MediaWiki  master
UploadBase.php
Go to the documentation of this file.
1 <?php
24 
39 abstract class UploadBase {
41  protected $mTempPath;
43  protected $tempFileObj;
44 
46  protected $mTitle = false, $mTitleError = 0;
51 
52  protected static $safeXmlEncodings = [
53  'UTF-8',
54  'ISO-8859-1',
55  'ISO-8859-2',
56  'UTF-16',
57  'UTF-32',
58  'WINDOWS-1250',
59  'WINDOWS-1251',
60  'WINDOWS-1252',
61  'WINDOWS-1253',
62  'WINDOWS-1254',
63  'WINDOWS-1255',
64  'WINDOWS-1256',
65  'WINDOWS-1257',
66  'WINDOWS-1258',
67  ];
68 
69  const SUCCESS = 0;
70  const OK = 0;
71  const EMPTY_FILE = 3;
73  const ILLEGAL_FILENAME = 5;
74  const OVERWRITE_EXISTING_FILE = 7; # Not used anymore; handled by verifyTitlePermissions()
75  const FILETYPE_MISSING = 8;
76  const FILETYPE_BADTYPE = 9;
77  const VERIFICATION_ERROR = 10;
78  const HOOK_ABORTED = 11;
79  const FILE_TOO_LARGE = 12;
81  const FILENAME_TOO_LONG = 14;
82 
88  $code_to_status = [
89  self::EMPTY_FILE => 'empty-file',
90  self::FILE_TOO_LARGE => 'file-too-large',
91  self::FILETYPE_MISSING => 'filetype-missing',
92  self::FILETYPE_BADTYPE => 'filetype-banned',
93  self::MIN_LENGTH_PARTNAME => 'filename-tooshort',
94  self::ILLEGAL_FILENAME => 'illegal-filename',
95  self::OVERWRITE_EXISTING_FILE => 'overwrite',
96  self::VERIFICATION_ERROR => 'verification-error',
97  self::HOOK_ABORTED => 'hookaborted',
98  self::WINDOWS_NONASCII_FILENAME => 'windows-nonascii-filename',
99  self::FILENAME_TOO_LONG => 'filename-toolong',
100  ];
101  if ( isset( $code_to_status[$error] ) ) {
102  return $code_to_status[$error];
103  }
104 
105  return 'unknown-error';
106  }
107 
113  public static function isEnabled() {
115 
116  if ( !$wgEnableUploads ) {
117  return false;
118  }
119 
120  # Check php's file_uploads setting
121  return wfIsHHVM() || wfIniGetBool( 'file_uploads' );
122  }
123 
132  public static function isAllowed( $user ) {
133  foreach ( [ 'upload', 'edit' ] as $permission ) {
134  if ( !$user->isAllowed( $permission ) ) {
135  return $permission;
136  }
137  }
138 
139  return true;
140  }
141 
148  public static function isThrottled( $user ) {
149  return $user->pingLimiter( 'upload' );
150  }
151 
152  // Upload handlers. Should probably just be a global.
153  private static $uploadHandlers = [ 'Stash', 'File', 'Url' ];
154 
162  public static function createFromRequest( &$request, $type = null ) {
163  $type = $type ? $type : $request->getVal( 'wpSourceType', 'File' );
164 
165  if ( !$type ) {
166  return null;
167  }
168 
169  // Get the upload class
170  $type = ucfirst( $type );
171 
172  // Give hooks the chance to handle this request
173  $className = null;
174  Hooks::run( 'UploadCreateFromRequest', [ $type, &$className ] );
175  if ( is_null( $className ) ) {
176  $className = 'UploadFrom' . $type;
177  wfDebug( __METHOD__ . ": class name: $className\n" );
178  if ( !in_array( $type, self::$uploadHandlers ) ) {
179  return null;
180  }
181  }
182 
183  // Check whether this upload class is enabled
184  if ( !call_user_func( [ $className, 'isEnabled' ] ) ) {
185  return null;
186  }
187 
188  // Check whether the request is valid
189  if ( !call_user_func( [ $className, 'isValidRequest' ], $request ) ) {
190  return null;
191  }
192 
194  $handler = new $className;
195 
196  $handler->initializeFromRequest( $request );
197 
198  return $handler;
199  }
200 
206  public static function isValidRequest( $request ) {
207  return false;
208  }
209 
210  public function __construct() {
211  }
212 
219  public function getSourceType() {
220  return null;
221  }
222 
231  public function initializePathInfo( $name, $tempPath, $fileSize, $removeTempFile = false ) {
232  $this->mDesiredDestName = $name;
233  if ( FileBackend::isStoragePath( $tempPath ) ) {
234  throw new MWException( __METHOD__ . " given storage path `$tempPath`." );
235  }
236 
237  $this->setTempFile( $tempPath, $fileSize );
238  $this->mRemoveTempFile = $removeTempFile;
239  }
240 
246  abstract public function initializeFromRequest( &$request );
247 
252  protected function setTempFile( $tempPath, $fileSize = null ) {
253  $this->mTempPath = $tempPath;
254  $this->mFileSize = $fileSize ?: null;
255  if ( strlen( $this->mTempPath ) && file_exists( $this->mTempPath ) ) {
256  $this->tempFileObj = new TempFSFile( $this->mTempPath );
257  if ( !$fileSize ) {
258  $this->mFileSize = filesize( $this->mTempPath );
259  }
260  } else {
261  $this->tempFileObj = null;
262  }
263  }
264 
269  public function fetchFile() {
270  return Status::newGood();
271  }
272 
277  public function isEmptyFile() {
278  return empty( $this->mFileSize );
279  }
280 
285  public function getFileSize() {
286  return $this->mFileSize;
287  }
288 
293  public function getTempFileSha1Base36() {
294  return FSFile::getSha1Base36FromPath( $this->mTempPath );
295  }
296 
301  public function getRealPath( $srcPath ) {
302  $repo = RepoGroup::singleton()->getLocalRepo();
303  if ( $repo->isVirtualUrl( $srcPath ) ) {
307  $tmpFile = $repo->getLocalCopy( $srcPath );
308  if ( $tmpFile ) {
309  $tmpFile->bind( $this ); // keep alive with $this
310  }
311  $path = $tmpFile ? $tmpFile->getPath() : false;
312  } else {
313  $path = $srcPath;
314  }
315 
316  return $path;
317  }
318 
323  public function verifyUpload() {
324 
328  if ( $this->isEmptyFile() ) {
329  return [ 'status' => self::EMPTY_FILE ];
330  }
331 
335  $maxSize = self::getMaxUploadSize( $this->getSourceType() );
336  if ( $this->mFileSize > $maxSize ) {
337  return [
338  'status' => self::FILE_TOO_LARGE,
339  'max' => $maxSize,
340  ];
341  }
342 
348  $verification = $this->verifyFile();
349  if ( $verification !== true ) {
350  return [
351  'status' => self::VERIFICATION_ERROR,
352  'details' => $verification
353  ];
354  }
355 
359  $result = $this->validateName();
360  if ( $result !== true ) {
361  return $result;
362  }
363 
364  $error = '';
365  if ( !Hooks::run( 'UploadVerification',
366  [ $this->mDestName, $this->mTempPath, &$error ], '1.28' )
367  ) {
368  return [ 'status' => self::HOOK_ABORTED, 'error' => $error ];
369  }
370 
371  return [ 'status' => self::OK ];
372  }
373 
380  public function validateName() {
381  $nt = $this->getTitle();
382  if ( is_null( $nt ) ) {
383  $result = [ 'status' => $this->mTitleError ];
384  if ( $this->mTitleError == self::ILLEGAL_FILENAME ) {
385  $result['filtered'] = $this->mFilteredName;
386  }
387  if ( $this->mTitleError == self::FILETYPE_BADTYPE ) {
388  $result['finalExt'] = $this->mFinalExtension;
389  if ( count( $this->mBlackListedExtensions ) ) {
390  $result['blacklistedExt'] = $this->mBlackListedExtensions;
391  }
392  }
393 
394  return $result;
395  }
396  $this->mDestName = $this->getLocalFile()->getName();
397 
398  return true;
399  }
400 
410  protected function verifyMimeType( $mime ) {
412  if ( $wgVerifyMimeType ) {
413  wfDebug( "mime: <$mime> extension: <{$this->mFinalExtension}>\n" );
415  if ( $this->checkFileExtension( $mime, $wgMimeTypeBlacklist ) ) {
416  return [ 'filetype-badmime', $mime ];
417  }
418 
419  # Check what Internet Explorer would detect
420  $fp = fopen( $this->mTempPath, 'rb' );
421  $chunk = fread( $fp, 256 );
422  fclose( $fp );
423 
424  $magic = MimeMagic::singleton();
425  $extMime = $magic->guessTypesForExtension( $this->mFinalExtension );
426  $ieTypes = $magic->getIEMimeTypes( $this->mTempPath, $chunk, $extMime );
427  foreach ( $ieTypes as $ieType ) {
428  if ( $this->checkFileExtension( $ieType, $wgMimeTypeBlacklist ) ) {
429  return [ 'filetype-bad-ie-mime', $ieType ];
430  }
431  }
432  }
433 
434  return true;
435  }
436 
442  protected function verifyFile() {
444 
445  $status = $this->verifyPartialFile();
446  if ( $status !== true ) {
447  return $status;
448  }
449 
450  $mwProps = new MWFileProps( MimeMagic::singleton() );
451  $this->mFileProps = $mwProps->getPropsFromPath( $this->mTempPath, $this->mFinalExtension );
452  $mime = $this->mFileProps['mime'];
453 
454  if ( $wgVerifyMimeType ) {
455  # XXX: Missing extension will be caught by validateName() via getTitle()
456  if ( $this->mFinalExtension != '' && !$this->verifyExtension( $mime, $this->mFinalExtension ) ) {
457  return [ 'filetype-mime-mismatch', $this->mFinalExtension, $mime ];
458  }
459  }
460 
461  # check for htmlish code and javascript
462  if ( !$wgDisableUploadScriptChecks ) {
463  if ( $this->mFinalExtension == 'svg' || $mime == 'image/svg+xml' ) {
464  $svgStatus = $this->detectScriptInSvg( $this->mTempPath, false );
465  if ( $svgStatus !== false ) {
466  return $svgStatus;
467  }
468  }
469  }
470 
472  if ( $handler ) {
473  $handlerStatus = $handler->verifyUpload( $this->mTempPath );
474  if ( !$handlerStatus->isOK() ) {
475  $errors = $handlerStatus->getErrorsArray();
476 
477  return reset( $errors );
478  }
479  }
480 
481  $error = true;
482  Hooks::run( 'UploadVerifyFile', [ $this, $mime, &$error ] );
483  if ( $error !== true ) {
484  if ( !is_array( $error ) ) {
485  $error = [ $error ];
486  }
487  return $error;
488  }
489 
490  wfDebug( __METHOD__ . ": all clear; passing.\n" );
491 
492  return true;
493  }
494 
503  protected function verifyPartialFile() {
505 
506  # getTitle() sets some internal parameters like $this->mFinalExtension
507  $this->getTitle();
508 
509  $mwProps = new MWFileProps( MimeMagic::singleton() );
510  $this->mFileProps = $mwProps->getPropsFromPath( $this->mTempPath, $this->mFinalExtension );
511 
512  # check MIME type, if desired
513  $mime = $this->mFileProps['file-mime'];
514  $status = $this->verifyMimeType( $mime );
515  if ( $status !== true ) {
516  return $status;
517  }
518 
519  # check for htmlish code and javascript
520  if ( !$wgDisableUploadScriptChecks ) {
521  if ( self::detectScript( $this->mTempPath, $mime, $this->mFinalExtension ) ) {
522  return [ 'uploadscripted' ];
523  }
524  if ( $this->mFinalExtension == 'svg' || $mime == 'image/svg+xml' ) {
525  $svgStatus = $this->detectScriptInSvg( $this->mTempPath, true );
526  if ( $svgStatus !== false ) {
527  return $svgStatus;
528  }
529  }
530  }
531 
532  # Check for Java applets, which if uploaded can bypass cross-site
533  # restrictions.
534  if ( !$wgAllowJavaUploads ) {
535  $this->mJavaDetected = false;
536  $zipStatus = ZipDirectoryReader::read( $this->mTempPath,
537  [ $this, 'zipEntryCallback' ] );
538  if ( !$zipStatus->isOK() ) {
539  $errors = $zipStatus->getErrorsArray();
540  $error = reset( $errors );
541  if ( $error[0] !== 'zip-wrong-format' ) {
542  return $error;
543  }
544  }
545  if ( $this->mJavaDetected ) {
546  return [ 'uploadjava' ];
547  }
548  }
549 
550  # Scan the uploaded file for viruses
551  $virus = $this->detectVirus( $this->mTempPath );
552  if ( $virus ) {
553  return [ 'uploadvirus', $virus ];
554  }
555 
556  return true;
557  }
558 
564  public function zipEntryCallback( $entry ) {
565  $names = [ $entry['name'] ];
566 
567  // If there is a null character, cut off the name at it, because JDK's
568  // ZIP_GetEntry() uses strcmp() if the name hashes match. If a file name
569  // were constructed which had ".class\0" followed by a string chosen to
570  // make the hash collide with the truncated name, that file could be
571  // returned in response to a request for the .class file.
