MediaWiki master
UploadStash.php
Go to the documentation of this file.
1<?php
27
59 // Format of the key for files -- has to be suitable as a filename itself (e.g. ab12cd34ef.jpg)
60 public const KEY_FORMAT_REGEX = '/^[\w\-\.]+\.\w*$/';
61 private const MAX_US_PROPS_SIZE = 65535;
62
69 public $repo;
70
72 protected $files = [];
73
75 protected $fileMetadata = [];
76
78 protected $fileProps = [];
79
81 private $user;
82
91 public function __construct( FileRepo $repo, UserIdentity $user = null ) {
92 // this might change based on wiki's configuration.
93 $this->repo = $repo;
94
95 // if a user was passed, use it. otherwise, attempt to use the global request context.
96 // this keeps FileRepo from breaking when it creates an UploadStash object
97 $this->user = $user ?? RequestContext::getMain()->getUser();
98 }
99
113 public function getFile( $key, $noAuth = false ) {
114 if ( !preg_match( self::KEY_FORMAT_REGEX, $key ) ) {
116 wfMessage( 'uploadstash-bad-path-bad-format', $key )
117 );
118 }
119
120 if ( !$noAuth && !$this->user->isRegistered() ) {
122 wfMessage( 'uploadstash-not-logged-in' )
123 );
124 }
125
126 if ( !isset( $this->fileMetadata[$key] ) ) {
127 if ( !$this->fetchFileMetadata( $key ) ) {
128 // If nothing was received, it's likely due to replication lag.
129 // Check the primary DB to see if the record is there.
130 $this->fetchFileMetadata( $key, DB_PRIMARY );
131 }
132
133 if ( !isset( $this->fileMetadata[$key] ) ) {
135 wfMessage( 'uploadstash-file-not-found', $key )
136 );
137 }
138
139 // create $this->files[$key]
140 $this->initFile( $key );
141
142 // fetch fileprops
143 if (
144 isset( $this->fileMetadata[$key]['us_props'] ) && strlen( $this->fileMetadata[$key]['us_props'] )
145 ) {
146 $this->fileProps[$key] = unserialize( $this->fileMetadata[$key]['us_props'] );
147 } else { // b/c for rows with no us_props
148 wfDebug( __METHOD__ . " fetched props for $key from file" );
149 $path = $this->fileMetadata[$key]['us_path'];
150 $this->fileProps[$key] = $this->repo->getFileProps( $path );
151 }
152 }
153
154 if ( !$this->files[$key]->exists() ) {
155 wfDebug( __METHOD__ . " tried to get file at $key, but it doesn't exist" );
156 // @todo Is this not an UploadStashFileNotFoundException case?
158 wfMessage( 'uploadstash-bad-path' )
159 );
160 }
161
162 if ( !$noAuth && $this->fileMetadata[$key]['us_user'] != $this->user->getId() ) {
164 wfMessage( 'uploadstash-wrong-owner', $key )
165 );
166 }
167
168 return $this->files[$key];
169 }
170
177 public function getMetadata( $key ) {
178 $this->getFile( $key );
179
180 return $this->fileMetadata[$key];
181 }
182
189 public function getFileProps( $key ) {
190 $this->getFile( $key );
191
192 return $this->fileProps[$key];
193 }
194
207 public function stashFile( $path, $sourceType = null ) {
208 if ( !is_file( $path ) ) {
209 wfDebug( __METHOD__ . " tried to stash file at '$path', but it doesn't exist" );
211 wfMessage( 'uploadstash-bad-path' )
212 );
213 }
214
215 $mwProps = new MWFileProps( MediaWikiServices::getInstance()->getMimeAnalyzer() );
216 $fileProps = $mwProps->getPropsFromPath( $path, true );
217 wfDebug( __METHOD__ . " stashing file at '$path'" );
218
219 // we will be initializing from some tmpnam files that don't have extensions.
220 // most of MediaWiki assumes all uploaded files have good extensions. So, we fix this.
