Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

filerepo: extract AuthenticatedFileEntryPoint from img_auth.php

Browse source 
The idea is that all entry points should share the code in the
MediaWikiEntryPoint base class. This change just moves code from
the file scope into a class, without any structural changes.

Bug: T354216
Change-Id: Ie2e827d30a070bcc63bdce56891c3aa0a4dacddd
This commit is contained in:
daniel 2023-11-29 14:15:44 +01:00
parent 822a0eea73
commit 12aa2374ab
7 changed files with 773 additions and 189 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
autoload.php
View file

@ -1133,6 +1133,7 @@ $wgAutoloadLocalClasses = [
'MediaWiki\\Feed\\RSSFeed' => __DIR__ . '/includes/Feed/RSSFeed.php',
'MediaWiki\\FileBackend\\FSFile\\TempFSFileFactory' => __DIR__ . '/includes/libs/filebackend/fsfile/TempFSFileFactory.php',
'MediaWiki\\FileBackend\\LockManager\\LockManagerGroupFactory' => __DIR__ . '/includes/filebackend/lockmanager/LockManagerGroupFactory.php',
'MediaWiki\\FileRepo\\AuthenticatedFileEntryPoint' => __DIR__ . '/includes/filerepo/AuthenticatedFileEntryPoint.php',
'MediaWiki\\FileRepo\\File\\FileSelectQueryBuilder' => __DIR__ . '/includes/filerepo/file/FileSelectQueryBuilder.php',
'MediaWiki\\FileRepo\\Thumbnail404EntryPoint' => __DIR__ . '/includes/filerepo/Thumbnail404EntryPoint.php',
'MediaWiki\\FileRepo\\ThumbnailEntryPoint' => __DIR__ . '/includes/filerepo/ThumbnailEntryPoint.php',

