MediaWiki master
UploadStash.php
Go to the documentation of this file.
1<?php
27
59 // Format of the key for files -- has to be suitable as a filename itself (e.g. ab12cd34ef.jpg)
60 public const KEY_FORMAT_REGEX = '/^[\w\-\.]+\.\w*$/';
61 private const MAX_US_PROPS_SIZE = 65535;
62
69 public $repo;
70
72 protected $files = [];
73
75 protected $fileMetadata = [];
76
78 protected $fileProps = [];
79
81 private $user;
82
91 public function __construct( FileRepo $repo, UserIdentity $user = null ) {
92 // this might change based on wiki's configuration.
93 $this->repo = $repo;
94
95 // if a user was passed, use it. otherwise, attempt to use the global request context.
96 // this keeps FileRepo from breaking when it creates an UploadStash object
97 $this->user = $user ?? RequestContext::getMain()->getUser();
98 }
99
113 public function getFile( $key, $noAuth = false ) {
114 if ( !preg_match( self::KEY_FORMAT_REGEX, $key ) ) {
116 wfMessage( 'uploadstash-bad-path-bad-format', $key )
117 );
118 }
119
120 if ( !$noAuth && !$this->user->isRegistered() ) {
122 wfMessage( 'uploadstash-not-logged-in' )
123 );
124 }
125
126 if ( !isset( $this->fileMetadata[$key] ) ) {
127 if ( !$this->fetchFileMetadata( $key ) ) {
128 // If nothing was received, it's likely due to replication lag.
129 // Check the primary DB to see if the record is there.
130 $this->fetchFileMetadata( $key, DB_PRIMARY );
131 }
132
133 if ( !isset( $this->fileMetadata[$key] ) ) {
135 wfMessage( 'uploadstash-file-not-found', $key )
136 );
137 }
138
139 // create $this->files[$key]
140 $this->initFile( $key );
141
142 // fetch fileprops
143 if (
144 isset( $this->fileMetadata[$key]['us_props'] ) && strlen( $this->fileMetadata[$key]['us_props'] )
145 ) {
146 $this->fileProps[$key] = unserialize( $this->fileMetadata[$key]['us_props'] );
147 } else { // b/c for rows with no us_props
148 wfDebug( __METHOD__ . " fetched props for $key from file" );
149 $path = $this->fileMetadata[$key]['us_path'];
150 $this->fileProps[$key] = $this->repo->getFileProps( $path );
151 }
152 }
153
154 if ( !$this->files[$key]->exists() ) {
155 wfDebug( __METHOD__ . " tried to get file at $key, but it doesn't exist" );
156 // @todo Is this not an UploadStashFileNotFoundException case?
158 wfMessage( 'uploadstash-bad-path' )
159 );
160 }
161
162 if ( !$noAuth && $this->fileMetadata[$key]['us_user'] != $this->user->getId() ) {
164 wfMessage( 'uploadstash-wrong-owner', $key )
165 );
166 }
167
168 return $this->files[$key];
169 }
170
177 public function getMetadata( $key ) {
178 $this->getFile( $key );
179
180 return $this->fileMetadata[$key];
181 }
182
189 public function getFileProps( $key ) {
190 $this->getFile( $key );
191
192 return $this->fileProps[$key];
193 }
194
208 public function stashFile( $path, $sourceType = null, $fileProps = null ) {
209 if ( !is_file( $path ) ) {
210 wfDebug( __METHOD__ . " tried to stash file at '$path', but it doesn't exist" );
212 wfMessage( 'uploadstash-bad-path' )
213 );
214 }
215
216 // File props is expensive to generate for large files, so reuse if possible.
217 if ( !$fileProps ) {
218 $mwProps = new MWFileProps( MediaWikiServices::getInstance()->getMimeAnalyzer() );
219 $fileProps = $mwProps->getPropsFromPath( $path, true );
220 }
221 wfDebug( __METHOD__ . " stashing file at '$path'" );
222
223 // we will be initializing from some tmpnam files that don't have extensions.
224 // most of MediaWiki assumes all uploaded files have good extensions. So, we fix this.