221 $extension = self::getExtensionForPath( $path );
222 if ( !preg_match( "/\\.\\Q$extension\\E$/", $path ) ) {
223 $pathWithGoodExtension = "$path.$extension";
224 } else {
225 $pathWithGoodExtension = $path;
226 }
227
228 // If no key was supplied, make one. a mysql insertid would be totally
229 // reasonable here, except that for historical reasons, the key is this
230 // random thing instead. At least it's not guessable.
231 // Some things that when combined will make a suitably unique key.
232 // see: http://www.jwz.org/doc/mid.html
233 [ $usec, $sec ] = explode( ' ', microtime() );
234 $usec = substr( $usec, 2 );
235 $key = Wikimedia\base_convert( $sec . $usec, 10, 36 ) . '.' .
236 Wikimedia\base_convert( (string)mt_rand(), 10, 36 ) . '.' .
237 $this->user->getId() . '.' .
238 $extension;
239
240 $this->fileProps[$key] = $fileProps;
241
242 if ( !preg_match( self::KEY_FORMAT_REGEX, $key ) ) {
244 wfMessage( 'uploadstash-bad-path-bad-format', $key )
245 );
246 }
247
248 wfDebug( __METHOD__ . " key for '$path': $key" );
249
250 // if not already in a temporary area, put it there
251 $storeStatus = $this->repo->storeTemp( basename( $pathWithGoodExtension ), $path );
252
253 if ( !$storeStatus->isOK() ) {
254 // It is a convention in MediaWiki to only return one error per API
255 // exception, even if multiple errors are available. We use reset()
256 // to pick the "first" thing that was wrong, preferring errors to
257 // warnings. This is a bit lame, as we may have more info in the
258 // $storeStatus and we're throwing it away, but to fix it means
259 // redesigning API errors significantly.
260 // $storeStatus->value just contains the virtual URL (if anything)
261 // which is probably useless to the caller.
262 $error = $storeStatus->getErrorsArray();
263 $error = reset( $error );
264 if ( !count( $error ) ) {
265 $error = $storeStatus->getWarningsArray();
266 $error = reset( $error );
267 if ( !count( $error ) ) {
268 $error = [ 'unknown', 'no error recorded' ];
269 }
270 }
271 // At this point, $error should contain the single "most important"
272 // error, plus any parameters.
273 $errorMsg = array_shift( $error );
274 throw new UploadStashFileException( wfMessage( $errorMsg, $error ) );
275 }
276 $stashPath = $storeStatus->value;
277
278 // fetch the current user ID
279 if ( !$this->user->isRegistered() ) {
281 wfMessage( 'uploadstash-not-logged-in' )
282 );
283 }
284
285 // insert the file metadata into the db.
286 wfDebug( __METHOD__ . " inserting $stashPath under $key" );
287 $dbw = $this->repo->getPrimaryDB();
288
289 $serializedFileProps = serialize( $fileProps );
290 if ( strlen( $serializedFileProps ) > self::MAX_US_PROPS_SIZE ) {
291 // Database is going to truncate this and make the field invalid.
292 // Prioritize important metadata over file handler metadata.
293 // File handler should be prepared to regenerate invalid metadata if needed.
294 $fileProps['metadata'] = [];
295 $serializedFileProps = serialize( $fileProps );
296 }
297
298 $insertRow = [
299 'us_user' => $this->user->getId(),
300 'us_key' => $key,
301 'us_orig_path' => $path,
302 'us_path' => $stashPath, // virtual URL
303 'us_props' => $dbw->encodeBlob( $serializedFileProps ),
304 'us_size' => $fileProps['size'],
305 'us_sha1' => $fileProps['sha1'],
306 'us_mime' => $fileProps['mime'],
307 'us_media_type' => $fileProps['media_type'],
308 'us_image_width' => $fileProps['width'],
309 'us_image_height' => $fileProps['height'],
310 'us_image_bits' => $fileProps['bits'],
311 'us_source_type' => $sourceType,
312 'us_timestamp' => $dbw->timestamp(),
313 'us_status' => 'finished'
314 ];
315
316 $dbw->newInsertQueryBuilder()
317 ->insertInto( 'uploadstash' )
318 ->row( $insertRow )
319 ->caller( __METHOD__ )->execute();
320
321 // store the insertid in the class variable so immediate retrieval
322 // (possibly laggy) isn't necessary.
