Aaron Schulz has uploaded a new change for review.
https://gerrit.wikimedia.org/r/167296
Change subject: Treat the "temp" repo zone as private
......................................................................
Treat the "temp" repo zone as private
* The primary user is the upload stash. Both stashed originals and thumbnails
can
be viewed through Special:UploadStash, which checks the appropriate
permissions.
There is no need for direct web access.
* Note that the scalar URL has to point to something that does no authentication
checks since the HTTP GET has no cookie headers propagated. However the file
name is the URL is determined by us_path, which is not exposed to the author
but rather stored in the DB and linked by the file key. The author should only
know the key.
Change-Id: I403520053b2053094e5f90083b6375bc04c351f4
---
M RELEASE-NOTES-1.25
M includes/filerepo/FileRepo.php
2 files changed, 7 insertions(+), 1 deletion(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/core
refs/changes/96/167296/1
diff --git a/RELEASE-NOTES-1.25 b/RELEASE-NOTES-1.25
index 2d5e7f4..e8cbd75 100644
--- a/RELEASE-NOTES-1.25
+++ b/RELEASE-NOTES-1.25
@@ -122,6 +122,9 @@
* Deprecated OutputPage::readOnlyPage() and OutputPage::rateLimited().
Also, the former will now throw an MWException if called with one or more
arguments.
+* The "temp" zone of the upload respository is now considered private. If it
+ already exists (such as under the images/ directory), please make sure that
+ the directory is not web readable (e.g. via a .htaccess file).
== Compatibility ==
diff --git a/includes/filerepo/FileRepo.php b/includes/filerepo/FileRepo.php
index 5929525..de742f0 100644
--- a/includes/filerepo/FileRepo.php
+++ b/includes/filerepo/FileRepo.php
@@ -1305,7 +1305,10 @@
list( , $container, ) = FileBackend::splitStoragePath( $path );
$params = array( 'dir' => $path );
- if ( $this->isPrivate || $container ===
$this->zones['deleted']['container'] ) {
+ if ( $this->isPrivate
+ || $container === $this->zones['deleted']['container']
+ || $container === $this->zones['temp']['container']
+ ) {
# Take all available measures to prevent web
accessibility of new deleted
# directories, in case the user has not configured
offline storage
$params = array( 'noAccess' => true, 'noListing' =>
true ) + $params;
--
To view, visit https://gerrit.wikimedia.org/r/167296
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I403520053b2053094e5f90083b6375bc04c351f4
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/core
Gerrit-Branch: master
Gerrit-Owner: Aaron Schulz <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