572  $nullPos = strpos( $entry['name'], "\000" );
573  if ( $nullPos !== false ) {
574  $names[] = substr( $entry['name'], 0, $nullPos );
575  }
576 
577  // If there is a trailing slash in the file name, we have to strip it,
578  // because that's what ZIP_GetEntry() does.
579  if ( preg_grep( '!\.class/?$!', $names ) ) {
580  $this->mJavaDetected = true;
581  }
582  }
583 
593  public function verifyPermissions( $user ) {
594  return $this->verifyTitlePermissions( $user );
595  }
596 
608  public function verifyTitlePermissions( $user ) {
613  $nt = $this->getTitle();
614  if ( is_null( $nt ) ) {
615  return true;
616  }
617  $permErrors = $nt->getUserPermissionsErrors( 'edit', $user );
618  $permErrorsUpload = $nt->getUserPermissionsErrors( 'upload', $user );
619  if ( !$nt->exists() ) {
620  $permErrorsCreate = $nt->getUserPermissionsErrors( 'create', $user );
621  } else {
622  $permErrorsCreate = [];
623  }
624  if ( $permErrors || $permErrorsUpload || $permErrorsCreate ) {
625  $permErrors = array_merge( $permErrors, wfArrayDiff2( $permErrorsUpload, $permErrors ) );
626  $permErrors = array_merge( $permErrors, wfArrayDiff2( $permErrorsCreate, $permErrors ) );
627 
628  return $permErrors;
629  }
630 
631  $overwriteError = $this->checkOverwrite( $user );
632  if ( $overwriteError !== true ) {
633  return [ $overwriteError ];
634  }
635 
636  return true;
637  }
638 
646  public function checkWarnings() {
647  global $wgLang;
648 
649  $warnings = [];
650 
651  $localFile = $this->getLocalFile();
652  $localFile->load( File::READ_LATEST );
653  $filename = $localFile->getName();
654 
659  $comparableName = str_replace( ' ', '_', $this->mDesiredDestName );
660  $comparableName = Title::capitalize( $comparableName, NS_FILE );
661 
662  if ( $this->mDesiredDestName != $filename && $comparableName != $filename ) {
663  $warnings['badfilename'] = $filename;
664  }
665 
666  // Check whether the file extension is on the unwanted list
668  if ( $wgCheckFileExtensions ) {
669  $extensions = array_unique( $wgFileExtensions );
670  if ( !$this->checkFileExtension( $this->mFinalExtension, $extensions ) ) {
671  $warnings['filetype-unwanted-type'] = [ $this->mFinalExtension,
672  $wgLang->commaList( $extensions ), count( $extensions ) ];
673  }
674  }
675 
677  if ( $wgUploadSizeWarning && ( $this->mFileSize > $wgUploadSizeWarning ) ) {
678  $warnings['large-file'] = [ $wgUploadSizeWarning, $this->mFileSize ];
679  }
680 
681  if ( $this->mFileSize == 0 ) {
682  $warnings['empty-file'] = true;
683  }
684 
685  $hash = $this->getTempFileSha1Base36();
686  $exists = self::getExistsWarning( $localFile );
687  if ( $exists !== false ) {
688  $warnings['exists'] = $exists;
689 
690  // check if file is an exact duplicate of current file version
691  if ( $hash === $localFile->getSha1() ) {
692  $warnings['no-change'] = $localFile;
693  }
694 
695  // check if file is an exact duplicate of older versions of this file
696  $history = $localFile->getHistory();
697  foreach ( $history as $oldFile ) {
698  if ( $hash === $oldFile->getSha1() ) {
699  $warnings['duplicate-version'][] = $oldFile;
700  }
701  }
702  }
703 
704  if ( $localFile->wasDeleted() && !$localFile->exists() ) {
705  $warnings['was-deleted'] = $filename;
706  }
707 
708  // Check dupes against existing files
709  $dupes = RepoGroup::singleton()->findBySha1( $hash );
710  $title = $this->getTitle();
711  // Remove all matches against self
712  foreach ( $dupes as $key => $dupe ) {
713  if ( $title->equals( $dupe->getTitle() ) ) {
714  unset( $dupes[$key] );
715  }
716  }
717  if ( $dupes ) {
718  $warnings['duplicate'] = $dupes;
719  }
720 
721  // Check dupes against archives
722  $archivedFile = new ArchivedFile( null, 0, '', $hash );
723  if ( $archivedFile->getID() > 0 ) {
724  if ( $archivedFile->userCan( File::DELETED_FILE ) ) {
725  $warnings['duplicate-archive'] = $archivedFile->getName();
726  } else {
727  $warnings['duplicate-archive'] = '';
728  }
729  }
730 
731  return $warnings;
732  }
733 
747  public function performUpload( $comment, $pageText, $watch, $user, $tags = [] ) {
748  $this->getLocalFile()->load( File::READ_LATEST );
749  $props = $this->mFileProps;
750 
751  $error = null;
752  Hooks::run( 'UploadVerifyUpload', [ $this, $user, $props, $comment, $pageText, &$error ] );
753  if ( $error ) {
754  if ( !is_array( $error ) ) {
755  $error = [ $error ];
756  }
757  return call_user_func_array( 'Status::newFatal', $error );
758  }
759 
760  $status = $this->getLocalFile()->upload(
761  $this->mTempPath,
762  $comment,
763  $pageText,
765  $props,
766  false,
767  $user,
768  $tags
769  );
770 
771  if ( $status->isGood() ) {
772  if ( $watch ) {
774  $this->getLocalFile()->getTitle(),
775  $user,
777  );
778  }
779  // Avoid PHP 7.1 warning of passing $this by reference
780  $uploadBase = $this;
781  Hooks::run( 'UploadComplete', [ &$uploadBase ] );
782 
783  $this->postProcessUpload();
784  }
785 
786  return $status;
787  }
788 
794  public function postProcessUpload() {
795  }
796 
803  public function getTitle() {
804  if ( $this->mTitle !== false ) {
805  return $this->mTitle;
806  }
807  if ( !is_string( $this->mDesiredDestName ) ) {
808  $this->mTitleError = self::ILLEGAL_FILENAME;
809  $this->mTitle = null;
810 
811  return $this->mTitle;
812  }
813  /* Assume that if a user specified File:Something.jpg, this is an error
814  * and that the namespace prefix needs to be stripped of.
815  */
816  $title = Title::newFromText( $this->mDesiredDestName );
817  if ( $title && $title->getNamespace() == NS_FILE ) {
818  $this->mFilteredName = $title->getDBkey();
819  } else {
820  $this->mFilteredName = $this->mDesiredDestName;
821  }
822 
823  # oi_archive_name is max 255 bytes, which include a timestamp and an
824  # exclamation mark, so restrict file name to 240 bytes.
825  if ( strlen( $this->mFilteredName ) > 240 ) {
826  $this->mTitleError = self::FILENAME_TOO_LONG;
827  $this->mTitle = null;
828 
829  return $this->mTitle;
830  }
831 
837  $this->mFilteredName = wfStripIllegalFilenameChars( $this->mFilteredName );
838  /* Normalize to title form before we do any further processing */
839  $nt = Title::makeTitleSafe( NS_FILE, $this->mFilteredName );
840  if ( is_null( $nt ) ) {
841  $this->mTitleError = self::ILLEGAL_FILENAME;
842  $this->mTitle = null;
843 
844  return $this->mTitle;
845  }
846  $this->mFilteredName = $nt->getDBkey();
847 
852  list( $partname, $ext ) = $this->splitExtensions( $this->mFilteredName );
853 
854  if ( count( $ext ) ) {
855  $this->mFinalExtension = trim( $ext[count( $ext ) - 1] );
856  } else {
857  $this->mFinalExtension = '';
858 
859  # No extension, try guessing one
860  $magic = MimeMagic::singleton();
861  $mime = $magic->guessMimeType( $this->mTempPath );
862  if ( $mime !== 'unknown/unknown' ) {
863  # Get a space separated list of extensions
864  $extList = $magic->getExtensionsForType( $mime );
865  if ( $extList ) {
866  # Set the extension to the canonical extension
867  $this->mFinalExtension = strtok( $extList, ' ' );
868 
869  # Fix up the other variables
870  $this->mFilteredName .= ".{$this->mFinalExtension}";
871  $nt = Title::makeTitleSafe( NS_FILE, $this->mFilteredName );
873  }
874  }
875  }
876 
877  /* Don't allow users to override the blacklist (check file extension) */
880 
881  $blackListedExtensions = $this->checkFileExtensionList( $ext, $wgFileBlacklist );
882 
883  if ( $this->mFinalExtension == '' ) {
884  $this->mTitleError = self::FILETYPE_MISSING;
885  $this->mTitle = null;
886 
887  return $this->mTitle;
888  } elseif ( $blackListedExtensions ||
889  ( $wgCheckFileExtensions && $wgStrictFileExtensions &&
890  !$this->checkFileExtension( $this->mFinalExtension, $wgFileExtensions ) )
891  ) {
892  $this->mBlackListedExtensions = $blackListedExtensions;
893  $this->mTitleError = self::FILETYPE_BADTYPE;
894  $this->mTitle = null;
895 
896  return $this->mTitle;
897  }
898 
899  // Windows may be broken with special characters, see T3780
900  if ( !preg_match( '/^[\x0-\x7f]*$/', $nt->getText() )
901  && !RepoGroup::singleton()->getLocalRepo()->backendSupportsUnicodePaths()
902  ) {
903  $this->mTitleError = self::WINDOWS_NONASCII_FILENAME;
904  $this->mTitle = null;
905 
906  return $this->mTitle;
907  }
908 
909  # If there was more than one "extension", reassemble the base
910  # filename to prevent bogus complaints about length
911  if ( count( $ext ) > 1 ) {
912  $iterations = count( $ext ) - 1;
913  for ( $i = 0; $i < $iterations; $i++ ) {
914  $partname .= '.' . $ext[$i];
915  }
916  }
917 
918  if ( strlen( $partname ) < 1 ) {
919  $this->mTitleError = self::MIN_LENGTH_PARTNAME;
920  $this->mTitle = null;
921 
922  return $this->mTitle;
923  }
924 
925  $this->mTitle = $nt;
926 
927  return $this->mTitle;
928  }
929 
935  public function getLocalFile() {
936  if ( is_null( $this->mLocalFile ) ) {
937  $nt = $this->getTitle();
938  $this->mLocalFile = is_null( $nt ) ? null : wfLocalFile( $nt );
939  }
940 
941  return $this->mLocalFile;
942  }
943 
947  public function getStashFile() {
948  return $this->mStashFile;
949  }
950 
962  public function tryStashFile( User $user, $isPartial = false ) {
963  if ( !$isPartial ) {
964  $error = $this->runUploadStashFileHook( $user );
965  if ( $error ) {
966  return call_user_func_array( 'Status::newFatal', $error );
967  }
968  }
969  try {
970  $file = $this->doStashFile( $user );
971  return Status::newGood( $file );
972  } catch ( UploadStashException $e ) {
973  return Status::newFatal( 'uploadstash-exception', get_class( $e ), $e->getMessage() );
974  }
975  }
976 
981  protected function runUploadStashFileHook( User $user ) {
982  $props = $this->mFileProps;
983  $error = null;
984  Hooks::run( 'UploadStashFile', [ $this, $user, $props, &$error ] );
985  if ( $error ) {
986  if ( !is_array( $error ) ) {
987  $error = [ $error ];
988  }
989  }
990  return $error;
991  }
992 
1012  public function stashFile( User $user = null ) {
1013  return $this->doStashFile( $user );
1014  }
1015 
1022  protected function doStashFile( User $user = null ) {
1023  $stash = RepoGroup::singleton()->getLocalRepo()->getUploadStash( $user );
1024  $file = $stash->stashFile( $this->mTempPath, $this->getSourceType() );
1025  $this->mStashFile = $file;
1026 
1027  return $file;
1028  }
1029 
1037  public function stashFileGetKey() {
1038  wfDeprecated( __METHOD__, '1.28' );
1039  return $this->doStashFile()->getFileKey();
1040  }
1041 
1048  public function stashSession() {
1049  wfDeprecated( __METHOD__, '1.28' );
1050  return $this->doStashFile()->getFileKey();
1051  }
1052 
1057  public function cleanupTempFile() {
1058  if ( $this->mRemoveTempFile && $this->tempFileObj ) {
1059  // Delete when all relevant TempFSFile handles go out of scope
1060  wfDebug( __METHOD__ . ": Marked temporary file '{$this->mTempPath}' for removal\n" );
1061  $this->tempFileObj->autocollect();
1062  }
1063  }
1064 
1065  public function getTempPath() {
1066  return $this->mTempPath;
1067  }
1068 
1078  public static function splitExtensions( $filename ) {
1079  $bits = explode( '.', $filename );
1080  $basename = array_shift( $bits );
1081 
1082  return [ $basename, $bits ];
1083  }
1084 
1093  public static function checkFileExtension( $ext, $list ) {
1094  return in_array( strtolower( $ext ), $list );
1095  }
1096 
1105  public static function checkFileExtensionList( $ext, $list ) {
1106  return array_intersect( array_map( 'strtolower', $ext ), $list );
1107  }
1108 
1116  public static function verifyExtension( $mime, $extension ) {
1117  $magic = MimeMagic::singleton();
1118 
1119  if ( !$mime || $mime == 'unknown' || $mime == 'unknown/unknown' ) {
1120  if ( !$magic->isRecognizableExtension( $extension ) ) {
1121  wfDebug( __METHOD__ . ": passing file with unknown detected mime type; " .
