| Index: trunk/phase3/languages/messages/MessagesEn.php |
| — | — | @@ -2236,6 +2236,7 @@ |
| 2237 | 2237 | 'upload-too-many-redirects' => 'The URL contained too many redirects', |
| 2238 | 2238 | 'upload-unknown-size' => 'Unknown size', |
| 2239 | 2239 | 'upload-http-error' => 'An HTTP error occured: $1', |
| | 2240 | +'upload-copy-upload-invalid-domain' => 'Copy uploads are not available from this domain.', |
| 2240 | 2241 | |
| 2241 | 2242 | # File backend |
| 2242 | 2243 | 'backend-fail-stream' => 'Could not stream file $1.', |
| Index: trunk/phase3/includes/DefaultSettings.php |
| — | — | @@ -453,6 +453,10 @@ |
| 454 | 454 | * This feature is experimental and broken as of r81612. |
| 455 | 455 | */ |
| 456 | 456 | $wgAllowAsyncCopyUploads = false; |
| | 457 | +/** |
| | 458 | + * A list of domains copy uploads can come from |
| | 459 | + */ |
| | 460 | +$wgCopyUploadsDomains = array(); |
| 457 | 461 | |
| 458 | 462 | /** |
| 459 | 463 | * Max size for uploads, in bytes. If not set to an array, applies to all |
| Index: trunk/phase3/includes/upload/UploadFromUrl.php |
| — | — | @@ -37,6 +37,28 @@ |
| 38 | 38 | } |
| 39 | 39 | |
| 40 | 40 | /** |
| | 41 | + * Checks whether the URL is for an allowed host |
| | 42 | + * |
| | 43 | + * @param $url string |
| | 44 | + * @return bool |
| | 45 | + */ |
| | 46 | + public static function isAllowedHost( $url ) { |
| | 47 | + global $wgCopyUploadsDomains; |
| | 48 | + if ( !count( $wgCopyUploadsDomains ) ) { |
| | 49 | + return true; |
| | 50 | + } |
| | 51 | + $valid = false; |
| | 52 | + $parsedUrl = wfParseUrl( $url ); |
| | 53 | + foreach( $wgCopyUploadsDomains as $domain ) { |
| | 54 | + if ( $parsedUrl['host'] === $domain ) { |
| | 55 | + $valid = true; |
| | 56 | + break; |
| | 57 | + } |
| | 58 | + } |
| | 59 | + return $valid; |
| | 60 | + } |
| | 61 | + |
| | 62 | + /** |
| 41 | 63 | * Entry point for API upload |
| 42 | 64 | * |
| 43 | 65 | * @param $name string |
| — | — | @@ -101,6 +123,9 @@ |
| 102 | 124 | return Status::newFatal( 'http-invalid-url' ); |
| 103 | 125 | } |
| 104 | 126 | |
| | 127 | + if( !self::isAllowedHost( $this->mUrl ) ) { |
| | 128 | + return Status::newFatal( 'upload-copy-upload-invalid-domain' ); |
| | 129 | + } |
| 105 | 130 | if ( !$this->mAsync ) { |
| 106 | 131 | return $this->reallyFetchFile(); |
| 107 | 132 | } |
| Index: trunk/phase3/includes/api/ApiUpload.php |
| — | — | @@ -322,6 +322,10 @@ |
| 323 | 323 | $this->dieUsageMsg( 'copyuploaddisabled' ); |
| 324 | 324 | } |
| 325 | 325 | |
| | 326 | + if ( !UploadFromUrl::isAllowedHost( $this->mParams['url'] ) ) { |
| | 327 | + $this->dieUsageMsg( 'copyuploadbaddomain' ); |
| | 328 | + } |
| | 329 | + |
| 326 | 330 | $async = false; |
| 327 | 331 | if ( $this->mParams['asyncdownload'] ) { |
| 328 | 332 | $this->checkAsyncDownloadEnabled(); |
| Index: trunk/phase3/includes/api/ApiBase.php |
| — | — | @@ -1231,6 +1231,7 @@ |
| 1232 | 1232 | 'nouploadmodule' => array( 'code' => 'nouploadmodule', 'info' => 'No upload module set' ), |
| 1233 | 1233 | 'uploaddisabled' => array( 'code' => 'uploaddisabled', 'info' => 'Uploads are not enabled. Make sure $wgEnableUploads is set to true in LocalSettings.php and the PHP ini setting file_uploads is true' ), |
| 1234 | 1234 | 'copyuploaddisabled' => array( 'code' => 'copyuploaddisabled', 'info' => 'Uploads by URL is not enabled. Make sure $wgAllowCopyUploads is set to true in LocalSettings.php.' ), |
| | 1235 | + 'copyuploadbaddomain' => array( 'code' => 'copyuploadbaddomain', 'info' => 'Uploads by URL are not allowed from this domain.' ), |
| 1235 | 1236 | |
| 1236 | 1237 | 'filename-tooshort' => array( 'code' => 'filename-tooshort', 'info' => 'The filename is too short' ), |
| 1237 | 1238 | 'filename-toolong' => array( 'code' => 'filename-toolong', 'info' => 'The filename is too long' ), |
| Index: trunk/phase3/maintenance/language/messages.inc |
| — | — | @@ -1345,6 +1345,7 @@ |
| 1346 | 1346 | 'upload-too-many-redirects', |
| 1347 | 1347 | 'upload-unknown-size', |
| 1348 | 1348 | 'upload-http-error', |
| | 1349 | + 'upload-copy-upload-invalid-domain', |
| 1349 | 1350 | ), |
| 1350 | 1351 | |
| 1351 | 1352 | 'filebackend-errors' => array( |
| Index: trunk/phase3/RELEASE-NOTES-1.20 |
| — | — | @@ -14,6 +14,7 @@ |
| 15 | 15 | |
| 16 | 16 | === New features in 1.20 === |
| 17 | 17 | * Added TitleIsKnown hook which gets called when determining if a page exists. |
| | 18 | +* (bug 32341) Add upload by URL domain limitation. |
| 18 | 19 | |
| 19 | 20 | === Bug fixes in 1.20 === |
| 20 | 21 | * (bug 30245) Use the correct way to construct a log page title. |