323 $insertRow['us_id'] = $dbw->insertId();
324
325 $this->fileMetadata[$key] = $insertRow;
326
327 # create the UploadStashFile object for this file.
328 $this->initFile( $key );
329
330 return $this->getFile( $key );
331 }
332
340 public function clear() {
341 if ( !$this->user->isRegistered() ) {
343 wfMessage( 'uploadstash-not-logged-in' )
344 );
345 }
346
347 wfDebug( __METHOD__ . ' clearing all rows for user ' . $this->user->getId() );
348 $dbw = $this->repo->getPrimaryDB();
349 $dbw->newDeleteQueryBuilder()
350 ->deleteFrom( 'uploadstash' )
351 ->where( [ 'us_user' => $this->user->getId() ] )
352 ->caller( __METHOD__ )->execute();
353
354 # destroy objects.
355 $this->files = [];
356 $this->fileMetadata = [];
357
358 return true;
359 }
360
369 public function removeFile( $key ) {
370 if ( !$this->user->isRegistered() ) {
372 wfMessage( 'uploadstash-not-logged-in' )
373 );
374 }
375
376 $dbw = $this->repo->getPrimaryDB();
377
378 // this is a cheap query. it runs on the primary DB so that this function
379 // still works when there's lag. It won't be called all that often.
380 $row = $dbw->newSelectQueryBuilder()
381 ->select( 'us_user' )
382 ->from( 'uploadstash' )
383 ->where( [ 'us_key' => $key ] )
384 ->caller( __METHOD__ )->fetchRow();
385
386 if ( !$row ) {
388 wfMessage( 'uploadstash-no-such-key', $key )
389 );
390 }
391
392 if ( $row->us_user != $this->user->getId() ) {
394 wfMessage( 'uploadstash-wrong-owner', $key )
395 );
396 }
397
398 return $this->removeFileNoAuth( $key );
399 }
400
407 public function removeFileNoAuth( $key ) {
408 wfDebug( __METHOD__ . " clearing row $key" );
409
410 // Ensure we have the UploadStashFile loaded for this key
411 $this->getFile( $key, true );
412
413 $dbw = $this->repo->getPrimaryDB();
414
415 $dbw->newDeleteQueryBuilder()
416 ->deleteFrom( 'uploadstash' )
417 ->where( [ 'us_key' => $key ] )
418 ->caller( __METHOD__ )->execute();
419
423 $this->files[$key]->remove();
424
425 unset( $this->files[$key] );
426 unset( $this->fileMetadata[$key] );
427
428 return true;
429 }
430
437 public function listFiles() {
438 if ( !$this->user->isRegistered() ) {
440 wfMessage( 'uploadstash-not-logged-in' )
441 );
442 }
443
444 $res = $this->repo->getReplicaDB()->newSelectQueryBuilder()
445 ->select( 'us_key' )
446 ->from( 'uploadstash' )
447 ->where( [ 'us_user' => $this->user->getId() ] )
448 ->caller( __METHOD__ )->fetchResultSet();
449
450 if ( !is_object( $res ) || $res->numRows() == 0 ) {
451 // nothing to do.
452 return false;
453 }
454
455 // finish the read before starting writes.
456 $keys = [];
457 foreach ( $res as $row ) {
458 $keys[] = $row->us_key;
459 }
460
461 return $keys;
462 }
463
473 public static function getExtensionForPath( $path ) {
474 $prohibitedFileExtensions = MediaWikiServices::getInstance()
475 ->getMainConfig()->get( MainConfigNames::ProhibitedFileExtensions );
476 // Does this have an extension?
477 $n = strrpos( $path, '.' );
478
479 if ( $n !== false ) {
480 $extension = $n ? substr( $path, $n + 1 ) : '';
481 } else {
482 // If not, assume that it should be related to the MIME type of the original file.