197
img_auth.php
View file

@ -20,6 +20,8 @@
* Your server needs to support REQUEST_URI or PATH_INFO; CGI-based
* configurations sometimes don't.
*
* @see MediaWiki\FileRepo\AuthenticatedFileEntryPoint The implementation.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
@ -40,195 +42,16 @@
*/
use MediaWiki\Context\RequestContext;
use MediaWiki\HookContainer\HookRunner;
use MediaWiki\Html\TemplateParser;
use MediaWiki\Request\WebRequest;
use MediaWiki\Title\Title;
use MediaWiki\EntryPointEnvironment;
use MediaWiki\FileRepo\AuthenticatedFileEntryPoint;
use MediaWiki\MediaWikiServices;
define( 'MW_NO_OUTPUT_COMPRESSION', 1 );
define( 'MW_ENTRY_POINT', 'img_auth' );
require __DIR__ . '/includes/WebStart.php';
wfImageAuthMain();
$mediawiki = new MediaWiki();
$mediawiki->doPostOutputShutdown();
function wfImageAuthMain() {
global $wgImgAuthUrlPathMap, $wgScriptPath, $wgImgAuthPath;
$services = \MediaWiki\MediaWikiServices::getInstance();
$permissionManager = $services->getPermissionManager();
$request = RequestContext::getMain()->getRequest();
$publicWiki = $services->getGroupPermissionsLookup()->groupHasPermission( '*', 'read' );
// Find the path assuming the request URL is relative to the local public zone URL
$baseUrl = $services->getRepoGroup()->getLocalRepo()->getZoneUrl( 'public' );
if ( $baseUrl[0] === '/' ) {
$basePath = $baseUrl;
} else {
$basePath = parse_url( $baseUrl, PHP_URL_PATH );
}
$path = WebRequest::getRequestPathSuffix( $basePath );
if ( $path === false ) {
// Try instead assuming img_auth.php is the base path
$basePath = $wgImgAuthPath ?: "$wgScriptPath/img_auth.php";
$path = WebRequest::getRequestPathSuffix( $basePath );
}
if ( $path === false ) {
wfForbidden( 'img-auth-accessdenied', 'img-auth-notindir' );
return;
}
if ( $path === '' || $path[0] !== '/' ) {
// Make sure $path has a leading /
$path = "/" . $path;
}
$user = RequestContext::getMain()->getUser();
// Various extensions may have their own backends that need access.
// Check if there is a special backend and storage base path for this file.
foreach ( $wgImgAuthUrlPathMap as $prefix => $storageDir ) {
$prefix = rtrim( $prefix, '/' ) . '/'; // implicit trailing slash
if ( strpos( $path, $prefix ) === 0 ) {
$be = $services->getFileBackendGroup()->backendFromPath( $storageDir );
$filename = $storageDir . substr( $path, strlen( $prefix ) ); // strip prefix
// Check basic user authorization
$isAllowedUser = $permissionManager->userHasRight( $user, 'read' );
if ( !$isAllowedUser ) {
wfForbidden( 'img-auth-accessdenied', 'img-auth-noread', $path );
return;
}
if ( $be->fileExists( [ 'src' => $filename ] ) ) {
wfDebugLog( 'img_auth', "Streaming `" . $filename . "`." );
$be->streamFile( [
'src' => $filename,
'headers' => [ 'Cache-Control: private', 'Vary: Cookie' ]
] );
} else {
wfForbidden( 'img-auth-accessdenied', 'img-auth-nofile', $path );
}
return;
}
}
// Get the local file repository
$repo = $services->getRepoGroup()->getRepo( 'local' );
$zone = strstr( ltrim( $path, '/' ), '/', true );
// Get the full file storage path and extract the source file name.
// (e.g. 120px-Foo.png => Foo.png or page2-120px-Foo.png => Foo.png).
// This only applies to thumbnails/transcoded, and each of them should
// be under a folder that has the source file name.
if ( $zone === 'thumb' || $zone === 'transcoded' ) {
$name = wfBaseName( dirname( $path ) );
$filename = $repo->getZonePath( $zone ) . substr( $path, strlen( "/" . $zone ) );
// Check to see if the file exists
if ( !$repo->fileExists( $filename ) ) {
wfForbidden( 'img-auth-accessdenied', 'img-auth-nofile', $filename );
return;
}
} else {
$name = wfBaseName( $path ); // file is a source file
$filename = $repo->getZonePath( 'public' ) . $path;
// Check to see if the file exists and is not deleted
$bits = explode( '!', $name, 2 );
if ( str_starts_with( $path, '/archive/' ) && count( $bits ) == 2 ) {
$file = $repo->newFromArchiveName( $bits[1], $name );
} else {
$file = $repo->newFile( $name );
}
if ( !$file->exists() || $file->isDeleted( File::DELETED_FILE ) ) {
wfForbidden( 'img-auth-accessdenied', 'img-auth-nofile', $filename );
return;
}
}
$headers = []; // extra HTTP headers to send
$title = Title::makeTitleSafe( NS_FILE, $name );
$hookRunner = new HookRunner( $services->getHookContainer() );
if ( !$publicWiki ) {
// For private wikis, run extra auth checks and set cache control headers
$headers['Cache-Control'] = 'private';
$headers['Vary'] = 'Cookie';
if ( !$title instanceof Title ) { // files have valid titles
wfForbidden( 'img-auth-accessdenied', 'img-auth-badtitle', $name );
return;
}
// Run hook for extension authorization plugins
/** @var array $result */
$result = null;
if ( !$hookRunner->onImgAuthBeforeStream( $title, $path, $name, $result ) ) {
wfForbidden( $result[0], $result[1], array_slice( $result, 2 ) );
return;
}
// Check user authorization for this title
// Checks Whitelist too
if ( !$permissionManager->userCan( 'read', $user, $title ) ) {
wfForbidden( 'img-auth-accessdenied', 'img-auth-noread', $name );
return;
}
}
if ( isset( $_SERVER['HTTP_RANGE'] ) ) {
$headers['Range'] = $_SERVER['HTTP_RANGE'];
}
if ( isset( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) ) {
$headers['If-Modified-Since'] = $_SERVER['HTTP_IF_MODIFIED_SINCE'];
}
if ( $request->getCheck( 'download' ) ) {
$headers['Content-Disposition'] = 'attachment';
}
// Allow modification of headers before streaming a file
$hookRunner->onImgAuthModifyHeaders( $title->getTitleValue(), $headers );
// Stream the requested file
[ $headers, $options ] = HTTPFileStreamer::preprocessHeaders( $headers );
wfDebugLog( 'img_auth', "Streaming `" . $filename . "`." );
$repo->streamFileWithStatus( $filename, $headers, $options );
}
/**
* Issue a standard HTTP 403 Forbidden header ($msg1-a message index, not a message) and an
* error message ($msg2, also a message index), (both required) then end the script
* subsequent arguments to $msg2 will be passed as parameters only for replacing in $msg2
* @param string $msg1
* @param string $msg2
* @param mixed ...$args To pass as params to wfMessage() with $msg2. Either variadic, or a single
* array argument.
*/
function wfForbidden( $msg1, $msg2, ...$args ) {
global $wgImgAuthDetails;
$args = ( isset( $args[0] ) && is_array( $args[0] ) ) ? $args[0] : $args;
$msgHdr = wfMessage( $msg1 )->text();
$detailMsgKey = $wgImgAuthDetails ? $msg2 : 'badaccess-group0';
$detailMsg = wfMessage( $detailMsgKey, $args )->text();
wfDebugLog( 'img_auth',
"wfForbidden Hdr: " . wfMessage( $msg1 )->inLanguage( 'en' )->text() . " Msg: " .
wfMessage( $msg2, $args )->inLanguage( 'en' )->text()
);
HttpStatus::header( 403 );
header( 'Cache-Control: no-cache' );
header( 'Content-Type: text/html; charset=utf-8' );
$templateParser = new TemplateParser();
echo $templateParser->processTemplate( 'ImageAuthForbidden', [
'msgHdr' => $msgHdr,
'detailMsg' => $detailMsg,
] );
}
( new AuthenticatedFileEntryPoint(
RequestContext::getMain(),
new EntryPointEnvironment(),
MediaWikiServices::getInstance()
) )->run();