225 $extension = self::getExtensionForPath( $path );
226 if ( !preg_match( "/\\.\\Q$extension\\E$/", $path ) ) {
227 $pathWithGoodExtension = "$path.$extension";
228 } else {
229 $pathWithGoodExtension = $path;
230 }
231
232 // If no key was supplied, make one. a mysql insertid would be totally
233 // reasonable here, except that for historical reasons, the key is this
234 // random thing instead. At least it's not guessable.
235 // Some things that when combined will make a suitably unique key.
236 // see: http://www.jwz.org/doc/mid.html
237 [ $usec, $sec ] = explode( ' ', microtime() );
238 $usec = substr( $usec, 2 );
239 $key = Wikimedia\base_convert( $sec . $usec, 10, 36 ) . '.' .
240 Wikimedia\base_convert( (string)mt_rand(), 10, 36 ) . '.' .
241 $this->user->getId() . '.' .
242 $extension;
243
244 $this->fileProps[$key] = $fileProps;
245
246 if ( !preg_match( self::KEY_FORMAT_REGEX, $key ) ) {
248 wfMessage( 'uploadstash-bad-path-bad-format', $key )
249 );
250 }
251
252 wfDebug( __METHOD__ . " key for '$path': $key" );
253
254 // if not already in a temporary area, put it there
255 $storeStatus = $this->repo->storeTemp( basename( $pathWithGoodExtension ), $path );
256
257 if ( !$storeStatus->isOK() ) {
258 // It is a convention in MediaWiki to only return one error per API
259 // exception, even if multiple errors are available.[citation needed]
260 // Pick the "first" thing that was wrong, preferring errors to warnings.
261 // This is a bit lame, as we may have more info in the
262 // $storeStatus and we're throwing it away, but to fix it means
263 // redesigning API errors significantly.
264 // $storeStatus->value just contains the virtual URL (if anything)
265 // which is probably useless to the caller.
266 foreach ( $storeStatus->getMessages( 'error' ) as $msg ) {
267 throw new UploadStashFileException( $msg );
268 }
269 foreach ( $storeStatus->getMessages( 'warning' ) as $msg ) {
270 throw new UploadStashFileException( $msg );
271 }
272 // XXX: This isn't a real message, hopefully this case is unreachable
273 throw new UploadStashFileException( [ 'unknown', 'no error recorded' ] );
274 }
275 $stashPath = $storeStatus->value;
276
277 // fetch the current user ID
278 if ( !$this->user->isRegistered() ) {
280 wfMessage( 'uploadstash-not-logged-in' )
281 );
282 }
283
284 // insert the file metadata into the db.
285 wfDebug( __METHOD__ . " inserting $stashPath under $key" );
286 $dbw = $this->repo->getPrimaryDB();
287
288 $serializedFileProps = serialize( $fileProps );
289 if ( strlen( $serializedFileProps ) > self::MAX_US_PROPS_SIZE ) {
290 // Database is going to truncate this and make the field invalid.
291 // Prioritize important metadata over file handler metadata.
292 // File handler should be prepared to regenerate invalid metadata if needed.
293 $fileProps['metadata'] = [];
294 $serializedFileProps = serialize( $fileProps );
295 }
296
297 $insertRow = [
298 'us_user' => $this->user->getId(),
299 'us_key' => $key,
300 'us_orig_path' => $path,
301 'us_path' => $stashPath, // virtual URL
302 'us_props' => $dbw->encodeBlob( $serializedFileProps ),
303 'us_size' => $fileProps['size'],
304 'us_sha1' => $fileProps['sha1'],
305 'us_mime' => $fileProps['mime'],
306 'us_media_type' => $fileProps['media_type'],
307 'us_image_width' => $fileProps['width'],
308 'us_image_height' => $fileProps['height'],
309 'us_image_bits' => $fileProps['bits'],
310 'us_source_type' => $sourceType,
311 'us_timestamp' => $dbw->timestamp(),
312 'us_status' => 'finished'
313 ];
314
315 $dbw->newInsertQueryBuilder()
316 ->insertInto( 'uploadstash' )
317 ->row( $insertRow )
318 ->caller( __METHOD__ )->execute();
319
320 // store the insertid in the class variable so immediate retrieval
321 // (possibly laggy) isn't necessary.