1122  "unrecognized extension '$extension', can't verify\n" );
1123 
1124  return true;
1125  } else {
1126  wfDebug( __METHOD__ . ": rejecting file with unknown detected mime type; " .
1127  "recognized extension '$extension', so probably invalid file\n" );
1128 
1129  return false;
1130  }
1131  }
1132 
1133  $match = $magic->isMatchingExtension( $extension, $mime );
1134 
1135  if ( $match === null ) {
1136  if ( $magic->getTypesForExtension( $extension ) !== null ) {
1137  wfDebug( __METHOD__ . ": No extension known for $mime, but we know a mime for $extension\n" );
1138 
1139  return false;
1140  } else {
1141  wfDebug( __METHOD__ . ": no file extension known for mime type $mime, passing file\n" );
1142 
1143  return true;
1144  }
1145  } elseif ( $match === true ) {
1146  wfDebug( __METHOD__ . ": mime type $mime matches extension $extension, passing file\n" );
1147 
1149  return true;
1150  } else {
1151  wfDebug( __METHOD__
1152  . ": mime type $mime mismatches file extension $extension, rejecting file\n" );
1153 
1154  return false;
1155  }
1156  }
1157 
1169  public static function detectScript( $file, $mime, $extension ) {
1171 
1172  # ugly hack: for text files, always look at the entire file.
1173  # For binary field, just check the first K.
1174 
1175  if ( strpos( $mime, 'text/' ) === 0 ) {
1176  $chunk = file_get_contents( $file );
1177  } else {
1178  $fp = fopen( $file, 'rb' );
1179  $chunk = fread( $fp, 1024 );
1180  fclose( $fp );
1181  }
1182 
1183  $chunk = strtolower( $chunk );
1184 
1185  if ( !$chunk ) {
1186  return false;
1187  }
1188 
1189  # decode from UTF-16 if needed (could be used for obfuscation).
1190  if ( substr( $chunk, 0, 2 ) == "\xfe\xff" ) {
1191  $enc = 'UTF-16BE';
1192  } elseif ( substr( $chunk, 0, 2 ) == "\xff\xfe" ) {
1193  $enc = 'UTF-16LE';
1194  } else {
1195  $enc = null;
1196  }
1197 
1198  if ( $enc ) {
1199  $chunk = iconv( $enc, "ASCII//IGNORE", $chunk );
1200  }
1201 
1202  $chunk = trim( $chunk );
1203 
1205  wfDebug( __METHOD__ . ": checking for embedded scripts and HTML stuff\n" );
1206 
1207  # check for HTML doctype
1208  if ( preg_match( "/<!DOCTYPE *X?HTML/i", $chunk ) ) {
1209  return true;
1210  }
1211 
1212  // Some browsers will interpret obscure xml encodings as UTF-8, while
1213  // PHP/expat will interpret the given encoding in the xml declaration (T49304)
1214  if ( $extension == 'svg' || strpos( $mime, 'image/svg' ) === 0 ) {
1215  if ( self::checkXMLEncodingMissmatch( $file ) ) {
1216  return true;
1217  }
1218  }
1219 
1235  $tags = [
1236  '<a href',
1237  '<body',
1238  '<head',
1239  '<html', # also in safari
1240  '<img',
1241  '<pre',
1242  '<script', # also in safari
1243  '<table'
1244  ];
1245 
1246  if ( !$wgAllowTitlesInSVG && $extension !== 'svg' && $mime !== 'image/svg' ) {
1247  $tags[] = '<title';
1248  }
1249 
1250  foreach ( $tags as $tag ) {
1251  if ( false !== strpos( $chunk, $tag ) ) {
1252  wfDebug( __METHOD__ . ": found something that may make it be mistaken for html: $tag\n" );
1253 
1254  return true;
1255  }
1256  }
1257 
1258  /*
1259  * look for JavaScript
1260  */
1261 
1262  # resolve entity-refs to look at attributes. may be harsh on big files... cache result?
1263  $chunk = Sanitizer::decodeCharReferences( $chunk );
1264 
1265  # look for script-types
1266  if ( preg_match( '!type\s*=\s*[\'"]?\s*(?:\w*/)?(?:ecma|java)!sim', $chunk ) ) {
1267  wfDebug( __METHOD__ . ": found script types\n" );
1268 
1269  return true;
1270  }
1271 
1272  # look for html-style script-urls
1273  if ( preg_match( '!(?:href|src|data)\s*=\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) ) {
1274  wfDebug( __METHOD__ . ": found html-style script urls\n" );
1275 
1276  return true;
1277  }
1278 
1279  # look for css-style script-urls
1280  if ( preg_match( '!url\s*\(\s*[\'"]?\s*(?:ecma|java)script:!sim', $chunk ) ) {
1281  wfDebug( __METHOD__ . ": found css-style script urls\n" );
1282 
1283  return true;
1284  }
1285 
1286  wfDebug( __METHOD__ . ": no scripts found\n" );
1287 
1288  return false;
1289  }
1290 
1298  public static function checkXMLEncodingMissmatch( $file ) {
1300  $contents = file_get_contents( $file, false, null, -1, $wgSVGMetadataCutoff );
1301  $encodingRegex = '!encoding[ \t\n\r]*=[ \t\n\r]*[\'"](.*?)[\'"]!si';
1302 
1303  if ( preg_match( "!<\?xml\b(.*?)\?>!si", $contents, $matches ) ) {
1304  if ( preg_match( $encodingRegex, $matches[1], $encMatch )
1305  && !in_array( strtoupper( $encMatch[1] ), self::$safeXmlEncodings )
1306  ) {
1307  wfDebug( __METHOD__ . ": Found unsafe XML encoding '{$encMatch[1]}'\n" );
1308 
1309  return true;
1310  }
1311  } elseif ( preg_match( "!<\?xml\b!si", $contents ) ) {
1312  // Start of XML declaration without an end in the first $wgSVGMetadataCutoff
1313  // bytes. There shouldn't be a legitimate reason for this to happen.
1314  wfDebug( __METHOD__ . ": Unmatched XML declaration start\n" );
1315 
1316  return true;
1317  } elseif ( substr( $contents, 0, 4 ) == "\x4C\x6F\xA7\x94" ) {
1318  // EBCDIC encoded XML
1319  wfDebug( __METHOD__ . ": EBCDIC Encoded XML\n" );
1320 
1321  return true;
1322  }
1323 
1324  // It's possible the file is encoded with multi-byte encoding, so re-encode attempt to
1325  // detect the encoding in case is specifies an encoding not whitelisted in self::$safeXmlEncodings
1326  $attemptEncodings = [ 'UTF-16', 'UTF-16BE', 'UTF-32', 'UTF-32BE' ];
1327  foreach ( $attemptEncodings as $encoding ) {
1328  MediaWiki\suppressWarnings();
1329  $str = iconv( $encoding, 'UTF-8', $contents );
1330  MediaWiki\restoreWarnings();
1331  if ( $str != '' && preg_match( "!<\?xml\b(.*?)\?>!si", $str, $matches ) ) {
1332  if ( preg_match( $encodingRegex, $matches[1], $encMatch )
1333  && !in_array( strtoupper( $encMatch[1] ), self::$safeXmlEncodings )
1334  ) {
1335  wfDebug( __METHOD__ . ": Found unsafe XML encoding '{$encMatch[1]}'\n" );
1336 
1337  return true;
1338  }
1339  } elseif ( $str != '' && preg_match( "!<\?xml\b!si", $str ) ) {
1340  // Start of XML declaration without an end in the first $wgSVGMetadataCutoff
1341  // bytes. There shouldn't be a legitimate reason for this to happen.
1342  wfDebug( __METHOD__ . ": Unmatched XML declaration start\n" );
1343 
1344  return true;
1345  }
1346  }
1347 
1348  return false;
1349  }
1350 
1356  protected function detectScriptInSvg( $filename, $partial ) {
1357  $this->mSVGNSError = false;
1358  $check = new XmlTypeCheck(
1359  $filename,
1360  [ $this, 'checkSvgScriptCallback' ],
1361  true,
1362  [
1363  'processing_instruction_handler' => 'UploadBase::checkSvgPICallback',
1364  'external_dtd_handler' => 'UploadBase::checkSvgExternalDTD',
1365  ]
1366  );
1367  if ( $check->wellFormed !== true ) {
1368  // Invalid xml (T60553)
1369  // But only when non-partial (T67724)
1370  return $partial ? false : [ 'uploadinvalidxml' ];
1371  } elseif ( $check->filterMatch ) {
1372  if ( $this->mSVGNSError ) {
1373  return [ 'uploadscriptednamespace', $this->mSVGNSError ];
1374  }
1375 
1376  return $check->filterMatchType;
1377  }
1378 
1379  return false;
1380  }
1381 
1388  public static function checkSvgPICallback( $target, $data ) {
1389  // Don't allow external stylesheets (T59550)
1390  if ( preg_match( '/xml-stylesheet/i', $target ) ) {
1391  return [ 'upload-scripted-pi-callback' ];
1392  }
1393 
1394  return false;
1395  }
1396 
1407  public static function checkSvgExternalDTD( $type, $publicId, $systemId ) {
1408  // This doesn't include the XHTML+MathML+SVG doctype since we don't
1409  // allow XHTML anyways.
1410  $allowedDTDs = [
1411  'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd',
1412  'http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd',
1413  'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-basic.dtd',
1414  'http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd'
1415  ];
1416  if ( $type !== 'PUBLIC'
1417  || !in_array( $systemId, $allowedDTDs )
1418  || strpos( $publicId, "-//W3C//" ) !== 0
1419  ) {
1420  return [ 'upload-scripted-dtd' ];
1421  }
1422  return false;
1423  }
1424 
1431  public function checkSvgScriptCallback( $element, $attribs, $data = null ) {
1432 
1433  list( $namespace, $strippedElement ) = $this->splitXmlNamespace( $element );
1434 
1435  // We specifically don't include:
1436  // http://www.w3.org/1999/xhtml (T62771)
1437  static $validNamespaces = [
1438  '',
1439  'adobe:ns:meta/',
1440  'http://creativecommons.org/ns#',
1441  'http://inkscape.sourceforge.net/dtd/sodipodi-0.dtd',
1442  'http://ns.adobe.com/adobeillustrator/10.0/',
1443  'http://ns.adobe.com/adobesvgviewerextensions/3.0/',
1444  'http://ns.adobe.com/extensibility/1.0/',
1445  'http://ns.adobe.com/flows/1.0/',
1446  'http://ns.adobe.com/illustrator/1.0/',
1447  'http://ns.adobe.com/imagereplacement/1.0/',
1448  'http://ns.adobe.com/pdf/1.3/',
1449  'http://ns.adobe.com/photoshop/1.0/',
1450  'http://ns.adobe.com/saveforweb/1.0/',
1451  'http://ns.adobe.com/variables/1.0/',
1452  'http://ns.adobe.com/xap/1.0/',
1453  'http://ns.adobe.com/xap/1.0/g/',
1454  'http://ns.adobe.com/xap/1.0/g/img/',
1455  'http://ns.adobe.com/xap/1.0/mm/',
1456  'http://ns.adobe.com/xap/1.0/rights/',
1457  'http://ns.adobe.com/xap/1.0/stype/dimensions#',
1458  'http://ns.adobe.com/xap/1.0/stype/font#',
1459  'http://ns.adobe.com/xap/1.0/stype/manifestitem#',
1460  'http://ns.adobe.com/xap/1.0/stype/resourceevent#',
1461  'http://ns.adobe.com/xap/1.0/stype/resourceref#',
1462  'http://ns.adobe.com/xap/1.0/t/pg/',
1463  'http://purl.org/dc/elements/1.1/',
1464  'http://purl.org/dc/elements/1.1',
1465  'http://schemas.microsoft.com/visio/2003/svgextensions/',
1466  'http://sodipodi.sourceforge.net/dtd/sodipodi-0.dtd',
1467  'http://taptrix.com/inkpad/svg_extensions',
1468  'http://web.resource.org/cc/',
1469  'http://www.freesoftware.fsf.org/bkchem/cdml',
1470  'http://www.inkscape.org/namespaces/inkscape',
1471  'http://www.opengis.net/gml',
1472  'http://www.w3.org/1999/02/22-rdf-syntax-ns#',
1473  'http://www.w3.org/2000/svg',
1474  'http://www.w3.org/tr/rec-rdf-syntax/',
1475  'http://www.w3.org/2000/01/rdf-schema#',
1476  ];
1477 
1478  // Inkscape mangles namespace definitions created by Adobe Illustrator.