483 $magic = MediaWikiServices::getInstance()->getMimeAnalyzer();
484 $mimeType = $magic->guessMimeType( $path );
485 $extension = $magic->getExtensionFromMimeTypeOrNull( $mimeType ) ?? '';
486 }
487
488 $extension = File::normalizeExtension( $extension );
489 if ( in_array( $extension, $prohibitedFileExtensions ) ) {
490 // The file should already be checked for being evil.
491 // However, if somehow we got here, we definitely
492 // don't want to give it an extension of .php and
493 // put it in a web accessible directory.
494 return '';
495 }
496
497 return $extension;
498 }
499
507 protected function fetchFileMetadata( $key, $readFromDB = DB_REPLICA ) {
508 // populate $fileMetadata[$key]
509 if ( $readFromDB === DB_PRIMARY ) {
510 // sometimes reading from the primary DB is necessary, if there's replication lag.
511 $dbr = $this->repo->getPrimaryDB();
512 } else {
513 $dbr = $this->repo->getReplicaDB();
514 }
515
516 $row = $dbr->newSelectQueryBuilder()
517 ->select( [
518 'us_user', 'us_key', 'us_orig_path', 'us_path', 'us_props',
519 'us_size', 'us_sha1', 'us_mime', 'us_media_type',
520 'us_image_width', 'us_image_height', 'us_image_bits',
521 'us_source_type', 'us_timestamp', 'us_status',
522 ] )
523 ->from( 'uploadstash' )
524 ->where( [ 'us_key' => $key ] )
525 ->caller( __METHOD__ )->fetchRow();
526
527 if ( !is_object( $row ) ) {
528 // key wasn't present in the database. this will happen sometimes.
529 return false;
530 }
531
532 $this->fileMetadata[$key] = (array)$row;
533 $this->fileMetadata[$key]['us_props'] = $dbr->decodeBlob( $row->us_props );
534
535 return true;
536 }
537
545 protected function initFile( $key ) {
546 $file = new UploadStashFile( $this->repo, $this->fileMetadata[$key]['us_path'], $key );
547 if ( $file->getSize() === 0 ) {
549 wfMessage( 'uploadstash-zero-length' )
550 );
551 }
552 $this->files[$key] = $file;
553
554 return true;
555 }
556}
wfDebug( $text, $dest='all', array $context=[])
Sends a line to the debug log if enabled or, optionally, to a comment in output.
wfMessage( $key,... $params)
This is the function for getting translated interface messages.
getFile()
Get the file for this page, if one exists.
Base class for file repositories.
Definition FileRepo.php:51
Local repository that stores files in the local filesystem and registers them in the wiki's own datab...
Definition LocalRepo.php:49
MimeMagic helper wrapper.
Group all the pieces relevant to the context of a request into one instance.
A class containing constants representing the names of configuration variables.
Service locator for MediaWiki core services.
UploadStash is intended to accomplish a few things:
static getExtensionForPath( $path)
Find or guess extension – ensuring that our extension matches our MIME type.
removeFile( $key)
Remove a particular file from the stash.
const KEY_FORMAT_REGEX
fetchFileMetadata( $key, $readFromDB=DB_REPLICA)
Helper function: do the actual database query to fetch file metadata.
getFileProps( $key)
Getter for fileProps.
stashFile( $path, $sourceType=null)
Stash a file in a temp directory and record that we did this in the database, along with other metada...
clear()
Remove all files from the stash.
array $fileMetadata
cache of the file metadata that's stored in the database
array $fileProps
fileprops cache
listFiles()
List all files in the stash.
__construct(FileRepo $repo, UserIdentity $user=null)
Represents a temporary filestore, with metadata in the database.
getMetadata( $key)
Getter for file metadata.
removeFileNoAuth( $key)
Remove a file (see removeFile), but doesn't check ownership first.
initFile( $key)
Helper function: Initialize the UploadStashFile for a given file.
getFile( $key, $noAuth=false)
Get a file and its metadata from the stash.
LocalRepo $repo
repository that this uses to store temp files public because we sometimes need to get a LocalFile wit...
array $files
array of initialized repo objects
Interface for objects representing user identity.
const DB_REPLICA
Definition defines.php:26
const DB_PRIMARY
Definition defines.php:28