322 $insertRow['us_id'] = $dbw->insertId();
323
324 $this->fileMetadata[$key] = $insertRow;
325
326 # create the UploadStashFile object for this file.
327 $this->initFile( $key );
328
329 return $this->getFile( $key );
330 }
331
339 public function clear() {
340 if ( !$this->user->isRegistered() ) {
342 wfMessage( 'uploadstash-not-logged-in' )
343 );
344 }
345
346 wfDebug( __METHOD__ . ' clearing all rows for user ' . $this->user->getId() );
347 $dbw = $this->repo->getPrimaryDB();
348 $dbw->newDeleteQueryBuilder()
349 ->deleteFrom( 'uploadstash' )
350 ->where( [ 'us_user' => $this->user->getId() ] )
351 ->caller( __METHOD__ )->execute();
352
353 # destroy objects.
354 $this->files = [];
355 $this->fileMetadata = [];
356
357 return true;
358 }
359
368 public function removeFile( $key ) {
369 if ( !$this->user->isRegistered() ) {
371 wfMessage( 'uploadstash-not-logged-in' )
372 );
373 }
374
375 $dbw = $this->repo->getPrimaryDB();
376
377 // this is a cheap query. it runs on the primary DB so that this function
378 // still works when there's lag. It won't be called all that often.
379 $row = $dbw->newSelectQueryBuilder()
380 ->select( 'us_user' )
381 ->from( 'uploadstash' )
382 ->where( [ 'us_key' => $key ] )
383 ->caller( __METHOD__ )->fetchRow();
384
385 if ( !$row ) {
387 wfMessage( 'uploadstash-no-such-key', $key )
388 );
389 }
390
391 if ( $row->us_user != $this->user->getId() ) {
393 wfMessage( 'uploadstash-wrong-owner', $key )
394 );
395 }
396
397 return $this->removeFileNoAuth( $key );
398 }
399
406 public function removeFileNoAuth( $key ) {
407 wfDebug( __METHOD__ . " clearing row $key" );
408
409 // Ensure we have the UploadStashFile loaded for this key
410 $this->getFile( $key, true );
411
412 $dbw = $this->repo->getPrimaryDB();
413
414 $dbw->newDeleteQueryBuilder()
415 ->deleteFrom( 'uploadstash' )
416 ->where( [ 'us_key' => $key ] )
417 ->caller( __METHOD__ )->execute();
418
422 $this->files[$key]->remove();
423
424 unset( $this->files[$key] );
425 unset( $this->fileMetadata[$key] );
426
427 return true;
428 }
429
436 public function listFiles() {
437 if ( !$this->user->isRegistered() ) {
439 wfMessage( 'uploadstash-not-logged-in' )
440 );
441 }
442
443 $res = $this->repo->getReplicaDB()->newSelectQueryBuilder()
444 ->select( 'us_key' )
445 ->from( 'uploadstash' )
446 ->where( [ 'us_user' => $this->user->getId() ] )
447 ->caller( __METHOD__ )->fetchResultSet();
448
449 if ( $res->numRows() == 0 ) {
450 // nothing to do.
451 return false;
452 }
453
454 // finish the read before starting writes.
455 $keys = [];
456 foreach ( $res as $row ) {
457 $keys[] = $row->us_key;
458 }
459
460 return $keys;
461 }
462
472 public static function getExtensionForPath( $path ) {
473 $prohibitedFileExtensions = MediaWikiServices::getInstance()
474 ->getMainConfig()->get( MainConfigNames::ProhibitedFileExtensions );
475 // Does this have an extension?
476 $n = strrpos( $path, '.' );
477
478 if ( $n !== false ) {
479 $extension = $n ? substr( $path, $n + 1 ) : '';
480 } else {
481 // If not, assume that it should be related to the MIME type of the original file.
482 $magic = MediaWikiServices::getInstance()->getMimeAnalyzer();
483 $mimeType = $magic->guessMimeType( $path );
484 $extension = $magic->getExtensionFromMimeTypeOrNull( $mimeType ) ?? '';
485 }
486
487 $extension = File::normalizeExtension( $extension );
488 if ( in_array( $extension, $prohibitedFileExtensions ) ) {
489 // The file should already be checked for being evil.
