3 * Image download authorisation script
5 * To use, in LocalSettings.php set $wgUploadDirectory to point to a non-public
6 * directory, and $wgUploadPath to point to this file. Also set $wgWhitelistRead
7 * to an array of pages you want everyone to be able to access. Your server must
8 * support PATH_INFO, CGI-based configurations generally don't.
10 # Valid web server entry point, enable includes
11 define( 'MEDIAWIKI', true );
13 if ( isset( $_REQUEST['GLOBALS'] ) ) {
14 die( '<a href="http://www.hardened-php.net/index.76.html">$GLOBALS overwrite vulnerability</a>');
17 require_once( 'includes/Defines.php' );
18 require_once( './LocalSettings.php' );
19 require_once( 'includes/Setup.php' );
20 require_once( 'includes/StreamFile.php' );
22 if( !isset( $_SERVER['PATH_INFO'] ) ) {
26 # Get filenames/directories
27 $filename = realpath( $wgUploadDirectory . $_SERVER['PATH_INFO'] );
28 $realUploadDirectory = realpath( $wgUploadDirectory );
29 $imageName = $wgLang->getNsText( NS_IMAGE
) . ":" . basename( $_SERVER['PATH_INFO'] );
31 # Check if the filename is in the correct directory
32 if ( substr( $filename, 0, strlen( $realUploadDirectory ) ) != $realUploadDirectory ) {
36 if ( is_array( $wgWhitelistRead ) && !in_array( $imageName, $wgWhitelistRead ) && !$wgUser->getID() ) {
40 if( !file_exists( $filename ) ) {
43 if( is_dir( $filename ) ) {
48 wfStreamFile( $filename );
50 function wfForbidden() {
51 header( 'HTTP/1.0 403 Forbidden' );
54 <h1>Access denied</h1>
55 <p>You need to log in to access files on this server</p>