><div class="ttdeci">TempFSFile null $tempFileObj</div><div class="ttdoc">Wrapper to handle deleting the temp file. </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00042">UploadBase.php:42</a></div></div> <div class="ttc" id="classUploadBase_html_af4a23e145883030bffcb842cbf6c897a"><div class="ttname"><a href="classUploadBase.html#af4a23e145883030bffcb842cbf6c897a">UploadBase\$mFileSize</a></div><div class="ttdeci">$mFileSize</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00047">UploadBase.php:47</a></div></div> <div class="ttc" id="hooks_8txt_html_ae55f6a597c457cd31e064490cae16f0a"><div class="ttname"><a href="hooks_8txt.html#ae55f6a597c457cd31e064490cae16f0a">$handler</a></div><div class="ttdeci">this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output modifiable modifiable after all normalizations have been except for the $wgMaxImageArea check set to true or false to override the $wgMaxImageArea check result gives extension the possibility to transform it themselves $handler</div><div class="ttdef"><b>Definition:</b> <a href="hooks_8txt_source.html#l00806">hooks.txt:806</a></div></div> <div class="ttc" id="DefaultSettings_8php_html_acb268f4a51af8c4bf404f8b4379176d0"><div class="ttname"><a href="DefaultSettings_8php.html#acb268f4a51af8c4bf404f8b4379176d0">$wgMimeTypeBlacklist</a></div><div class="ttdeci">$wgMimeTypeBlacklist</div><div class="ttdoc">Files with these MIME types will never be allowed as uploads if $wgVerifyMimeType is enabled...</div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l00887">DefaultSettings.php:887</a></div></div> <div class="ttc" id="GlobalFunctions_8php_html_ae0675d4e55228eaad7607df946396cb4"><div class="ttname"><a href="GlobalFunctions_8php.html#ae0675d4e55228eaad7607df946396cb4">wfShellExecWithStderr</a></div><div class="ttdeci">wfShellExecWithStderr($cmd, &$retval=null, $environ=[], $limits=[])</div><div class="ttdoc">Execute a shell command, returning both stdout and stderr. </div><div class="ttdef"><b>Definition:</b> <a href="GlobalFunctions_8php_source.html#l02546">GlobalFunctions.php:2546</a></div></div> <div class="ttc" id="classUploadBase_html_a515d712e20d4ed2cee1b9f23637401ad"><div class="ttname"><a href="classUploadBase.html#a515d712e20d4ed2cee1b9f23637401ad">UploadBase\verifyFile</a></div><div class="ttdeci">verifyFile()</div><div class="ttdoc">Verifies that it's ok to include the uploaded file. </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00441">UploadBase.php:441</a></div></div> <div class="ttc" id="classUploadBase_html_a97839fdd914750ecd650fd3a045f36f8"><div class="ttname"><a href="classUploadBase.html#a97839fdd914750ecd650fd3a045f36f8">UploadBase\OK</a></div><div class="ttdeci">const OK</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00069">UploadBase.php:69</a></div></div> <div class="ttc" id="DefaultSettings_8php_html_a75612877f528cecdb711d45fa25588ee"><div class="ttname"><a href="DefaultSettings_8php.html#a75612877f528cecdb711d45fa25588ee">$wgVerifyMimeType</a></div><div class="ttdeci">$wgVerifyMimeType</div><div class="ttdoc">Determines if the MIME type of uploaded files should be checked. </div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l01289">DefaultSettings.php:1289</a></div></div> <div class="ttc" id="DefaultSettings_8php_html_a8775ad8dc715863ccf18c544d305670a"><div class="ttname"><a href="DefaultSettings_8php.html#a8775ad8dc715863ccf18c544d305670a">$wgFileBlacklist</a></div><div class="ttdeci">$wgFileBlacklist</div><div class="ttdoc">Files with these extensions will never be allowed as