1
includes/MediaWikiEntryPoint.php
View file

@ -147,6 +147,7 @@ abstract class MediaWikiEntryPoint {
protected function doSetup() {
// no-op
// TODO: move ob_start( [ MediaWiki\Output\OutputHandler::class, 'handle' ] ) here
// TODO: move MW_NO_OUTPUT_COMPRESSION handling here.
// TODO: move HeaderCallback::register() here
// TODO: move SessionManager::getGlobalSession() here (from Setup.php)
// TODO: move AuthManager::autoCreateUser here (from Setup.php)

234
includes/filerepo/AuthenticatedFileEntryPoint.php Normal file
View file

@ -0,0 +1,234 @@
<?php
/**
* Entry point implementation for serving non-public images to logged-in users.
*
* @see /img_auth.php The web entry point.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
* http://www.gnu.org/copyleft/gpl.html
*
* @file
* @ingroup entrypoint
*/
namespace MediaWiki\FileRepo;
use File;
use HTTPFileStreamer;
use MediaWiki\HookContainer\HookRunner;
use MediaWiki\Html\TemplateParser;
use MediaWiki\MainConfigNames;
use MediaWiki\MediaWikiEntryPoint;
use MediaWiki\Title\Title;
class AuthenticatedFileEntryPoint extends MediaWikiEntryPoint {
/**
* Main entry point
*/
public function execute() {
$services = $this->getServiceContainer();
$permissionManager = $services->getPermissionManager();
$request = $this->getRequest();
$publicWiki = $services->getGroupPermissionsLookup()->groupHasPermission( '*', 'read' );
// Find the path assuming the request URL is relative to the local public zone URL
$baseUrl = $services->getRepoGroup()->getLocalRepo()->getZoneUrl( 'public' );
if ( $baseUrl[0] === '/' ) {
$basePath = $baseUrl;
} else {
$basePath = parse_url( $baseUrl, PHP_URL_PATH );
}
$path = $this->getRequestPathSuffix( "$basePath" );
if ( $path === false ) {
// Try instead assuming img_auth.php is the base path
$basePath = $this->getConfig( MainConfigNames::ImgAuthPath )
?: $this->getConfig( MainConfigNames::ScriptPath ) . '/img_auth.php';
$path = $this->getRequestPathSuffix( $basePath );
}
if ( $path === false ) {
$this->forbidden( 'img-auth-accessdenied', 'img-auth-notindir' );
return;
}
if ( $path === '' || $path[0] !== '/' ) {
// Make sure $path has a leading /
$path = "/" . $path;
}
$user = $this->getContext()->getUser();
// Various extensions may have their own backends that need access.
// Check if there is a special backend and storage base path for this file.
$pathMap = $this->getConfig( MainConfigNames::ImgAuthUrlPathMap );
foreach ( $pathMap as $prefix => $storageDir ) {
$prefix = rtrim( $prefix, '/' ) . '/'; // implicit trailing slash
if ( strpos( $path, $prefix ) === 0 ) {
$be = $services->getFileBackendGroup()->backendFromPath( $storageDir );
$filename = $storageDir . substr( $path, strlen( $prefix ) ); // strip prefix
// Check basic user authorization
$isAllowedUser = $permissionManager->userHasRight( $user, 'read' );
if ( !$isAllowedUser ) {
$this->forbidden( 'img-auth-accessdenied', 'img-auth-noread', $path );
return;
}
if ( $be && $be->fileExists( [ 'src' => $filename ] ) ) {
wfDebugLog( 'img_auth', "Streaming `" . $filename . "`." );
$be->streamFile( [
'src' => $filename,
'headers' => [ 'Cache-Control: private', 'Vary: Cookie' ]
] );
} else {
$this->forbidden( 'img-auth-accessdenied', 'img-auth-nofile', $path );
}
return;
}
}
// Get the local file repository
$repo = $services->getRepoGroup()->getLocalRepo();
$zone = strstr( ltrim( $path, '/' ), '/', true );
// Get the full file storage path and extract the source file name.
// (e.g. 120px-Foo.png => Foo.png or page2-120px-Foo.png => Foo.png).
// This only applies to thumbnails/transcoded, and each of them should
// be under a folder that has the source file name.
if ( $zone === 'thumb' || $zone === 'transcoded' ) {
$name = wfBaseName( dirname( $path ) );