1479  // This is nasty but harmless. (T144827)
1480  $isBuggyInkscape = preg_match( '/^&(#38;)*ns_[a-z_]+;$/', $namespace );
1481 
1482  if ( !( $isBuggyInkscape || in_array( $namespace, $validNamespaces ) ) ) {
1483  wfDebug( __METHOD__ . ": Non-svg namespace '$namespace' in uploaded file.\n" );
1485  $this->mSVGNSError = $namespace;
1486 
1487  return true;
1488  }
1489 
1490  /*
1491  * check for elements that can contain javascript
1492  */
1493  if ( $strippedElement == 'script' ) {
1494  wfDebug( __METHOD__ . ": Found script element '$element' in uploaded file.\n" );
1495 
1496  return [ 'uploaded-script-svg', $strippedElement ];
1497  }
1498 
1499  # e.g., <svg xmlns="http://www.w3.org/2000/svg">
1500  # <handler xmlns:ev="http://www.w3.org/2001/xml-events" ev:event="load">alert(1)</handler> </svg>
1501  if ( $strippedElement == 'handler' ) {
1502  wfDebug( __METHOD__ . ": Found scriptable element '$element' in uploaded file.\n" );
1503 
1504  return [ 'uploaded-script-svg', $strippedElement ];
1505  }
1506 
1507  # SVG reported in Feb '12 that used xml:stylesheet to generate javascript block
1508  if ( $strippedElement == 'stylesheet' ) {
1509  wfDebug( __METHOD__ . ": Found scriptable element '$element' in uploaded file.\n" );
1510 
1511  return [ 'uploaded-script-svg', $strippedElement ];
1512  }
1513 
1514  # Block iframes, in case they pass the namespace check
1515  if ( $strippedElement == 'iframe' ) {
1516  wfDebug( __METHOD__ . ": iframe in uploaded file.\n" );
1517 
1518  return [ 'uploaded-script-svg', $strippedElement ];
1519  }
1520 
1521  # Check <style> css
1522  if ( $strippedElement == 'style'
1523  && self::checkCssFragment( Sanitizer::normalizeCss( $data ) )
1524  ) {
1525  wfDebug( __METHOD__ . ": hostile css in style element.\n" );
1526  return [ 'uploaded-hostile-svg' ];
1527  }
1528 
1529  foreach ( $attribs as $attrib => $value ) {
1530  $stripped = $this->stripXmlNamespace( $attrib );
1531  $value = strtolower( $value );
1532 
1533  if ( substr( $stripped, 0, 2 ) == 'on' ) {
1534  wfDebug( __METHOD__
1535  . ": Found event-handler attribute '$attrib'='$value' in uploaded file.\n" );
1536 
1537  return [ 'uploaded-event-handler-on-svg', $attrib, $value ];
1538  }
1539 
1540  # Do not allow relative links, or unsafe url schemas.
1541  # For <a> tags, only data:, http: and https: and same-document
1542  # fragment links are allowed. For all other tags, only data:
1543  # and fragment are allowed.
1544  if ( $stripped == 'href'
1545  && $value !== ''
1546  && strpos( $value, 'data:' ) !== 0
1547  && strpos( $value, '#' ) !== 0
1548  ) {
1549  if ( !( $strippedElement === 'a'
1550  && preg_match( '!^https?://!i', $value ) )
1551  ) {
1552  wfDebug( __METHOD__ . ": Found href attribute <$strippedElement "
1553  . "'$attrib'='$value' in uploaded file.\n" );
1554 
1555  return [ 'uploaded-href-attribute-svg', $strippedElement, $attrib, $value ];
1556  }
1557  }
1558 
1559  # only allow data: targets that should be safe. This prevents vectors like,
1560  # image/svg, text/xml, application/xml, and text/html, which can contain scripts
1561  if ( $stripped == 'href' && strncasecmp( 'data:', $value, 5 ) === 0 ) {
1562  // rfc2397 parameters. This is only slightly slower than (;[\w;]+)*.
1563  // @codingStandardsIgnoreStart Generic.Files.LineLength
1564  $parameters = '(?>;[a-zA-Z0-9\!#$&\'*+.^_`{|}~-]+=(?>[a-zA-Z0-9\!#$&\'*+.^_`{|}~-]+|"(?>[\0-\x0c\x0e-\x21\x23-\x5b\x5d-\x7f]+|\\\\[\0-\x7f])*"))*(?:;base64)?';
1565  // @codingStandardsIgnoreEnd
1566 
1567  if ( !preg_match( "!^data:\s*image/(gif|jpeg|jpg|png)$parameters,!i", $value ) ) {
1568  wfDebug( __METHOD__ . ": Found href to unwhitelisted data: uri "
1569  . "\"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" );
1570  return [ 'uploaded-href-unsafe-target-svg', $strippedElement, $attrib, $value ];
1571  }
1572  }
1573 
1574  # Change href with animate from (http://html5sec.org/#137).
1575  if ( $stripped === 'attributename'
1576  && $strippedElement === 'animate'
1577  && $this->stripXmlNamespace( $value ) == 'href'
1578  ) {
1579  wfDebug( __METHOD__ . ": Found animate that might be changing href using from "
1580  . "\"<$strippedElement '$attrib'='$value'...\" in uploaded file.\n" );
1581 
1582  return [ 'uploaded-animate-svg', $strippedElement, $attrib, $value ];
1583  }
1584 
1585  # use set/animate to add event-handler attribute to parent
1586  if ( ( $strippedElement == 'set' || $strippedElement == 'animate' )
1587  && $stripped == 'attributename'
1588  && substr( $value, 0, 2 ) == 'on'
1589  ) {
1590  wfDebug( __METHOD__ . ": Found svg setting event-handler attribute with "
1591  . "\"<$strippedElement $stripped='$value'...\" in uploaded file.\n" );
1592 
1593  return [ 'uploaded-setting-event-handler-svg', $strippedElement, $stripped, $value ];
1594  }
1595 
1596  # use set to add href attribute to parent element
1597  if ( $strippedElement == 'set'
1598  && $stripped == 'attributename'
1599  && strpos( $value, 'href' ) !== false
1600  ) {
1601  wfDebug( __METHOD__ . ": Found svg setting href attribute '$value' in uploaded file.\n" );
1602 
1603  return [ 'uploaded-setting-href-svg' ];
1604  }
1605 
1606  # use set to add a remote / data / script target to an element
1607  if ( $strippedElement == 'set'
1608  && $stripped == 'to'
1609  && preg_match( '!(http|https|data|script):!sim', $value )
1610  ) {
1611  wfDebug( __METHOD__ . ": Found svg setting attribute to '$value' in uploaded file.\n" );
1612 
1613  return [ 'uploaded-wrong-setting-svg', $value ];
1614  }
1615 
1616  # use handler attribute with remote / data / script
1617  if ( $stripped == 'handler' && preg_match( '!(http|https|data|script):!sim', $value ) ) {
1618  wfDebug( __METHOD__ . ": Found svg setting handler with remote/data/script "
1619  . "'$attrib'='$value' in uploaded file.\n" );
1620 
1621  return [ 'uploaded-setting-handler-svg', $attrib, $value ];
1622  }
1623 
1624  # use CSS styles to bring in remote code
1625  if ( $stripped == 'style'
1626  && self::checkCssFragment( Sanitizer::normalizeCss( $value ) )
1627  ) {
1628  wfDebug( __METHOD__ . ": Found svg setting a style with "
1629  . "remote url '$attrib'='$value' in uploaded file.\n" );
1630  return [ 'uploaded-remote-url-svg', $attrib, $value ];
1631  }
1632 
1633  # Several attributes can include css, css character escaping isn't allowed
1634  $cssAttrs = [ 'font', 'clip-path', 'fill', 'filter', 'marker',
1635  'marker-end', 'marker-mid', 'marker-start', 'mask', 'stroke' ];
1636  if ( in_array( $stripped, $cssAttrs )
1637  && self::checkCssFragment( $value )
1638  ) {
1639  wfDebug( __METHOD__ . ": Found svg setting a style with "
1640  . "remote url '$attrib'='$value' in uploaded file.\n" );
1641  return [ 'uploaded-remote-url-svg', $attrib, $value ];
1642  }
1643 
1644  # image filters can pull in url, which could be svg that executes scripts
1645  if ( $strippedElement == 'image'
1646  && $stripped == 'filter'
1647  && preg_match( '!url\s*\(!sim', $value )
1648  ) {
1649  wfDebug( __METHOD__ . ": Found image filter with url: "
1650  . "\"<$strippedElement $stripped='$value'...\" in uploaded file.\n" );
1651 
1652  return [ 'uploaded-image-filter-svg', $strippedElement, $stripped, $value ];
1653  }
1654  }
1655 
1656  return false; // No scripts detected
1657  }
1658 
1666  private static function checkCssFragment( $value ) {
1667 
1668  # Forbid external stylesheets, for both reliability and to protect viewer's privacy
1669  if ( stripos( $value, '@import' ) !== false ) {
1670  return true;
1671  }
1672 
1673  # We allow @font-face to embed fonts with data: urls, so we snip the string
1674  # 'url' out so this case won't match when we check for urls below
1675  $pattern = '!(@font-face\s*{[^}]*src:)url(\("data:;base64,)!im';
1676  $value = preg_replace( $pattern, '$1$2', $value );
1677 
1678  # Check for remote and executable CSS. Unlike in Sanitizer::checkCss, the CSS
1679  # properties filter and accelerator don't seem to be useful for xss in SVG files.
1680  # Expression and -o-link don't seem to work either, but filtering them here in case.
1681  # Additionally, we catch remote urls like url("http:..., url('http:..., url(http:...,
1682  # but not local ones such as url("#..., url('#..., url(#....
1683  if ( preg_match( '!expression
1684  | -o-link\s*:
1685  | -o-link-source\s*:
1686  | -o-replace\s*:!imx', $value ) ) {
1687  return true;
1688  }
1689 
1690  if ( preg_match_all(
1691  "!(\s*(url|image|image-set)\s*\(\s*[\"']?\s*[^#]+.*?\))!sim",
1692  $value,
1693  $matches
1694  ) !== 0
1695  ) {
1696  # TODO: redo this in one regex. Until then, url("#whatever") matches the first
1697  foreach ( $matches[1] as $match ) {
1698  if ( !preg_match( "!\s*(url|image|image-set)\s*\(\s*(#|'#|\"#)!im", $match ) ) {
1699  return true;
1700  }
1701  }
1702  }
1703 
1704  if ( preg_match( '/[\000-\010\013\016-\037\177]/', $value ) ) {
1705  return true;
1706  }
1707 
1708  return false;
1709  }
1710 
1716  private static function splitXmlNamespace( $element ) {
1717  // 'http://www.w3.org/2000/svg:script' -> [ 'http://www.w3.org/2000/svg', 'script' ]
1718  $parts = explode( ':', strtolower( $element ) );
1719  $name = array_pop( $parts );
1720  $ns = implode( ':', $parts );
1721 
1722  return [ $ns, $name ];
1723  }
1724 
1729  private function stripXmlNamespace( $name ) {
1730  // 'http://www.w3.org/2000/svg:script' -> 'script'
1731  $parts = explode( ':', strtolower( $name ) );
1732 
1733  return array_pop( $parts );
1734  }
1735 
1746  public static function detectVirus( $file ) {
1748 
1749  if ( !$wgAntivirus ) {
1750  wfDebug( __METHOD__ . ": virus scanner disabled\n" );
1751 
1752  return null;
1753  }
1754 
1755  if ( !$wgAntivirusSetup[$wgAntivirus] ) {
1756  wfDebug( __METHOD__ . ": unknown virus scanner: $wgAntivirus\n" );
1757  $wgOut->wrapWikiMsg( "<div class=\"error\">\n$1\n</div>",
1758  [ 'virus-badscanner', $wgAntivirus ] );
1759 
1760  return wfMessage( 'virus-unknownscanner' )->text() . " $wgAntivirus";
1761  }
1762 
1763  # look up scanner configuration
1764  $command = $wgAntivirusSetup[$wgAntivirus]['command'];
1765  $exitCodeMap = $wgAntivirusSetup[$wgAntivirus]['codemap'];
1766  $msgPattern = isset( $wgAntivirusSetup[$wgAntivirus]['messagepattern'] ) ?
1767  $wgAntivirusSetup[$wgAntivirus]['messagepattern'] : null;
1768 
1769  if ( strpos( $command, "%f" ) === false ) {
1770  # simple pattern: append file to scan
1771  $command .= " " . wfEscapeShellArg( $file );
1772  } else {
1773  # complex pattern: replace "%f" with file to scan
1774  $command = str_replace( "%f", wfEscapeShellArg( $file ), $command );
1775  }
1776 
1777  wfDebug( __METHOD__ . ": running virus scan: $command \n" );
1778 
1779  # execute virus scanner
1780  $exitCode = false;
1781 
1782  # NOTE: there's a 50 line workaround to make stderr redirection work on windows, too.
