MarkAHershberger has uploaded a new change for review. (
https://gerrit.wikimedia.org/r/328672 )
Change subject: thumbnail script should respect imgAuthBeforeStream
......................................................................
thumbnail script should respect imgAuthBeforeStream
Bug: T153948
Change-Id: Ieb4828251daede48d9db0b44897ccecc8395b231
---
M thumb.php
1 file changed, 20 insertions(+), 13 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/core
refs/changes/72/328672/1
diff --git a/thumb.php b/thumb.php
index c38b89c..6684f2c 100644
--- a/thumb.php
+++ b/thumb.php
@@ -72,7 +72,7 @@
return;
}
- wfStreamThumb( $params ); // stream the thumbnail
+ wfStreamThumb( $params, $matches['title'] ); // stream the thumbnail
}
/**
@@ -88,7 +88,7 @@
* to the parameters)
* @return void
*/
-function wfStreamThumb( array $params ) {
+function wfStreamThumb( array $params, $path ) {
global $wgVaryOnXFP;
$headers = []; // HTTP headers to send
@@ -118,6 +118,18 @@
// Some basic input validation
$fileName = strtr( $fileName, '\\/', '__' );
+ // Format is <timestamp>!<name>
+ $bits = explode( '!', $fileName, 2 );
+ if ( count( $bits ) !== 2 && $isOld ) {
+ wfThumbError( 404, wfMessage( 'badtitletext' )->parse() );
+ return;
+ }
+ $name = $bits[1];
+ $title = Title::makeTitleSafe( NS_FILE, $name );
+ if ( !$title ) {
+ wfThumbError( 404, wfMessage( 'badtitletext' )->parse() );
+ return;
+ }
// Actually fetch the image. Method depends on whether it is archived
or not.
if ( $isTemp ) {
@@ -129,17 +141,6 @@
$repo->getZonePath( 'public' ) . '/' .
$repo->getTempHashPath( $fileName ) . $fileName
);
} elseif ( $isOld ) {
- // Format is <timestamp>!<name>
- $bits = explode( '!', $fileName, 2 );
- if ( count( $bits ) != 2 ) {
- wfThumbError( 404, wfMessage( 'badtitletext' )->parse()
);
- return;
- }
- $title = Title::makeTitleSafe( NS_FILE, $bits[1] );
- if ( !$title ) {
- wfThumbError( 404, wfMessage( 'badtitletext' )->parse()
);
- return;
- }
$img =
RepoGroup::singleton()->getLocalRepo()->newFromArchiveName( $title, $fileName );
} else {
$img = wfLocalFile( $fileName );
@@ -169,6 +170,12 @@
return;
}
+ $result = null;
+ if ( !Hooks::run( 'ImgAuthBeforeStream', [ &$title, &$path, &$name,
&$result ] ) ) {
+ wfForbidden( $result[0], $result[1], array_slice( $result, 2 )
);
+ return;
+ }
+
// Do rendering parameters extraction from thumbnail name.
if ( isset( $params['thumbName'] ) ) {
$params = wfExtractThumbParams( $img, $params );
--
To view, visit https://gerrit.wikimedia.org/r/328672
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: Ieb4828251daede48d9db0b44897ccecc8395b231
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/core
Gerrit-Branch: master
Gerrit-Owner: MarkAHershberger <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