$filename = $repo->getZonePath( $zone ) . substr( $path, strlen( "/" . $zone ) );
// Check to see if the file exists
if ( !$repo->fileExists( $filename ) ) {
$this->forbidden( 'img-auth-accessdenied', 'img-auth-nofile', $filename );
return;
}
} else {
$name = wfBaseName( $path ); // file is a source file
$filename = $repo->getZonePath( 'public' ) . $path;
// Check to see if the file exists and is not deleted
$bits = explode( '!', $name, 2 );
if ( str_starts_with( $path, '/archive/' ) && count( $bits ) == 2 ) {
$file = $repo->newFromArchiveName( $bits[1], $name );
} else {
$file = $repo->newFile( $name );
}
if ( !$file || !$file->exists() || $file->isDeleted( File::DELETED_FILE ) ) {
$this->forbidden( 'img-auth-accessdenied', 'img-auth-nofile', $filename );
return;
}
}
$headers = []; // extra HTTP headers to send
$title = Title::makeTitleSafe( NS_FILE, $name );
$hookRunner = new HookRunner( $services->getHookContainer() );
if ( !$publicWiki ) {
// For private wikis, run extra auth checks and set cache control headers
$headers['Cache-Control'] = 'private';
$headers['Vary'] = 'Cookie';
if ( !$title instanceof Title ) { // files have valid titles
$this->forbidden( 'img-auth-accessdenied', 'img-auth-badtitle', $name );
return;
}
// Run hook for extension authorization plugins
$authResult = [];
if ( !$hookRunner->onImgAuthBeforeStream( $title, $path, $name, $authResult ) ) {
$this->forbidden( $authResult[0], $authResult[1], array_slice( $authResult, 2 ) );
return;
}
// Check user authorization for this title
// Checks Whitelist too
if ( !$permissionManager->userCan( 'read', $user, $title ) ) {
$this->forbidden( 'img-auth-accessdenied', 'img-auth-noread', $name );
return;
}
}
$range = $this->environment->getServerInfo( 'HTTP_RANGE' );
$ims = $this->environment->getServerInfo( 'HTTP_IF_MODIFIED_SINCE' );
if ( $range !== null ) {
$headers['Range'] = $range;
}
if ( $ims !== null ) {
$headers['If-Modified-Since'] = $ims;
}
if ( $request->getCheck( 'download' ) ) {
$headers['Content-Disposition'] = 'attachment';
}
// Allow modification of headers before streaming a file
$hookRunner->onImgAuthModifyHeaders( $title->getTitleValue(), $headers );
// Stream the requested file
$this->prepareForOutput();
[ $headers, $options ] = HTTPFileStreamer::preprocessHeaders( $headers );
wfDebugLog( 'img_auth', "Streaming `" . $filename . "`." );
$repo->streamFileWithStatus( $filename, $headers, $options );
$this->enterPostSendMode();
}
/**
* Issue a standard HTTP 403 Forbidden header ($msg1-a message index, not a message) and an
* error message ($msg2, also a message index), (both required) then end the script
* subsequent arguments to $msg2 will be passed as parameters only for replacing in $msg2
*
* @param string $msg1
* @param string $msg2
* @param mixed ...$args To pass as params to $context->msg() with $msg2. Either variadic, or a single
* array argument.
*/
private function forbidden( $msg1, $msg2, ...$args ) {
$args = ( isset( $args[0] ) && is_array( $args[0] ) ) ? $args[0] : $args;
$context = $this->getContext();
$msgHdr = $context->msg( $msg1 )->text();
$detailMsgKey = $this->getConfig( MainConfigNames::ImgAuthDetails )
? $msg2 : 'badaccess-group0';
$detailMsg = $context->msg(
$detailMsgKey,
$args
)->text();
wfDebugLog(
'img_auth',
"wfForbidden Hdr: " . $context->msg( $msg1 )->inLanguage( 'en' )->text()
. " Msg: " . $context->msg( $msg2, $args )->inLanguage( 'en' )->text()
);
$this->status( 403 );
$this->header( 'Cache-Control: no-cache' );
$this->header( 'Content-Type: text/html; charset=utf-8' );
$templateParser = new TemplateParser();
$this->print(
$templateParser->processTemplate( 'ImageAuthForbidden', [
'msgHdr' => $msgHdr,
'detailMsg' => $detailMsg,
] )
);
}
}