1783  # that does not seem to be worth the pain.
1784  # Ask me (Duesentrieb) about it if it's ever needed.
1785  $output = wfShellExecWithStderr( $command, $exitCode );
1786 
1787  # map exit code to AV_xxx constants.
1788  $mappedCode = $exitCode;
1789  if ( $exitCodeMap ) {
1790  if ( isset( $exitCodeMap[$exitCode] ) ) {
1791  $mappedCode = $exitCodeMap[$exitCode];
1792  } elseif ( isset( $exitCodeMap["*"] ) ) {
1793  $mappedCode = $exitCodeMap["*"];
1794  }
1795  }
1796 
1797  /* NB: AV_NO_VIRUS is 0 but AV_SCAN_FAILED is false,
1798  * so we need the strict equalities === and thus can't use a switch here
1799  */
1800  if ( $mappedCode === AV_SCAN_FAILED ) {
1801  # scan failed (code was mapped to false by $exitCodeMap)
1802  wfDebug( __METHOD__ . ": failed to scan $file (code $exitCode).\n" );
1803 
1804  $output = $wgAntivirusRequired
1805  ? wfMessage( 'virus-scanfailed', [ $exitCode ] )->text()
1806  : null;
1807  } elseif ( $mappedCode === AV_SCAN_ABORTED ) {
1808  # scan failed because filetype is unknown (probably imune)
1809  wfDebug( __METHOD__ . ": unsupported file type $file (code $exitCode).\n" );
1810  $output = null;
1811  } elseif ( $mappedCode === AV_NO_VIRUS ) {
1812  # no virus found
1813  wfDebug( __METHOD__ . ": file passed virus scan.\n" );
1814  $output = false;
1815  } else {
1816  $output = trim( $output );
1817 
1818  if ( !$output ) {
1819  $output = true; # if there's no output, return true
1820  } elseif ( $msgPattern ) {
1821  $groups = [];
1822  if ( preg_match( $msgPattern, $output, $groups ) ) {
1823  if ( $groups[1] ) {
1824  $output = $groups[1];
1825  }
1826  }
1827  }
1828 
1829  wfDebug( __METHOD__ . ": FOUND VIRUS! scanner feedback: $output \n" );
1830  }
1831 
1832  return $output;
1833  }
1834 
1843  private function checkOverwrite( $user ) {
1844  // First check whether the local file can be overwritten
1845  $file = $this->getLocalFile();
1846  $file->load( File::READ_LATEST );
1847  if ( $file->exists() ) {
1848  if ( !self::userCanReUpload( $user, $file ) ) {
1849  return [ 'fileexists-forbidden', $file->getName() ];
1850  } else {
1851  return true;
1852  }
1853  }
1854 
1855  /* Check shared conflicts: if the local file does not exist, but
1856  * wfFindFile finds a file, it exists in a shared repository.
1857  */
1858  $file = wfFindFile( $this->getTitle(), [ 'latest' => true ] );
1859  if ( $file && !$user->isAllowed( 'reupload-shared' ) ) {
1860  return [ 'fileexists-shared-forbidden', $file->getName() ];
1861  }
1862 
1863  return true;
1864  }
1865 
1873  public static function userCanReUpload( User $user, File $img ) {
1874  if ( $user->isAllowed( 'reupload' ) ) {
1875  return true; // non-conditional
1876  } elseif ( !$user->isAllowed( 'reupload-own' ) ) {
1877  return false;
1878  }
1879 
1880  if ( !( $img instanceof LocalFile ) ) {
1881  return false;
1882  }
1883 
1884  $img->load();
1885 
1886  return $user->getId() == $img->getUser( 'id' );
1887  }
1888 
1900  public static function getExistsWarning( $file ) {
1901  if ( $file->exists() ) {
1902  return [ 'warning' => 'exists', 'file' => $file ];
1903  }
1904 
1905  if ( $file->getTitle()->getArticleID() ) {
1906  return [ 'warning' => 'page-exists', 'file' => $file ];
1907  }
1908 
1909  if ( strpos( $file->getName(), '.' ) == false ) {
1910  $partname = $file->getName();
1911  $extension = '';
1912  } else {
1913  $n = strrpos( $file->getName(), '.' );
1914  $extension = substr( $file->getName(), $n + 1 );
1915  $partname = substr( $file->getName(), 0, $n );
1916  }
1917  $normalizedExtension = File::normalizeExtension( $extension );
1918 
1919  if ( $normalizedExtension != $extension ) {
1920  // We're not using the normalized form of the extension.
1921  // Normal form is lowercase, using most common of alternate
1922  // extensions (eg 'jpg' rather than 'JPEG').
1923 
1924  // Check for another file using the normalized form...
1925  $nt_lc = Title::makeTitle( NS_FILE, "{$partname}.{$normalizedExtension}" );
1926  $file_lc = wfLocalFile( $nt_lc );
1927 
1928  if ( $file_lc->exists() ) {
1929  return [
1930  'warning' => 'exists-normalized',
1931  'file' => $file,
1932  'normalizedFile' => $file_lc
1933  ];
1934  }
1935  }
1936 
1937  // Check for files with the same name but a different extension
1938  $similarFiles = RepoGroup::singleton()->getLocalRepo()->findFilesByPrefix(
1939  "{$partname}.", 1 );
1940  if ( count( $similarFiles ) ) {
1941  return [
1942  'warning' => 'exists-normalized',
1943  'file' => $file,
1944  'normalizedFile' => $similarFiles[0],
1945  ];
1946  }
1947 
1948  if ( self::isThumbName( $file->getName() ) ) {
1949  # Check for filenames like 50px- or 180px-, these are mostly thumbnails
1950  $nt_thb = Title::newFromText(
1951  substr( $partname, strpos( $partname, '-' ) + 1 ) . '.' . $extension,
1952  NS_FILE
1953  );
1954  $file_thb = wfLocalFile( $nt_thb );
1955  if ( $file_thb->exists() ) {
1956  return [
1957  'warning' => 'thumb',
1958  'file' => $file,
1959  'thumbFile' => $file_thb
1960  ];
1961  } else {
1962  // File does not exist, but we just don't like the name
1963  return [
1964  'warning' => 'thumb-name',
1965  'file' => $file,
1966  'thumbFile' => $file_thb
1967  ];
1968  }
1969  }
1970 
1971  foreach ( self::getFilenamePrefixBlacklist() as $prefix ) {
1972  if ( substr( $partname, 0, strlen( $prefix ) ) == $prefix ) {
1973  return [
1974  'warning' => 'bad-prefix',
1975  'file' => $file,
1976  'prefix' => $prefix
1977  ];
1978  }
1979  }
1980 
1981  return false;
1982  }
1983 
1989  public static function isThumbName( $filename ) {
1990  $n = strrpos( $filename, '.' );
1991  $partname = $n ? substr( $filename, 0, $n ) : $filename;
1992 
1993  return (
1994  substr( $partname, 3, 3 ) == 'px-' ||
1995  substr( $partname, 2, 3 ) == 'px-'
1996  ) &&
1997  preg_match( "/[0-9]{2}/", substr( $partname, 0, 2 ) );
1998  }
1999 
2005  public static function getFilenamePrefixBlacklist() {
2006  $blacklist = [];
2007  $message = wfMessage( 'filename-prefix-blacklist' )->inContentLanguage();
2008  if ( !$message->isDisabled() ) {
2009  $lines = explode( "\n", $message->plain() );
2010  foreach ( $lines as $line ) {
2011  // Remove comment lines
2012  $comment = substr( trim( $line ), 0, 1 );
2013  if ( $comment == '#' || $comment == '' ) {
2014  continue;
2015  }
2016  // Remove additional comments after a prefix
2017  $comment = strpos( $line, '#' );
2018  if ( $comment > 0 ) {
2019  $line = substr( $line, 0, $comment - 1 );
2020  }
2021  $blacklist[] = trim( $line );
2022  }
2023  }
2024 
2025  return $blacklist;
2026  }
2027 
2039  public function getImageInfo( $result ) {
2040  $localFile = $this->getLocalFile();
2041  $stashFile = $this->getStashFile();
2042  // Calling a different API module depending on whether the file was stashed is less than optimal.
2043  // In fact, calling API modules here at all is less than optimal. Maybe it should be refactored.
2044  if ( $stashFile ) {
2046  $info = ApiQueryStashImageInfo::getInfo( $stashFile, array_flip( $imParam ), $result );
2047  } else {
2049  $info = ApiQueryImageInfo::getInfo( $localFile, array_flip( $imParam ), $result );
2050  }
2051 
2052  return $info;
2053  }
2054 
2059  public function convertVerifyErrorToStatus( $error ) {
2060  $code = $error['status'];
2061  unset( $code['status'] );
2062 
2063  return Status::newFatal( $this->getVerificationErrorCode( $code ), $error );
2064  }
2065 
2073  public static function getMaxUploadSize( $forType = null ) {
2075 
2076  if ( is_array( $wgMaxUploadSize ) ) {
2077  if ( !is_null( $forType ) && isset( $wgMaxUploadSize[$forType] ) ) {
2078  return $wgMaxUploadSize[$forType];
2079  } else {
2080  return $wgMaxUploadSize['*'];
2081  }
2082  } else {
2083  return intval( $wgMaxUploadSize );
2084  }
2085  }
2086 
2094  public static function getMaxPhpUploadSize() {
2095  $phpMaxFileSize = wfShorthandToInteger(
2096  ini_get( 'upload_max_filesize' ) ?: ini_get( 'hhvm.server.upload.upload_max_file_size' ),
2097  PHP_INT_MAX
2098  );
2099  $phpMaxPostSize = wfShorthandToInteger(
2100  ini_get( 'post_max_size' ) ?: ini_get( 'hhvm.server.max_post_size' ),
2101  PHP_INT_MAX
2102  ) ?: PHP_INT_MAX;
2103  return min( $phpMaxFileSize, $phpMaxPostSize );
2104  }
2105 
2115  public static function getSessionStatus( User $user, $statusKey ) {
2116  $key = wfMemcKey( 'uploadstatus', $user->getId() ?: md5( $user->getName() ), $statusKey );
2117 
2118  return MediaWikiServices::getInstance()->getMainObjectStash()->get( $key );
2119  }
2120 
2131  public static function setSessionStatus( User $user, $statusKey, $value ) {
2132  $key = wfMemcKey( 'uploadstatus', $user->getId() ?: md5( $user->getName() ), $statusKey );
2133 
2134  $cache = MediaWikiServices::getInstance()->getMainObjectStash();
2135  if ( $value === false ) {
2136  $cache->delete( $key );
2137  } else {
2138  $cache->set( $key, $value, $cache::TTL_DAY );
2139  }
2140  }
2141 }
$wgStrictFileExtensions
If this is turned off, users may override the warning for files not covered by $wgFileExtensions.
checkSvgScriptCallback($element, $attribs, $data=null)
static checkFileExtensionList($ext, $list)
Perform case-insensitive match against a list of file extensions.
getImageInfo($result)
Gets image info about the file just uploaded.
getVerificationErrorCode($error)
Definition: UploadBase.php:87
null means default in associative array form
Definition: hooks.txt:1957
deferred txt A few of the database updates required by various functions here can be deferred until after the result page is displayed to the user For updating the view updating the linked to tables after a etc PHP does not yet have any way to tell the server to actually return and disconnect while still running these but it might have such a feature in the future We handle these by creating a deferred update object and putting those objects on a global list
Definition: deferred.txt:11
static read($fileName, $callback, $options=[])
Read a ZIP file and call a function for each file discovered in it.
const FILENAME_TOO_LONG
Definition: UploadBase.php:81
$wgSVGMetadataCutoff
Don't read SVG metadata beyond this point.
$wgDisableUploadScriptChecks
Setting this to true will disable the upload system's checks for HTML/JavaScript. ...
magic word the default is to use $key to get the and $key value or $key value text $key value html to format the value $key
Definition: hooks.txt:2520
tryStashFile(User $user, $isPartial=false)
Like stashFile(), but respects extensions' wishes to prevent the stashing.
Definition: UploadBase.php:962
wfIsHHVM()
Check if we are running under HHVM.
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist Do not use this to implement individual filters if they are compatible with the ChangesListFilter and ChangesListFilterGroup structure use sub classes of those in conjunction with the ChangesListSpecialPageStructuredFilters hook This hook can be used to implement filters that do not implement that or custom behavior that is not an individual filter e g Watchlist and Watchlist you will want to construct new ChangesListBooleanFilter or ChangesListStringOptionsFilter objects When constructing you specify which group they belong to You can reuse existing or create your you must register them with $special registerFilterGroup removed from all revisions and log entries to which it was applied This gives extensions a chance to take it off their books as the deletion has already been partly carried out by this point or something similar the user will be unable to create the tag set $status
Definition: hooks.txt:1050
const SUCCESS
Definition: UploadBase.php:69
static createFromRequest(&$request, $type=null)
Create a form of UploadBase depending on wpSourceType and initializes it.