uploads. </div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l00873">DefaultSettings.php:873</a></div></div> <div class="ttc" id="classApiQueryImageInfo_html_a611c5e450f742dfa90aa802bf5b86c34"><div class="ttname"><a href="classApiQueryImageInfo.html#a611c5e450f742dfa90aa802bf5b86c34">ApiQueryImageInfo\getInfo</a></div><div class="ttdeci">static getInfo($file, $prop, $result, $thumbParams=null, $opts=false)</div><div class="ttdoc">Get result information for an image revision. </div><div class="ttdef"><b>Definition:</b> <a href="ApiQueryImageInfo_8php_source.html#l00360">ApiQueryImageInfo.php:360</a></div></div> <div class="ttc" id="classUploadBase_html_aaf9222d1c1e2cea503ffed7044ee01af"><div class="ttname"><a href="classUploadBase.html#aaf9222d1c1e2cea503ffed7044ee01af">UploadBase\$mLocalFile</a></div><div class="ttdeci">$mLocalFile</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00047">UploadBase.php:47</a></div></div> <div class="ttc" id="hooks_8txt_html_ac2ead7e8a992de6c5d4efa814a3d4c6b"><div class="ttname"><a href="hooks_8txt.html#ac2ead7e8a992de6c5d4efa814a3d4c6b">page</a></div><div class="ttdeci">do that in ParserLimitReportFormat instead use this to modify the parameters of the image and a DIV can begin in one section and end in another Make sure your code can handle that case gracefully See the EditSectionClearerLink extension for an example zero but section is usually empty its values are the globals values before the output is cached my talk page</div><div class="ttdef"><b>Definition:</b> <a href="hooks_8txt_source.html#l02506">hooks.txt:2506</a></div></div> <div class="ttc" id="classUploadBase_html_a149edc19abce49ba9de3521a7ea14dc8"><div class="ttname"><a href="classUploadBase.html#a149edc19abce49ba9de3521a7ea14dc8">UploadBase\EMPTY_FILE</a></div><div class="ttdeci">const EMPTY_FILE</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00070">UploadBase.php:70</a></div></div> <div class="ttc" id="classTitle_html_ae89bd391627ac34c9f943a1607f15928"><div class="ttname"><a href="classTitle.html#ae89bd391627ac34c9f943a1607f15928">Title\makeTitle</a></div><div class="ttdeci">static makeTitle($ns, $title, $fragment= '', $interwiki= '')</div><div class="ttdoc">Create a new Title from a namespace index and a DB key. </div><div class="ttdef"><b>Definition:</b> <a href="Title_8php_source.html#l00511">Title.php:511</a></div></div> <div class="ttc" id="namespaceMWException_html"><div class="ttname"><a href="namespaceMWException.html">MWException</a></div></div> <div class="ttc" id="classTitle_html_a20fdcacfb6f560717c2036d5113cf228"><div class="ttname"><a href="classTitle.html#a20fdcacfb6f560717c2036d5113cf228">Title\capitalize</a></div><div class="ttdeci">static capitalize($text, $ns=NS_MAIN)</div><div class="ttdoc">Capitalize a text string for a title if it belongs to a namespace that capitalizes. </div><div class="ttdef"><b>Definition:</b> <a href="Title_8php_source.html#l03327">Title.php:3327</a></div></div> <div class="ttc" id="classUploadBase_html_abc8a8f8b5f21f8a5dd84279978f471e1"><div class="ttname"><a href="classUploadBase.html#abc8a8f8b5f21f8a5dd84279978f471e1">UploadBase\getTempPath</a></div><div class="ttdeci">getTempPath()</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l01062">UploadBase.php:1062</a></div></div> <div class="ttc" id="classUploadBase_html_ad537badf14243a64cb5331bafd563244"><div class="ttname"><a href="classUploadBase.html#ad537badf14243a64cb5331bafd563244">UploadBase\getRealPath</a></div><div class="ttdeci">getRealPath($srcPath)</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00300">UploadBase.php:300</a></div></div> <div