461
tests/phpunit/includes/filerepo/AuthenticatedFileEntryPointTest.php Normal file
View file

@ -0,0 +1,461 @@
<?php
use MediaWiki\FileRepo\AuthenticatedFileEntryPoint;
use MediaWiki\MainConfigNames;
use MediaWiki\Request\FauxRequest;
use MediaWiki\Tests\FileRepo\TestRepoTrait;
use MediaWiki\Tests\MockEnvironment;
/**
* @covers \MediaWiki\FileRepo\AuthenticatedFileEntryPoint
* @group Database
*/
class AuthenticatedFileEntryPointTest extends MediaWikiIntegrationTestCase {
use TestRepoTrait;
private const PNG_MAGIC = "\x89\x50\x4e\x47";
private const JPEG_MAGIC = "\xff\xd8\xff\xe0";
private const IMAGES_DIR = __DIR__ . '/../../data/media';
private ?MockEnvironment $environment = null;
/**
* will be called only once per test class
*/
public function addDBDataOnce() {
// Create mock repo with test files
$this->initTestRepoGroup();
$this->importFileToTestRepo( self::IMAGES_DIR . '/greyscale-png.png', 'Test.png' );
$this->importFileToTestRepo( self::IMAGES_DIR . '/test.jpg', 'Icon.jpg' );
// Create a second version of Test.png and Icon.jpg
$this->importFileToTestRepo( self::IMAGES_DIR . '/greyscale-na-png.png', 'Test.png' );
$this->importFileToTestRepo( self::IMAGES_DIR . '/portrait-rotated.jpg', 'Icon.jpg' );
// Create a thumbnail
$this->copyFileToTestBackend(
self::IMAGES_DIR . '/greyscale-na-png.png',
'/thumb/Test.png'
);
// Create a redirect
$title = Title::makeTitle( NS_FILE, 'Redirect_to_Test.png' );
$this->editPage( $title, '#REDIRECT [[File:Test.png]]' );
// Suppress the old version of Icon
$file = $this->getTestRepo()->newFile( 'Icon.jpg' );
$history = $file->getHistory();
$oldFile = $history[0];
$this->db->newUpdateQueryBuilder()
->table( 'oldimage' )
->set( [ 'oi_deleted' => 1 ] )
->where( [ 'oi_archive_name' => $oldFile->getArchiveName() ] )
->caller( __METHOD__ )
->execute();
}
protected function setUp(): void {
parent::setUp();
$this->overrideConfigValue(
MainConfigNames::ImgAuthDetails,
true
);
$this->overrideConfigValue(
MainConfigNames::ForeignFileRepos,
[]
);
$this->overrideConfigValue(
MainConfigNames::UseInstantCommons,
false
);
$this->overrideConfigValue(
MainConfigNames::ImgAuthUrlPathMap,
[ '/testing' => 'mwstore://test/test-thumb/' ]
);
$this->overrideConfigValue(
MainConfigNames::ImgAuthPath,
'/img_auth/'
);
$this->installTestRepoGroup();
}
private function recordHeader( string $header ) {
$this->environment->getFauxResponse()->header( $header );
}
private function getFileUrlPath( string $name, string $prefix = '' ): string {
if ( $prefix !== '' && !str_ends_with( $prefix, '/' ) ) {
$prefix = $prefix . '/';
}
if ( !str_starts_with( $prefix, '/' ) ) {
// Unauthenticated path
$prefix = '/w/images/' . $prefix;
}
$file = $this->getTestRepo()->newFile( $name );
if ( $file ) {
$name = $file->getRel();
}
return $prefix . $name;
}
/**
* @param FauxRequest|string|array|null $request
*
* @return MockEnvironment
*/
private function makeEnvironment( $request ): MockEnvironment {
if ( !$request ) {
$request = new FauxRequest();
}
if ( is_string( $request ) ) {
$url = $request;
$request = new FauxRequest();
$request->setRequestURL( $url );
}
if ( is_array( $request ) ) {
$request = new FauxRequest( $request );
}
$this->environment = new MockEnvironment( $request );
return $this->environment;
}
/**
* @param MockEnvironment|null $environment
* @param FauxRequest|RequestContext|string|array|null $request
*
* @return AuthenticatedFileEntryPoint
*/
private function getEntryPoint( MockEnvironment $environment = null, $request = null ) {
if ( !$request && $environment ) {
$request = $environment->getFauxRequest();
}
if ( $request instanceof RequestContext ) {