Definition: UploadBase.php:162
static isAllowed($user)
Returns true if the user can use this upload module or else a string identifying the missing permissi...
Definition: UploadBase.php:132
wfShorthandToInteger($string= '', $default=-1)
Converts shorthand byte notation to integer form.
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for use
static singleton()
Get an instance of this class.
Definition: MimeMagic.php:33
div flags Integer display flags(NO_ACTION_LINK, NO_EXTRA_USER_LINKS) 'LogException'returning false will NOT prevent logging $e
Definition: hooks.txt:2123
static newFatal($message)
Factory function for fatal errors.
Definition: StatusValue.php:63
$command
Definition: cdb.php:64
static checkFileExtension($ext, $list)
Perform case-insensitive match against a list of file extensions.
globals txt Globals are evil The original MediaWiki code relied on globals for processing context far too often MediaWiki development since then has been a story of slowly moving context out of global variables and into objects Storing processing context in object member variables allows those objects to be reused in a much more flexible way Consider the elegance of
database rows
Definition: globals.txt:10
const DELETE_SOURCE
Definition: File.php:66
static getSessionStatus(User $user, $statusKey)
Get the current status of a chunked upload (used for polling)
const OVERWRITE_EXISTING_FILE
Definition: UploadBase.php:74
static $safeXmlEncodings
Definition: UploadBase.php:52
static isValidRequest($request)
Check whether a request if valid for this handler.
Definition: UploadBase.php:206
This class is used to hold the location and do limited manipulation of files stored temporarily (this...
Definition: TempFSFile.php:30
null for the local wiki Added in
Definition: hooks.txt:1573
has been added to your &Future changes to this page and its associated Talk page will be listed there
$value
const AV_NO_VIRUS
Definition: Defines.php:109
verifyPermissions($user)
Alias for verifyTitlePermissions.
Definition: UploadBase.php:593
if($ext== 'php'||$ext== 'php5') $mime
Definition: router.php:65
stripXmlNamespace($name)
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency MediaWikiServices
Definition: injection.txt:23
static splitXmlNamespace($element)
Divide the element name passed by the xml parser to the callback into URI and prifix.
static newFromText($text, $defaultNamespace=NS_MAIN)
Create a new Title from text, such as what one would find in a link.
Definition: Title.php:265
const ILLEGAL_FILENAME
Definition: UploadBase.php:73
isEmptyFile()
Return true if the file is empty.
Definition: UploadBase.php:277
const AV_SCAN_FAILED
Definition: Defines.php:112
string $mTempPath
Local file system path to the file to upload (or a local copy)
Definition: UploadBase.php:41
when a variable name is used in a it is silently declared as a new local masking the global
Definition: design.txt:93
when a variable name is used in a function
Definition: design.txt:93
wfLocalFile($title)
Get an object referring to a locally registered file.
$wgAllowJavaUploads
Allow Java archive uploads.
wfStripIllegalFilenameChars($name)
Replace all invalid characters with '-'.
static checkSvgPICallback($target, $data)
Callback to filter SVG Processing Instructions.
getName()
Get the user name, or the IP of an anonymous user.
Definition: User.php:2240
verifyMimeType($mime)
Verify the MIME type.
Definition: UploadBase.php:410
wfArrayDiff2($a, $b)
Like array_diff( $a, $b ) except that it works with two-dimensional arrays.
wfDebug($text, $dest= 'all', array $context=[])
Sends a line to the debug log if enabled or, optionally, to a comment in output.
const AV_SCAN_ABORTED
Definition: Defines.php:111
static getMaxUploadSize($forType=null)
Get the MediaWiki maximum uploaded file size for given type of upload, based on $wgMaxUploadSize.
const DELETED_FILE
Definition: File.php:53
this class mediates it Skin Encapsulates a look and feel for the wiki All of the functions that render HTML and make choices about how to render it are here and are called from various other places when and is meant to be subclassed with other skins that may override some of its functions The User object contains a reference to a and so rather than having a global skin object we just rely on the global User and get the skin with $wgUser and also has some character encoding functions and other locale stuff The current user interface language is instantiated as $wgLang
Definition: design.txt:56
The index of the header message $result[1]=The index of the body text message $result[2 through n]=Parameters passed to body text message.Please note the header message cannot receive/use parameters. 'ImportHandleLogItemXMLTag':When parsing a XML tag in a log item.Return false to stop further processing of the tag $reader:XMLReader object $logInfo:Array of information 'ImportHandlePageXMLTag':When parsing a XML tag in a page.Return false to stop further processing of the tag $reader:XMLReader object &$pageInfo:Array of information 'ImportHandleRevisionXMLTag':When parsing a XML tag in a page revision.Return false to stop further processing of the tag $reader:XMLReader object $pageInfo:Array of page information $revisionInfo:Array of revision information 'ImportHandleToplevelXMLTag':When parsing a top level XML tag.Return false to stop further processing of the tag $reader:XMLReader object 'ImportHandleUploadXMLTag':When parsing a XML tag in a file upload.Return false to stop further processing of the tag $reader:XMLReader object $revisionInfo:Array of information 'ImportLogInterwikiLink':Hook to change the interwiki link used in log entries and edit summaries for transwiki imports.&$fullInterwikiPrefix:Interwiki prefix, may contain colons.&$pageTitle:String that contains page title. 'ImportSources':Called when reading from the $wgImportSources configuration variable.Can be used to lazy-load the import sources list.&$importSources:The value of $wgImportSources.Modify as necessary.See the comment in DefaultSettings.php for the detail of how to structure this array. 'InfoAction':When building information to display on the action=info page.$context:IContextSource object &$pageInfo:Array of information 'InitializeArticleMaybeRedirect':MediaWiki check to see if title is a redirect.&$title:Title object for the current page &$request:WebRequest &$ignoreRedirect:boolean to skip redirect check &$target:Title/string of redirect target &$article:Article object 'InternalParseBeforeLinks':during Parser's internalParse method before links but after nowiki/noinclude/includeonly/onlyinclude and other processings.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InternalParseBeforeSanitize':during Parser's internalParse method just before the parser removes unwanted/dangerous HTML tags and after nowiki/noinclude/includeonly/onlyinclude and other processings.Ideal for syntax-extensions after template/parser function execution which respect nowiki and HTML-comments.&$parser:Parser object &$text:string containing partially parsed text &$stripState:Parser's internal StripState object 'InterwikiLoadPrefix':When resolving if a given prefix is an interwiki or not.Return true without providing an interwiki to continue interwiki search.$prefix:interwiki prefix we are looking for.&$iwData:output array describing the interwiki with keys iw_url, iw_local, iw_trans and optionally iw_api and iw_wikiid. 'InvalidateEmailComplete':Called after a user's email has been invalidated successfully.$user:user(object) whose email is being invalidated 'IRCLineURL':When constructing the URL to use in an IRC notification.Callee may modify $url and $query, URL will be constructed as $url.$query &$url:URL to index.php &$query:Query string $rc:RecentChange object that triggered url generation 'IsFileCacheable':Override the result of Article::isFileCacheable()(if true) &$article:article(object) being checked 'IsTrustedProxy':Override the result of IP::isTrustedProxy() &$ip:IP being check &$result:Change this value to override the result of IP::isTrustedProxy() 'IsUploadAllowedFromUrl':Override the result of UploadFromUrl::isAllowedUrl() $url:URL used to upload from &$allowed:Boolean indicating if uploading is allowed for given URL 'isValidEmailAddr':Override the result of Sanitizer::validateEmail(), for instance to return false if the domain name doesn't match your organization.$addr:The e-mail address entered by the user &$result:Set this and return false to override the internal checks 'isValidPassword':Override the result of User::isValidPassword() $password:The password entered by the user &$result:Set this and return false to override the internal checks $user:User the password is being validated for 'Language::getMessagesFileName':$code:The language code or the language we're looking for a messages file for &$file:The messages file path, you can override this to change the location. 'LanguageGetMagic':DEPRECATED!Use $magicWords in a file listed in $wgExtensionMessagesFiles instead.Use this to define synonyms of magic words depending of the language &$magicExtensions:associative array of magic words synonyms $lang:language code(string) 'LanguageGetNamespaces':Provide custom ordering for namespaces or remove namespaces.Do not use this hook to add namespaces.Use CanonicalNamespaces for that.&$namespaces:Array of namespaces indexed by their numbers 'LanguageGetSpecialPageAliases':DEPRECATED!Use $specialPageAliases in a file listed in $wgExtensionMessagesFiles instead.Use to define aliases of special pages names depending of the language &$specialPageAliases:associative array of magic words synonyms $lang:language code(string) 'LanguageGetTranslatedLanguageNames':Provide translated language names.&$names:array of language code=> language name $code:language of the preferred translations 'LanguageLinks':Manipulate a page's language links.This is called in various places to allow extensions to define the effective language links for a page.$title:The page's Title.&$links:Array with elements of the form"language:title"in the order that they will be output.&$linkFlags:Associative array mapping prefixed links to arrays of flags.Currently unused, but planned to provide support for marking individual language links in the UI, e.g.for featured articles. 'LanguageSelector':Hook to change the language selector available on a page.$out:The output page.$cssClassName:CSS class name of the language selector. 'LinkBegin':DEPRECATED!Use HtmlPageLinkRendererBegin instead.Used when generating internal and interwiki links in Linker::link(), before processing starts.Return false to skip default processing and return $ret.See documentation for Linker::link() for details on the expected meanings of parameters.$skin:the Skin object $target:the Title that the link is pointing to &$html:the contents that the< a > tag should have(raw HTML) $result
Definition: hooks.txt:1955
setTempFile($tempPath, $fileSize=null)
Definition: UploadBase.php:252
verifyPartialFile()
A verification routine suitable for partial files.
Definition: UploadBase.php:503
$wgCheckFileExtensions
This is a flag to determine whether or not to check file extensions on upload.
static decodeCharReferences($text)
Decode any character references, numeric or named entities, in the text and return a UTF-8 string...
Definition: Sanitizer.php:1502
$wgEnableUploads
Uploads have to be specially set up to be secure.
static isThumbName($filename)
Helper function that checks whether the filename looks like a thumbnail.
static isThrottled($user)
Returns true if the user has surpassed the upload rate limit, false otherwise.
Definition: UploadBase.php:148
Class representing a row of the 'filearchive' table.
zipEntryCallback($entry)
Callback for ZipDirectoryReader to detect Java class files.
Definition: UploadBase.php:564
$wgAntivirusRequired
Determines if a failed virus scan (AV_SCAN_FAILED) will cause the file to be rejected.
We ve cleaned up the code here by removing clumps of infrequently used code and moving them off somewhere else It s much easier for someone working with this code to see what s _really_ going and make changes or fix bugs In we can take all the code that deals with the little used title reversing we can concentrate it all in an extension file
Definition: hooks.txt:93
getTempFileSha1Base36()
Get the base 36 SHA1 of the file.
Definition: UploadBase.php:293
stashFileGetKey()
Stash a file in a temporary directory, returning a key which can be used to find the file again...
UploadBase and subclasses are the backend of MediaWiki's file uploads.
Definition: UploadBase.php:39
either a unescaped string or a HtmlArmor object after in associative array form externallinks including delete and has completed for all link tables whether this was an auto creation default is conds Array Extra conditions for the No matching items in log is displayed if loglist is empty msgKey Array If you want a nice box with a set this to the key of the message First element is the message additional optional elements are parameters for the key that are processed with wfMessage() -> params() ->parseAsBlock()-offset Set to overwrite offset parameter in $wgRequest set to ''to unsetoffset-wrap String Wrap the message in html(usually something like"&lt
wfIniGetBool($setting)
Safety wrapper around ini_get() for boolean settings.
static singleton()
Get a RepoGroup instance.
Definition: RepoGroup.php:59
fetchFile()
Fetch the file.
Definition: UploadBase.php:269
static isStoragePath($path)
Check if a given path is a "mwstore://" path.
stashSession()
alias for stashFileGetKey, for backwards compatibility
postProcessUpload()
Perform extra steps after a successful upload.
Definition: UploadBase.php:794
static getPropertyNames($filter=[])
Returns all possible parameters to iiprop.
$cache
Definition: mcc.php:33
const IGNORE_USER_RIGHTS
Definition: User.php:88
static doWatch(Title $title, User $user, $checkRights=User::CHECK_USER_RIGHTS)
Watch a page.
getTitle()
Returns the title of the file to be uploaded.
Definition: UploadBase.php:803
performUpload($comment, $pageText, $watch, $user, $tags=[])
Really perform the upload.
