includes/upload/UploadFromUrl.php

   1 <?php
   2 /**
   3  * Implements uploading from a HTTP resource.
   4  *
   5  * @ingroup Upload
   6  * @author Bryan Tong Minh
   7  * @author Michael Dale
   8  */
   9 class UploadFromUrl extends UploadBase {
  10         protected $mAsync, $mUrl;
  11         protected $mIgnoreWarnings = true;
  12
  13         protected $mTempPath, $mTmpHandle;
  14
  15         /**
  16          * Checks if the user is allowed to use the upload-by-URL feature. If the
  17          * user is allowed, pass on permissions checking to the parent.
  18          *
  19          * @param $user User
  20          *
  21          * @return bool
  22          */
  23         public static function isAllowed( $user ) {
  24                 if ( !$user->isAllowed( 'upload_by_url' ) ) {
  25                         return 'upload_by_url';
  26                 }
  27                 return parent::isAllowed( $user );
  28         }
  29
  30         /**
  31          * Checks if the upload from URL feature is enabled
  32          * @return bool
  33          */
  34         public static function isEnabled() {
  35                 global $wgAllowCopyUploads;
  36                 return $wgAllowCopyUploads && parent::isEnabled();
  37         }
  38
  39         /**
  40          * Checks whether the URL is for an allowed host
  41          *
  42          * @param $url string
  43          * @return bool
  44          */
  45         public static function isAllowedHost( $url ) {
  46                 global $wgCopyUploadsDomains;
  47                 if ( !count( $wgCopyUploadsDomains ) ) {
  48                         return true;
  49                 }
  50                 $parsedUrl = wfParseUrl( $url );
  51                 if ( !$parsedUrl ) {
  52                         return false;
  53                 }
  54                 $valid = false;
  55                 foreach( $wgCopyUploadsDomains as $domain ) {
  56                         if ( $parsedUrl['host'] === $domain ) {
  57                                 $valid = true;
  58                                 break;
  59                         }
  60                 }
  61                 return $valid;
  62         }
  63
  64         /**
  65          * Entry point for API upload
  66          *
  67          * @param $name string
  68          * @param $url string
  69          * @param $async mixed Whether the download should be performed
  70          * asynchronous. False for synchronous, async or async-leavemessage for
  71          * asynchronous download.
  72          */
  73         public function initialize( $name, $url, $async = false ) {
  74                 global $wgAllowAsyncCopyUploads;
  75
  76                 $this->mUrl = $url;
  77                 $this->mAsync = $wgAllowAsyncCopyUploads ? $async : false;
  78                 if ( $async ) {
  79                         throw new MWException( 'Asynchronous copy uploads are no longer possible as of r81612.' );
  80                 }
  81
  82                 $tempPath = $this->mAsync ? null : $this->makeTemporaryFile();
  83                 # File size and removeTempFile will be filled in later
  84                 $this->initializePathInfo( $name, $tempPath, 0, false );
  85         }
  86
  87         /**
  88          * Entry point for SpecialUpload
  89          * @param $request WebRequest object
  90          */
  91         public function initializeFromRequest( &$request ) {
  92                 $desiredDestName = $request->getText( 'wpDestFile' );
  93                 if ( !$desiredDestName ) {
  94                         $desiredDestName = $request->getText( 'wpUploadFileURL' );
  95                 }
  96                 return $this->initialize(
  97                         $desiredDestName,
  98                         trim( $request->getVal( 'wpUploadFileURL' ) ),
  99                         false
 100                 );
 101         }
 102
 103         /**
 104          * @param $request WebRequest object
 105          * @return bool
 106          */
 107         public static function isValidRequest( $request ) {
 108                 global $wgUser;
 109
 110                 $url = $request->getVal( 'wpUploadFileURL' );
 111                 return !empty( $url )
 112                         && Http::isValidURI( $url )
 113                         && $wgUser->isAllowed( 'upload_by_url' );
 114         }
 115
 116         /**
 117          * @return string
 118          */
 119         public function getSourceType() { return 'url'; }
 120
 121         /**
 122          * @return Status
 123          */
 124         public function fetchFile() {
 125                 if ( !Http::isValidURI( $this->mUrl ) ) {
 126                         return Status::newFatal( 'http-invalid-url' );
 127                 }
 128
 129                 if( !self::isAllowedHost( $this->mUrl ) ) {
 130                         return Status::newFatal( 'upload-copy-upload-invalid-domain' );
 131                 }
 132                 if ( !$this->mAsync ) {
 133                         return $this->reallyFetchFile();
 134                 }
 135                 return Status::newGood();
 136         }
 137         /**
 138          * Create a new temporary file in the URL subdirectory of wfTempDir().