$context = $request;
$request = $context->getRequest();
} else {
$context = new RequestContext();
$context->setRequest( $request );
$context->setUser( $this->getTestUser()->getUser() );
}
if ( !$environment ) {
$environment = $this->makeEnvironment( $request );
}
$entryPoint = new AuthenticatedFileEntryPoint(
$context,
$environment,
$this->getServiceContainer()
);
$entryPoint->enableOutputCapture();
return $entryPoint;
}
public static function provideGetRequestPathSuffix() {
yield [ '/upload', '/upload/file', 'file' ];
yield [ '/upload', '/upload/file?q=x', 'file' ];
yield [ '/upload', '/upload/x%25y', 'x%y' ];
yield [ '/foo', '/upload/file', false ];
}
/**
* @dataProvider provideGetRequestPathSuffix
*
* @param string $basePath
* @param string $requestURL
* @param string|false $expected
*
* @covers \MediaWiki\MediaWikiEntryPoint::getRequestPathSuffix
*/
public function testGetRequestPathSuffix( string $basePath, string $requestURL, $expected ) {
$entryPoint = $this->getEntryPoint( $this->makeEnvironment( $requestURL ) );
$this->assertSame( $expected, $entryPoint->getRequestPathSuffix( $basePath ) );
}
public static function provideStreamFile() {
yield 'public wiki' => [
'',
];
yield 'private wiki' => [
'',
[
'*' => [],
'user' => [ 'read' => true ],
],
[],
[],
[
'cache-control' => 'private',
'vary' => 'Cookie',
]
];
yield 'range' => [
'',
[],
[],
[ 'HTTP_RANGE' => 'bytes=0-99' ],
[ 'content-range' => 'bytes 0-99/365', 'content-length' => '100' ],
206
];
yield 'download' => [
'',
[],
[ 'download' => 1 ],
[],
[ 'content-disposition' => 'attachment' ]
];
yield 'thumb zone' => [
// Path under /w/images/
'thumb',
];
yield 'mapped prefix' => [
// Path under /w/images/
'testing', // per ImgAuthUrlPathMap
];
yield 'use ImgAuthPath' => [
// If the prefix starts with a "/" it's the full path.
'/img_auth/', // per ImgAuthPath
];
}
/**
* @dataProvider provideStreamFile
*
* @param string $prefix
* @param array $permissions
* @param array $requestData
* @param array $serverInfo
* @param array $expectedHeaders
* @param int $expectedCode
*
* @throws Exception
*/
public function testStreamFile(
string $prefix,
array $permissions = [],
array $requestData = [],
array $serverInfo = [],
array $expectedHeaders = [],
int $expectedCode = 200
) {
if ( !isset( $permissions['*'] ) ) {
// public wiki
$permissions['*'] = [ 'read' => true ];
}
$this->overrideConfigValue( MainConfigNames::GroupPermissions, $permissions );
$name = 'Test.png';
$url = $this->getFileUrlPath( $name, $prefix );
$request = new FauxRequest( $requestData );
$request->setRequestURL( $url );
$env = $this->makeEnvironment( $request );
foreach ( $serverInfo as $key => $value ) {
$env->setServerInfo( $key, $value );
}
$entryPoint = $this->getEntryPoint( $env );
$entryPoint->run();
$data = $entryPoint->getCapturedOutput();
$env->assertStatusCode( $expectedCode, $data );
$this->assertStringStartsWith(
self::PNG_MAGIC,
$data
);
$env->assertHeaderValue( 'image/png', 'Content-Type' );
foreach ( $expectedHeaders as $name => $exp ) {
$env->assertHeaderValue( $exp, $name );
}
}
public function testStreamFile_archive() {
$this->overrideConfigValue(
MainConfigNames::GroupPermissions,
[ '*' => [ 'read' => true ] ]
);
$name = 'Test.png';
$file = $this->getTestRepo()->newFile( $name );
$history = $file->getHistory();
$oldFile = $history[0];
$url = '/img_auth/' . $oldFile->getArchiveRel() . '/' . $oldFile->getArchiveName();
$env = $this->makeEnvironment( $url );
$entryPoint = $this->getEntryPoint( $env );
$entryPoint->run();
$data = $entryPoint->getCapturedOutput();
$env->assertStatusCode( 200, $data );
}