Definition: UploadBase.php:747
wfDeprecated($function, $version=false, $component=false, $callerOffset=2)
Throws a warning that $function is deprecated.
null means default in associative array with keys and values unescaped Should be merged with default with a value of false meaning to suppress the attribute in associative array with keys and values unescaped noclasses just before the function returns a value If you return an< a > element with HTML attributes $attribs and contents $html will be returned If you return $ret will be returned and may include noclasses after processing & $attribs
Definition: hooks.txt:1957
static detectVirus($file)
Generic wrapper function for a virus scanner program.
static splitExtensions($filename)
Split a file into a base name and all dot-delimited 'extensions' on the end.
static makeTitleSafe($ns, $title, $fragment= '', $interwiki= '')
Create a new Title from a namespace index and a DB key.
Definition: Title.php:538
cleanupTempFile()
If we've modified the upload file we need to manually remove it on exit to clean up.
you don t have to do a grep find to see where the $wgReverseTitle variable is used
Definition: hooks.txt:117
getSourceType()
Returns the upload type.
Definition: UploadBase.php:219
const FILE_TOO_LARGE
Definition: UploadBase.php:79
namespace and then decline to actually register it file or subcat img or subcat $title
Definition: hooks.txt:935
static newGood($value=null)
Factory function for good results.
Definition: StatusValue.php:76
checkWarnings()
Check for non fatal problems with the file.
Definition: UploadBase.php:646
initializeFromRequest(&$request)
Initialize from a WebRequest.
verifyUpload()
Verify whether the upload is sane.
Definition: UploadBase.php:323
const MIN_LENGTH_PARTNAME
Definition: UploadBase.php:72
static run($event, array $args=[], $deprecatedVersion=null)
Call hook functions defined in Hooks::register and $wgHooks.
Definition: Hooks.php:131
getFileSize()
Return the file size.
Definition: UploadBase.php:285
const NS_FILE
Definition: Defines.php:68
Apache License January AND DISTRIBUTION Definitions License shall mean the terms and conditions for and distribution as defined by Sections through of this document Licensor shall mean the copyright owner or entity authorized by the copyright owner that is granting the License Legal Entity shall mean the union of the acting entity and all other entities that control are controlled by or are under common control with that entity For the purposes of this definition control direct or to cause the direction or management of such whether by contract or including but not limited to software source documentation and configuration files Object form shall mean any form resulting from mechanical transformation or translation of a Source including but not limited to compiled object generated and conversions to other media types Work shall mean the work of whether in Source or Object made available under the as indicated by a copyright notice that is included in or attached to the whether in Source or Object that is based or other modifications as a an original work of authorship For the purposes of this Derivative Works shall not include works that remain separable or merely the Work and Derivative Works thereof Contribution shall mean any work of including the original version of the Work and any modifications or additions to that Work or Derivative Works that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner For the purposes of this submitted means any form of or written communication sent to the Licensor or its including but not limited to communication on electronic mailing source code control and issue tracking systems that are managed by
static getSha1Base36FromPath($path)
Get a SHA-1 hash of a file in the local filesystem, in base-36 lower case encoding, zero padded to 31 digits.
Definition: FSFile.php:218
const VERIFICATION_ERROR
Definition: UploadBase.php:77
This document is intended to provide useful advice for parties seeking to redistribute MediaWiki to end users It s targeted particularly at maintainers for Linux since it s been observed that distribution packages of MediaWiki often break We ve consistently had to recommend that users seeking support use official tarballs instead of their distribution s and this often solves whatever problem the user is having It would be nice if this could such as
Definition: distributors.txt:9
static isEnabled()
Returns true if uploads are enabled.
Definition: UploadBase.php:113
please add to it if you re going to add events to the MediaWiki code where normally authentication against an external auth plugin would be creating a local account $user
Definition: hooks.txt:246
doStashFile(User $user=null)
Implementation for stashFile() and tryStashFile().
validateName()
Verify that the name is valid and, if necessary, that we can overwrite.
Definition: UploadBase.php:380
const FILETYPE_BADTYPE
Definition: UploadBase.php:76
$wgMaxUploadSize
Max size for uploads, in bytes.
getLocalFile()
Return the local file and initializes if necessary.
Definition: UploadBase.php:935
$wgAntivirusSetup
Configuration for different virus scanners.
const FILETYPE_MISSING
Definition: UploadBase.php:75
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist Do not use this to implement individual filters if they are compatible with the ChangesListFilter and ChangesListFilterGroup structure use sub classes of those in conjunction with the ChangesListSpecialPageStructuredFilters hook This hook can be used to implement filters that do not implement that or custom behavior that is not an individual filter e g Watchlist and Watchlist you will want to construct new ChangesListBooleanFilter or ChangesListStringOptionsFilter objects When constructing you specify which group they belong to You can reuse existing or create your you must register them with $special registerFilterGroup removed from all revisions and log entries to which it was applied This gives extensions a chance to take it off their books as the deletion has already been partly carried out by this point or something similar the user will be unable to create the tag set and then return false from the hook function Ensure you consume the ChangeTagAfterDelete hook to carry out custom deletion actions as context called by AbstractContent::getParserOutput May be used to override the normal model specific rendering of page content as context as context the output can only depend on parameters provided to this hook not on global state indicating whether full HTML should be generated If generation of HTML may be but other information should still be present in the ParserOutput object & $output
Definition: hooks.txt:1050
do that in ParserLimitReportFormat instead use this to modify the parameters of the image and a DIV can begin in one section and end in another Make sure your code can handle that case gracefully See the EditSectionClearerLink extension for an example zero but section is usually empty its values are the globals values before the output is cached my talk my contributions etc etc otherwise the built in rate limiting checks are if enabled allows for interception of redirect as a string mapping parameter names to values & $type
Definition: hooks.txt:2537
static normalizeCss($value)
Normalize CSS into a format we can easily search for hostile input.
Definition: Sanitizer.php:893
$wgFileExtensions
This is the list of preferred extensions for uploading files.
injection txt This is an overview of how MediaWiki makes use of dependency injection The design described here grew from the discussion of RFC T384 The term dependency this means that anything an object needs to operate should be injected from the the object itself should only know narrow no concrete implementation of the logic it relies on The requirement to inject everything typically results in an architecture that based on two main types of and essentially stateless service objects that use other service objects to operate on the value objects As of the beginning MediaWiki is only starting to use the DI approach Much of the code still relies on global state or direct resulting in a highly cyclical dependency which acts as the top level factory for services in MediaWiki which can be used to gain access to default instances of various services MediaWikiServices however also allows new services to be defined and default services to be redefined Services are defined or redefined by providing a callback the instantiator that will return a new instance of the service When it will create an instance of MediaWikiServices and populate it with the services defined in the files listed by thereby bootstrapping the DI framework Per $wgServiceWiringFiles lists includes ServiceWiring php
Definition: injection.txt:35
static getFilenamePrefixBlacklist()
Get a list of blacklisted filename prefixes from [[MediaWiki:Filename-prefix-blacklist]].
$wgUploadSizeWarning
Warn if uploaded files are larger than this (in bytes), or false to disable.
verifyTitlePermissions($user)
Check whether the user can edit, upload and create the image.
Definition: UploadBase.php:608
$lines
Definition: router.php:67
const HOOK_ABORTED
Definition: UploadBase.php:78
error also a ContextSource you ll probably need to make sure the header is varied on $request
Definition: hooks.txt:2613
stashFile(User $user=null)
If the user does not supply all necessary information in the first upload form submission (either by ...
getId()
Get the user's ID.
Definition: User.php:2215
static verifyExtension($mime, $extension)
Checks if the MIME type of the uploaded file matches the file extension.
detectScriptInSvg($filename, $partial)
this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output modifiable & $code
Definition: hooks.txt:784
static detectScript($file, $mime, $extension)
Heuristic for detecting files that could contain JavaScript instructions or things that may look like...
convertVerifyErrorToStatus($error)
$line
Definition: cdb.php:58
static $uploadHandlers
Definition: UploadBase.php:153
this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist Do not use this to implement individual filters if they are compatible with the ChangesListFilter and ChangesListFilterGroup structure use sub classes of those in conjunction with the ChangesListSpecialPageStructuredFilters hook This hook can be used to implement filters that do not implement that or custom behavior that is not an individual filter e g Watchlist and Watchlist you will want to construct new ChangesListBooleanFilter or ChangesListStringOptionsFilter objects When constructing you specify which group they belong to You can reuse existing or create your you must register them with $special registerFilterGroup removed from all revisions and log entries to which it was applied This gives extensions a chance to take it off their books $tag
Definition: hooks.txt:1029
const WINDOWS_NONASCII_FILENAME
Definition: UploadBase.php:80
static checkSvgExternalDTD($type, $publicId, $systemId)
Verify that DTD urls referenced are only the standard dtds.
static getHandler($type)
Get a MediaHandler for a given MIME type from the instance cache.
MimeMagic helper wrapper.
Definition: MWFileProps.php:28
Allows to change the fields on the form that will be generated $name
Definition: hooks.txt:304
$wgAllowTitlesInSVG
Disallow element in SVG files. </div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l01134">DefaultSettings.php:1134</a></div></div> <div class="ttc" id="classUploadBase_html_abaddaebc8a45879bc55291f21c9a4633"><div class="ttname"><a href="classUploadBase.html#abaddaebc8a45879bc55291f21c9a4633">UploadBase\checkXMLEncodingMissmatch</a></div><div class="ttdeci">static checkXMLEncodingMissmatch($file)</div><div class="ttdoc">Check a whitelist of xml encodings that are known not to be interpreted differently by the server's x...</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l01298">UploadBase.php:1298</a></div></div> <div class="ttc" id="GlobalFunctions_8php_html_a781ca00c48d9c5cbd509c282a244c022"><div class="ttname"><a href="GlobalFunctions_8php.html#a781ca00c48d9c5cbd509c282a244c022">wfEscapeShellArg</a></div><div class="ttdeci">wfEscapeShellArg()</div><div class="ttdoc">Version of escapeshellarg() that works better on Windows. </div><div class="ttdef"><b>Definition:</b> <a href="GlobalFunctions_8php_source.html#l02194">GlobalFunctions.php:2194</a></div></div> <div class="ttc" id="classUploadBase_html_a087aa90b972383fc6af7f66cd82667b3"><div class="ttname"><a href="classUploadBase.html#a087aa90b972383fc6af7f66cd82667b3">UploadBase\checkCssFragment</a></div><div class="ttdeci">static checkCssFragment($value)</div><div class="ttdoc">Check a block of CSS or CSS fragment for anything that looks like it is bringing in remote code...