class="ttc" id="classUploadBase_html_a1b77c2db3cddd7ad587aed7464524301"><div class="ttname"><a href="classUploadBase.html#a1b77c2db3cddd7ad587aed7464524301">UploadBase\initializePathInfo</a></div><div class="ttdeci">initializePathInfo($name, $tempPath, $fileSize, $removeTempFile=false)</div><div class="ttdoc">Initialize the path information. </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00230">UploadBase.php:230</a></div></div> <div class="ttc" id="namespaceUser_html"><div class="ttname"><a href="namespaceUser.html">User</a></div></div> <div class="ttc" id="classUploadBase_html_af6c491d0a6ef8295e6030d1ca60dcbcc"><div class="ttname"><a href="classUploadBase.html#af6c491d0a6ef8295e6030d1ca60dcbcc">UploadBase\checkOverwrite</a></div><div class="ttdeci">checkOverwrite($user)</div><div class="ttdoc">Check if there's an overwrite conflict and, if so, if restrictions forbid this user from performing t...</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l01808">UploadBase.php:1808</a></div></div> <div class="ttc" id="DefaultSettings_8php_html_a01c3b237a8adaa3513c952ea52cf6410"><div class="ttname"><a href="DefaultSettings_8php.html#a01c3b237a8adaa3513c952ea52cf6410">$wgAntivirus</a></div><div class="ttdeci">$wgAntivirus</div><div class="ttdoc">Internal name of virus scanner. </div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l01230">DefaultSettings.php:1230</a></div></div> <div class="ttc" id="classUploadBase_html_a76651d9c2b11bd0dc7967c0e5c7e9a35"><div class="ttname"><a href="classUploadBase.html#a76651d9c2b11bd0dc7967c0e5c7e9a35">UploadBase\$mRemoveTempFile</a></div><div class="ttdeci">$mRemoveTempFile</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00044">UploadBase.php:44</a></div></div> <div class="ttc" id="NoLocalSettings_8php_html_ae9c29842f430802929abcf142683912c"><div class="ttname"><a href="NoLocalSettings_8php.html#ae9c29842f430802929abcf142683912c">$matches</a></div><div class="ttdeci">$matches</div><div class="ttdef"><b>Definition:</b> <a href="NoLocalSettings_8php_source.html#l00024">NoLocalSettings.php:24</a></div></div> <div class="ttc" id="classUploadBase_html_a40e2f0618fea100cfccce200ec9f2389"><div class="ttname"><a href="classUploadBase.html#a40e2f0618fea100cfccce200ec9f2389">UploadBase\runUploadStashFileHook</a></div><div class="ttdeci">runUploadStashFileHook(User $user)</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00978">UploadBase.php:978</a></div></div> <div class="ttc" id="hooks_8txt_html_ae2d36f45856c4960c998f6c76c83b7a8"><div class="ttname"><a href="hooks_8txt.html#ae2d36f45856c4960c998f6c76c83b7a8">$name</a></div><div class="ttdeci">Allows to change the fields on the form that will be generated $name</div><div class="ttdef"><b>Definition:</b> <a href="hooks_8txt_source.html#l00300">hooks.txt:300</a></div></div> </div><!-- fragment --></div><!-- contents --> </div><!-- doc-content --> <!-- start footer part --> <div id="nav-path" class="navpath"><!-- id is needed for treeview function! --> <ul> <li class="navelem"><a class="el" href="dir_b0f92a87ee026d34ca8fad24187d57bf.html">includes</a></li><li class="navelem"><a class="el" href="dir_0b10f6acd4741c83db7478a14749b164.html">upload</a></li><li class="navelem"><a class="el" href="UploadBase_8php.html">UploadBase.php</a></li> <li class="footer">Generated on Mon Dec 5 2016 21:27:09 for MediaWiki by <a href="http://www.doxygen.org/index.html"> <img class="footer" src="doxygen.png" alt="doxygen"/></a> 1.8.8 </li> </ul> </div> </body> </html>