public function testNotModified() {
$this->overrideConfigValue(
MainConfigNames::GroupPermissions,
[ '*' => [ 'read' => true ] ]
);
$url = $this->getFileUrlPath( 'Test.png' );
$env = $this->makeEnvironment( $url );
$env->setServerInfo( 'HTTP_IF_MODIFIED_SINCE', '25250101001122' );
$entryPoint = $this->getEntryPoint( $env );
$entryPoint->run();
// Not modified
$env->assertStatusCode( 304 );
}
public function testAccessDenied_deleted() {
$this->overrideConfigValue(
MainConfigNames::GroupPermissions,
[ '*' => [ 'read' => true ] ]
);
$name = 'Icon.jpg';
$file = $this->getTestRepo()->newFile( $name );
$history = $file->getHistory();
// This old revision is marked as deleted (supressed) in the database
$oldFile = $history[0];
$url = '/img_auth/' . $oldFile->getArchiveRel() . '/' . $oldFile->getArchiveName();
$env = $this->makeEnvironment( $url );
$entryPoint = $this->getEntryPoint( $env );
$entryPoint->run();
$data = $entryPoint->getCapturedOutput();
$env->assertStatusCode( 403, $data );
}
public static function provideAccessDenied() {
yield 'no prefix' => [ '' ];
yield 'thumb zone' => [ 'thumb' ];
yield 'mapped prefix' => [ 'testing' ];
}
/**
* @dataProvider provideAccessDenied
*/
public function testAccessDenied(
string $prefix,
string $expected = 'User does not have access to read'
) {
$this->overrideConfigValue(
MainConfigNames::GroupPermissions,
[ '*' => [], 'user' => [], ]
);
$env = $this->makeEnvironment( $this->getFileUrlPath( 'Test.png', $prefix ) );
$entryPoint = $this->getEntryPoint( $env );
$entryPoint->run();
$output = $entryPoint->getCapturedOutput();
$env->assertStatusCode( 403 );
$env->assertHeaderValue( 'no-cache', 'cache-control' );
$this->assertStringContainsString( '<h1>Access denied</h1>', $output );
$this->assertStringContainsString( $expected, $output );
}
public function testAccessDenied_hook() {
$this->setUserLang( 'qqx' );
$this->overrideConfigValue(
MainConfigNames::GroupPermissions,
[ '*' => [], 'user' => [ 'read' => true ], ]
);
$this->setTemporaryHook(
'ImgAuthBeforeStream',
static function ( $title, $path, $name, ?array &$result ) {
$result = [ 'test-title', 'test-detail' ];
return false;
}
);
$env = $this->makeEnvironment( $this->getFileUrlPath( 'Test.png' ) );
$entryPoint = $this->getEntryPoint( $env );
$entryPoint->run();
$output = $entryPoint->getCapturedOutput();
$env->assertStatusCode( 403 );
$env->assertHeaderValue( 'no-cache', 'cache-control' );
$this->assertStringContainsString( '<h1>⧼test-title⧽</h1>', $output );
$this->assertStringContainsString( '<p>⧼test-detail⧽</p>', $output );
}
public static function provideNotFOund() {
yield 'no prefix, missing file' =>
[ 'No-such-file.png', '' ];
yield 'no prefix, bad title' =>
[ '_<>_', '' ];
yield 'thumb zone' =>
[ 'No-such-file.png', 'thumb' ];
yield 'mapped prefix' =>
[ 'No-such-file.png', 'testing' ];
yield 'unrecognized base path' =>
[
'No-such-file.png',
'/bad/base/path',
'Requested path is not in the configured',
];
}
/**
* @dataProvider provideNotFOund
*/
public function testNotFound( string $name, string $prefix, $expected = 'does not exist' ) {
$this->overrideConfigValue(
MainConfigNames::GroupPermissions,
[
'*' => [ 'read' => 'true' ],
]
);
$env = $this->makeEnvironment( $this->getFileUrlPath( $name, $prefix ) );
$entryPoint = $this->getEntryPoint( $env );
$entryPoint->run();
$output = $entryPoint->getCapturedOutput();
// Missing files are also "forbidden"
$env->assertStatusCode( 403 );
$env->assertHeaderValue( 'no-cache', 'cache-control' );
$this->assertStringContainsString(
'<h1>Access denied</h1>',
$output
);
$this->assertStringContainsString(
$expected,
$output
);
}
}