</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l01666">UploadBase.php:1666</a></div></div> <div class="ttc" id="classXmlTypeCheck_html"><div class="ttname"><a href="classXmlTypeCheck.html">XmlTypeCheck</a></div><div class="ttdef"><b>Definition:</b> <a href="XmlTypeCheck_8php_source.html#l00028">XmlTypeCheck.php:28</a></div></div> <div class="ttc" id="classUploadBase_html_af2f0fc4c8dea6e705323620b5337cae5"><div class="ttname"><a href="classUploadBase.html#af2f0fc4c8dea6e705323620b5337cae5">UploadBase\getMaxPhpUploadSize</a></div><div class="ttdeci">static getMaxPhpUploadSize()</div><div class="ttdoc">Get the PHP maximum uploaded file size, based on ini settings. </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l02094">UploadBase.php:2094</a></div></div> <div class="ttc" id="GlobalFunctions_8php_html_a77dd228704cc6c8c9293b2846b348a95"><div class="ttname"><a href="GlobalFunctions_8php.html#a77dd228704cc6c8c9293b2846b348a95">wfMemcKey</a></div><div class="ttdeci">wfMemcKey()</div><div class="ttdoc">Make a cache key for the local wiki. </div><div class="ttdef"><b>Definition:</b> <a href="GlobalFunctions_8php_source.html#l02967">GlobalFunctions.php:2967</a></div></div> <div class="ttc" id="Setup_8php_html_a42b1168a7e1606df23cc6419aa411e78"><div class="ttname"><a href="Setup_8php.html#a42b1168a7e1606df23cc6419aa411e78">$wgOut</a></div><div class="ttdeci">$wgOut</div><div class="ttdef"><b>Definition:</b> <a href="Setup_8php_source.html#l00791">Setup.php:791</a></div></div> <div class="ttc" id="classUploadBase_html_af9702f03fda4170d5debce1bc23c65b8"><div class="ttname"><a href="classUploadBase.html#af9702f03fda4170d5debce1bc23c65b8">UploadBase\setSessionStatus</a></div><div class="ttdeci">static setSessionStatus(User $user, $statusKey, $value)</div><div class="ttdoc">Set the current status of a chunked upload (used for polling) </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l02131">UploadBase.php:2131</a></div></div> <div class="ttc" id="NoLocalSettings_8php_html_a0a4baf0b22973c07685c3981f0d17fc4"><div class="ttname"><a href="NoLocalSettings_8php.html#a0a4baf0b22973c07685c3981f0d17fc4">$path</a></div><div class="ttdeci">$path</div><div class="ttdef"><b>Definition:</b> <a href="NoLocalSettings_8php_source.html#l00026">NoLocalSettings.php:26</a></div></div> <div class="ttc" id="classUploadBase_html_a39347cf74d116df59f2fe0344bfaac91"><div class="ttname"><a href="classUploadBase.html#a39347cf74d116df59f2fe0344bfaac91">UploadBase\$mBlackListedExtensions</a></div><div class="ttdeci">$mBlackListedExtensions</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00049">UploadBase.php:49</a></div></div> <div class="ttc" id="classUploadBase_html_aef55162125a82f0247397621735daca1"><div class="ttname"><a href="classUploadBase.html#aef55162125a82f0247397621735daca1">UploadBase\$tempFileObj</a></div><div class="ttdeci">TempFSFile null $tempFileObj</div><div class="ttdoc">Wrapper to handle deleting the temp file. </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00043">UploadBase.php:43</a></div></div> <div class="ttc" id="classUploadBase_html_af4a23e145883030bffcb842cbf6c897a"><div class="ttname"><a href="classUploadBase.html#af4a23e145883030bffcb842cbf6c897a">UploadBase\$mFileSize</a></div><div class="ttdeci">$mFileSize</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00048">UploadBase.php:48</a></div></div> <div class="ttc" id="hooks_8txt_html_ae55f6a597c457cd31e064490cae16f0a"><div class="ttname"><a href="hooks_8txt.html#ae55f6a597c457cd31e064490cae16f0a">$handler</a></div><div class="ttdeci">this hook is for auditing only or null if authentication failed before getting that far or null if we can t even determine that probably a stub it is not rendered in wiki pages or galleries in category pages allow injecting custom HTML after the section Any uses of the hook need to handle escaping see BaseTemplate::getToolbox and BaseTemplate::makeListItem for details on the format of individual items inside of this array or by returning and letting standard HTTP rendering take place modifiable or by returning false and taking over the output modifiable modifiable after all normalizations have been except for the $wgMaxImageArea check set to true or false to override the $wgMaxImageArea check result gives extension the possibility to transform it themselves $handler</div><div class="ttdef"><b>Definition:</b> <a href="hooks_8txt_source.html#l00784">hooks.txt:784</a></div></div> <div class="ttc" id="DefaultSettings_8php_html_acb268f4a51af8c4bf404f8b4379176d0"><div class="ttname"><a href="DefaultSettings_8php.html#acb268f4a51af8c4bf404f8b4379176d0">$wgMimeTypeBlacklist</a></div><div class="ttdeci">$wgMimeTypeBlacklist</div><div class="ttdoc">Files with these MIME types will never be allowed as uploads if $wgVerifyMimeType is enabled...</div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l00886">DefaultSettings.php:886</a></div></div> <div class="ttc" id="GlobalFunctions_8php_html_ae0675d4e55228eaad7607df946396cb4"><div class="ttname"><a href="GlobalFunctions_8php.html#ae0675d4e55228eaad7607df946396cb4">wfShellExecWithStderr</a></div><div class="ttdeci">wfShellExecWithStderr($cmd, &$retval=null, $environ=[], $limits=[])</div><div class="ttdoc">Execute a shell command, returning both stdout and stderr. </div><div class="ttdef"><b>Definition:</b> <a href="GlobalFunctions_8php_source.html#l02530">GlobalFunctions.php:2530</a></div></div> <div class="ttc" id="classUploadBase_html_a515d712e20d4ed2cee1b9f23637401ad"><div class="ttname"><a href="classUploadBase.html#a515d712e20d4ed2cee1b9f23637401ad">UploadBase\verifyFile</a></div><div class="ttdeci">verifyFile()</div><div class="ttdoc">Verifies that it's ok to include the uploaded file. </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00442">UploadBase.php:442</a></div></div> <div class="ttc" id="classUploadBase_html_a97839fdd914750ecd650fd3a045f36f8"><div class="ttname"><a href="classUploadBase.html#a97839fdd914750ecd650fd3a045f36f8">UploadBase\OK</a></div><div class="ttdeci">const OK</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00070">UploadBase.php:70</a></div></div> <div class="ttc" id="DefaultSettings_8php_html_a75612877f528cecdb711d45fa25588ee"><div class="ttname"><a href="DefaultSettings_8php.html#a75612877f528cecdb711d45fa25588ee">$wgVerifyMimeType</a></div><div class="ttdeci">$wgVerifyMimeType</div><div class="ttdoc">Determines if the MIME type of uploaded files should be checked. </div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l01288">DefaultSettings.php:1288</a></div></div> <div class="ttc" id="hooks_8txt_html_a1a5e48c4e4feac127181f418a6652ea7"><div class="ttname"><a href="hooks_8txt.html#a1a5e48c4e4feac127181f418a6652ea7">own</a></div><div class="ttdeci">this hook is for auditing only RecentChangesLinked and Watchlist RecentChangesLinked and Watchlist Do not use this to implement individual filters if they are compatible with the ChangesListFilter and ChangesListFilterGroup structure use sub classes of those in conjunction with the ChangesListSpecialPageStructuredFilters hook This hook can be used to implement filters that do not implement that or custom behavior that is not an individual filter e g Watchlist and Watchlist you will want to construct new ChangesListBooleanFilter or ChangesListStringOptionsFilter objects When constructing you specify which group they belong to You can reuse existing or create your own(ChangesListBooleanFilterGroup or ChangesListStringOptionsFilterGroup).If you create new groups</div></div> <div class="ttc" id="DefaultSettings_8php_html_a8775ad8dc715863ccf18c544d305670a"><div class="ttname"><a href="DefaultSettings_8php.html#a8775ad8dc715863ccf18c544d305670a">$wgFileBlacklist</a></div><div class="ttdeci">$wgFileBlacklist</div><div class="ttdoc">Files with these extensions will never be allowed as uploads. </div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l00872">DefaultSettings.php:872</a></div></div> <div class="ttc" id="classApiQueryImageInfo_html_a611c5e450f742dfa90aa802bf5b86c34"><div class="ttname"><a href="classApiQueryImageInfo.html#a611c5e450f742dfa90aa802bf5b86c34">ApiQueryImageInfo\getInfo</a></div><div class="ttdeci">static getInfo($file, $prop, $result, $thumbParams=null, $opts=false)</div><div class="ttdoc">Get result information for an image revision. </div><div class="ttdef"><b>Definition:</b> <a href="ApiQueryImageInfo_8php_source.html#l00375">ApiQueryImageInfo.php:375</a></div></div> <div class="ttc" id="classUploadBase_html_aaf9222d1c1e2cea503ffed7044ee01af"><div class="ttname"><a href="classUploadBase.html#aaf9222d1c1e2cea503ffed7044ee01af">UploadBase\$mLocalFile</a></div><div class="ttdeci">$mLocalFile</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00048">UploadBase.php:48</a></div></div> <div class="ttc" id="hooks_8txt_html_ac2ead7e8a992de6c5d4efa814a3d4c6b"><div class="ttname"><a href="hooks_8txt.html#ac2ead7e8a992de6c5d4efa814a3d4c6b">page</a></div><div class="ttdeci">do that in ParserLimitReportFormat instead use this to modify the parameters of the image and a DIV can begin in one section and end in another Make sure your code can handle that case gracefully See the EditSectionClearerLink extension for an example zero but section is usually empty its values are the globals values before the output is cached my talk page</div><div class="ttdef"><b>Definition:</b> <a href="hooks_8txt_source.html#l02537">hooks.txt:2537</a></div></div> <div class="ttc" id="classUploadBase_html_a149edc19abce49ba9de3521a7ea14dc8"><div class="ttname"><a href="classUploadBase.html#a149edc19abce49ba9de3521a7ea14dc8">UploadBase\EMPTY_FILE</a></div><div class="ttdeci">const EMPTY_FILE</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00071">UploadBase.php:71</a></div></div> <div class="ttc" id="classTitle_html_ae89bd391627ac34c9f943a1607f15928"><div class="ttname"><a href="classTitle.html#ae89bd391627ac34c9f943a1607f15928">Title\makeTitle</a></div><div class="ttdeci">static makeTitle($ns, $title, $fragment= '', $interwiki= '')</div><div class="ttdoc">Create a new Title from a namespace index and a DB key. </div><div class="ttdef"><b>Definition:</b> <a href="Title_8php_source.html#l00514">Title.php:514</a></div></div> <div class="ttc" id="namespaceMWException_html"><div class="ttname"><a href="namespaceMWException.html">MWException</a></div></div> <div class="ttc" id="classTitle_html_a20fdcacfb6f560717c2036d5113cf228"><div class="ttname"><a href="classTitle.html#a20fdcacfb6f560717c2036d5113cf228">Title\capitalize</a></div><div class="ttdeci">static capitalize($text, $ns=NS_MAIN)</div><div class="ttdoc">Capitalize a text string for a title if it belongs to a namespace that capitalizes. </div><div class="ttdef"><b>Definition:</b> <a href="Title_8php_source.html#l03378">Title.php:3378</a></div></div> <div class="ttc" id="classUploadBase_html_abc8a8f8b5f21f8a5dd84279978f471e1"><div class="ttname"><a href="classUploadBase.html#abc8a8f8b5f21f8a5dd84279978f471e1">UploadBase\getTempPath</a></div><div class="ttdeci">getTempPath()</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l01065">UploadBase.php:1065</a></div></div> <div class="ttc" id="classUploadBase_html_ad537badf14243a64cb5331bafd563244"><div class="ttname"><a href="classUploadBase.html#ad537badf14243a64cb5331bafd563244">UploadBase\getRealPath</a></div><div class="ttdeci">getRealPath($srcPath)</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00301">UploadBase.php:301</a></div></div> <div class="ttc" id="classUploadBase_html_a1b77c2db3cddd7ad587aed7464524301"><div class="ttname"><a href="classUploadBase.html#a1b77c2db3cddd7ad587aed7464524301">UploadBase\initializePathInfo</a></div><div class="ttdeci">initializePathInfo($name, $tempPath, $fileSize, $removeTempFile=false)</div><div class="ttdoc">Initialize the path information. </div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00231">UploadBase.php:231</a></div></div> <div class="ttc" id="namespaceUser_html"><div class="ttname"><a href="namespaceUser.html">User</a></div></div> <div class="ttc" id="classUploadBase_html_af6c491d0a6ef8295e6030d1ca60dcbcc"><div class="ttname"><a href="classUploadBase.html#af6c491d0a6ef8295e6030d1ca60dcbcc">UploadBase\checkOverwrite</a></div><div class="ttdeci">checkOverwrite($user)</div><div class="ttdoc">Check if there's an overwrite conflict and, if so, if restrictions forbid this user from performing t...</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l01843">UploadBase.php:1843</a></div></div> <div class="ttc" id="DefaultSettings_8php_html_a01c3b237a8adaa3513c952ea52cf6410"><div class="ttname"><a href="DefaultSettings_8php.html#a01c3b237a8adaa3513c952ea52cf6410">$wgAntivirus</a></div><div class="ttdeci">$wgAntivirus</div><div class="ttdoc">Internal name of virus scanner. </div><div class="ttdef"><b>Definition:</b> <a href="DefaultSettings_8php_source.html#l01229">DefaultSettings.php:1229</a></div></div> <div class="ttc" id="classUploadBase_html_a76651d9c2b11bd0dc7967c0e5c7e9a35"><div class="ttname"><a href="classUploadBase.html#a76651d9c2b11bd0dc7967c0e5c7e9a35">UploadBase\$mRemoveTempFile</a></div><div class="ttdeci">$mRemoveTempFile</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00045">UploadBase.php:45</a></div></div> <div class="ttc" id="NoLocalSettings_8php_html_ae9c29842f430802929abcf142683912c"><div class="ttname"><a href="NoLocalSettings_8php.html#ae9c29842f430802929abcf142683912c">$matches</a></div><div class="ttdeci">$matches</div><div class="ttdef"><b>Definition:</b> <a href="NoLocalSettings_8php_source.html#l00024">NoLocalSettings.php:24</a></div></div> <div class="ttc" id="classUploadBase_html_a40e2f0618fea100cfccce200ec9f2389"><div class="ttname"><a href="classUploadBase.html#a40e2f0618fea100cfccce200ec9f2389">UploadBase\runUploadStashFileHook</a></div><div class="ttdeci">runUploadStashFileHook(User $user)</div><div class="ttdef"><b>Definition:</b> <a href="UploadBase_8php_source.html#l00981">UploadBase.php:981</a></div></div> </div><!-- fragment --></div><!-- contents --> </div><!-- doc-content --> <!-- start footer part --> <div id="nav-path" class="navpath"><!-- id is needed for treeview function! --> <ul> <li class="navelem"><a class="el" href="dir_b0f92a87ee026d34ca8fad24187d57bf.html">includes</a></li><li class="navelem"><a class="el" href="dir_0b10f6acd4741c83db7478a14749b164.html">upload</a></li><li class="navelem"><a class="el" href="UploadBase_8php.html">UploadBase.php</a></li> <li class="footer">Generated on Mon May 22 2017 16:25:11 for MediaWiki by <a href="http://www.doxygen.org/index.html"> <img class="footer" src="doxygen.png" alt="doxygen"/></a> 1.8.8 </li> </ul> </div> </body> </html>