490 // However, if somehow we got here, we definitely
491 // don't want to give it an extension of .php and
492 // put it in a web accessible directory.
493 return '';
494 }
495
496 return $extension;
497 }
498
506 protected function fetchFileMetadata( $key, $readFromDB = DB_REPLICA ) {
507 // populate $fileMetadata[$key]
508 if ( $readFromDB === DB_PRIMARY ) {
509 // sometimes reading from the primary DB is necessary, if there's replication lag.
510 $dbr = $this->repo->getPrimaryDB();
511 } else {
512 $dbr = $this->repo->getReplicaDB();
513 }
514
515 $row = $dbr->newSelectQueryBuilder()
516 ->select( [
517 'us_user', 'us_key', 'us_orig_path', 'us_path', 'us_props',
518 'us_size', 'us_sha1', 'us_mime', 'us_media_type',
519 'us_image_width', 'us_image_height', 'us_image_bits',
520 'us_source_type', 'us_timestamp', 'us_status',
521 ] )
522 ->from( 'uploadstash' )
523 ->where( [ 'us_key' => $key ] )
524 ->caller( __METHOD__ )->fetchRow();
525
526 if ( !is_object( $row ) ) {
527 // key wasn't present in the database. this will happen sometimes.
528 return false;
529 }
530
531 $this->fileMetadata[$key] = (array)$row;
532 $this->fileMetadata[$key]['us_props'] = $dbr->decodeBlob( $row->us_props );
533
534 return true;
535 }
536
544 protected function initFile( $key ) {
545 $file = new UploadStashFile(
546 $this->repo,
547 $this->fileMetadata[$key]['us_path'],
548 $key,
549 $this->fileMetadata[$key]['us_sha1']
550 );
551 if ( $file->getSize() === 0 ) {
553 wfMessage( 'uploadstash-zero-length' )
554 );
555 }
556 $this->files[$key] = $file;
557
558 return true;
559 }
560}
wfDebug( $text, $dest='all', array $context=[])
Sends a line to the debug log if enabled or, optionally, to a comment in output.
wfMessage( $key,... $params)
This is the function for getting translated interface messages.
getFile()
Get the file for this page, if one exists.
Base class for file repositories.
Definition FileRepo.php:52
Local repository that stores files in the local filesystem and registers them in the wiki's own datab...
Definition LocalRepo.php:49
MimeMagic helper wrapper.
Group all the pieces relevant to the context of a request into one instance.
A class containing constants representing the names of configuration variables.
Service locator for MediaWiki core services.
UploadStash is intended to accomplish a few things:
static getExtensionForPath( $path)
Find or guess extension – ensuring that our extension matches our MIME type.
removeFile( $key)
Remove a particular file from the stash.
const KEY_FORMAT_REGEX
fetchFileMetadata( $key, $readFromDB=DB_REPLICA)
Helper function: do the actual database query to fetch file metadata.
getFileProps( $key)
Getter for fileProps.
clear()
Remove all files from the stash.
array $fileMetadata
cache of the file metadata that's stored in the database
array $fileProps
fileprops cache
listFiles()
List all files in the stash.
__construct(FileRepo $repo, UserIdentity $user=null)
Represents a temporary filestore, with metadata in the database.
getMetadata( $key)
Getter for file metadata.
removeFileNoAuth( $key)
Remove a file (see removeFile), but doesn't check ownership first.
initFile( $key)
Helper function: Initialize the UploadStashFile for a given file.
stashFile( $path, $sourceType=null, $fileProps=null)
Stash a file in a temp directory and record that we did this in the database, along with other metada...
getFile( $key, $noAuth=false)
Get a file and its metadata from the stash.
LocalRepo $repo
repository that this uses to store temp files public because we sometimes need to get a LocalFile wit...
array $files
array of initialized repo objects
Interface for objects representing user identity.
const DB_REPLICA
Definition defines.php:26
const DB_PRIMARY
Definition defines.php:28