2
tests/phpunit/includes/filerepo/ThumbnailEntryPointTest.php
View file

@ -37,7 +37,7 @@ class ThumbnailEntryPointTest extends MediaWikiIntegrationTestCase {
$this->importFileToTestRepo( self::IMAGES_DIR . '/greyscale-png.png', 'Test.png' );
$this->importFileToTestRepo( self::IMAGES_DIR . '/test.jpg', 'Icon.jpg' );
// Create a second version of Test.png
// Create a second version of Test.png and Icon.jpg
$this->importFileToTestRepo( self::IMAGES_DIR . '/greyscale-na-png.png', 'Test.png' );
$this->importFileToTestRepo( self::IMAGES_DIR . '/portrait-rotated.jpg', 'Icon.jpg' );

66
tests/phpunit/mocks/filerepo/TestRepoTrait.php
View file

@ -3,6 +3,7 @@
namespace MediaWiki\Tests\FileRepo;
use FileBackend;
use FileBackendGroup;
use FSFileBackend;
use LocalRepo;
use LogicException;
@ -85,7 +86,10 @@ trait TestRepoTrait {
}
private function installTestRepoGroup( array $options = [] ) {
$this->setService( 'RepoGroup', $this->createTestRepoGroup( $options ) );
$repoGroup = $this->createTestRepoGroup( $options );
$this->setService( 'RepoGroup', $repoGroup );
$this->installTestBackendGroup( $repoGroup->getLocalRepo()->getBackend() );
}
private function createTestRepoGroup( $options = [], ?MediaWikiServices $services = null ) {
@ -103,6 +107,27 @@ trait TestRepoTrait {
return $repoGroup;
}
private function installTestBackendGroup( FileBackend $backend ) {
$this->setService( 'FileBackendGroup', $this->createTestBackendGroup( $backend ) );
}
private function createTestBackendGroup( FileBackend $backend ) {
$expected = "mwstore://{$backend->getName()}/";
$backendGroup = $this->createNoOpMock( FileBackendGroup::class, [ 'backendFromPath' ] );
$backendGroup->method( 'backendFromPath' )->willReturnCallback(
static function ( $path ) use ( $expected, $backend ) {
if ( str_starts_with( $path, $expected ) ) {
return $backend;
}
return null;
}
);
return $backendGroup;
}
private function getLocalFileRepoConfig( $options = [] ): array {
if ( self::$mockRepoTraitDir === null ) {
throw new LogicException( 'Mock repo not initialized. ' .
@ -215,6 +240,45 @@ trait TestRepoTrait {
return $file;
}
private function copyFileToTestBackend( string $src, string $dst ) {
$repo = self::getTestRepo();
$backend = $repo->getBackend();
$zone = strstr( ltrim( $dst, '/' ), '/', true );
$name = basename( $dst );
$dstFile = $repo->newFile( $name );
$dst = $dstFile->getRel();
if ( $zone !== null ) {
$zonePath = $repo->getZonePath( $zone );
if ( $zonePath ) {
$dst = "$zonePath/$dst";
}
}
$dir = dirname( $dst );
if ( $dir !== '' ) {
$status = $backend->prepare(
[ 'op' => 'prepare', 'dir' => $dir ]
);
if ( !$status->isOK() ) {
Assert::fail( "Error copying file $src to $dst: " . $status );
}
}
$status = $backend->store(
[ 'op' => 'store', 'src' => $src, 'dst' => $dst, ],
);
if ( !$status->isOK() ) {
Assert::fail( "Error copying file $src to $dst: " . $status );
}
}
private function recordHeader( string $header ) {
// no-op
}