 139          *
 140          * @return string Path to the file
 141          */
 142         protected function makeTemporaryFile() {
 143                 return tempnam( wfTempDir(), 'URL' );
 144         }
 145
 146         /**
 147          * Callback: save a chunk of the result of a HTTP request to the temporary file
 148          *
 149          * @param $req mixed
 150          * @param $buffer string
 151          * @return int number of bytes handled
 152          */
 153         public function saveTempFileChunk( $req, $buffer ) {
 154                 $nbytes = fwrite( $this->mTmpHandle, $buffer );
 155
 156                 if ( $nbytes == strlen( $buffer ) ) {
 157                         $this->mFileSize += $nbytes;
 158                 } else {
 159                         // Well... that's not good!
 160                         fclose( $this->mTmpHandle );
 161                         $this->mTmpHandle = false;
 162                 }
 163
 164                 return $nbytes;
 165         }
 166
 167         /**
 168          * Download the file, save it to the temporary file and update the file
 169          * size and set $mRemoveTempFile to true.
 170          * @return Status
 171          */
 172         protected function reallyFetchFile() {
 173                 if ( $this->mTempPath === false ) {
 174                         return Status::newFatal( 'tmp-create-error' );
 175                 }
 176
 177                 // Note the temporary file should already be created by makeTemporaryFile()
 178                 $this->mTmpHandle = fopen( $this->mTempPath, 'wb' );
 179                 if ( !$this->mTmpHandle ) {
 180                         return Status::newFatal( 'tmp-create-error' );
 181                 }
 182
 183                 $this->mRemoveTempFile = true;
 184                 $this->mFileSize = 0;
 185
 186                 $req = MWHttpRequest::factory( $this->mUrl, array(
 187                         'followRedirects' => true
 188                 ) );
 189                 $req->setCallback( array( $this, 'saveTempFileChunk' ) );
 190                 $status = $req->execute();
 191
 192                 if ( $this->mTmpHandle ) {
 193                         // File got written ok...
 194                         fclose( $this->mTmpHandle );
 195                         $this->mTmpHandle = null;
 196                 } else {
 197                         // We encountered a write error during the download...
 198                         return Status::newFatal( 'tmp-write-error' );
 199                 }
 200
 201                 if ( !$status->isOk() ) {
 202                         return $status;
 203                 }
 204
 205                 return $status;
 206         }
 207
 208         /**
 209          * Wrapper around the parent function in order to defer verifying the
 210          * upload until the file really has been fetched.
 211          * @return array|mixed
 212          */
 213         public function verifyUpload() {
 214                 if ( $this->mAsync ) {
 215                         return array( 'status' => UploadBase::OK );
 216                 }
 217                 return parent::verifyUpload();
 218         }
 219
 220         /**
 221          * Wrapper around the parent function in order to defer checking warnings
 222          * until the file really has been fetched.
 223          * @return Array
 224          */
 225         public function checkWarnings() {
 226                 if ( $this->mAsync ) {
 227                         $this->mIgnoreWarnings = false;
 228                         return array();
 229                 }
 230                 return parent::checkWarnings();
 231         }
 232
 233         /**
 234          * Wrapper around the parent function in order to defer checking protection
 235          * until we are sure that the file can actually be uploaded
 236          * @return bool|mixed
 237          */
 238         public function verifyTitlePermissions( $user ) {
 239                 if ( $this->mAsync ) {
 240                         return true;
 241                 }
 242                 return parent::verifyTitlePermissions( $user );
 243         }
 244
 245         /**
 246          * Wrapper around the parent function in order to defer uploading to the
 247          * job queue for asynchronous uploads
 248          * @return Status
 249          */
 250         public function performUpload( $comment, $pageText, $watch, $user ) {
 251                 if ( $this->mAsync ) {
 252                         $sessionKey = $this->insertJob( $comment, $pageText, $watch, $user );
 253
 254                         return Status::newFatal( 'async', $sessionKey );
 255                 }
 256
 257                 return parent::performUpload( $comment, $pageText, $watch, $user );
 258         }
 259
 260         /**
 261          * @param  $comment
 262          * @param  $pageText
 263          * @param  $watch
 264          * @param  $user User
 265          * @return
 266          */
 267         protected function insertJob( $comment, $pageText, $watch, $user ) {
 268                 $sessionKey = $this->stashSession();
 269                 $job = new UploadFromUrlJob( $this->getTitle(), array(
 270                         'url' => $this->mUrl,
 271                         'comment' => $comment,
 272                         'pageText' => $pageText,
 273                         'watch' => $watch,
 274                         'userName' => $user->getName(),
 275                         'leaveMessage' => $this->mAsync == 'async-leavemessage',
 276                         'ignoreWarnings' => $this->mIgnoreWarnings,
 277                         'sessionId' => session_id(),
 278                         'sessionKey' => $sessionKey,
 279                 ) );
 280                 $job->initializeSessionData();
 281                 $job->insert();
 282                 return $sessionKey;
 283         }
 284
 285 }