summaryrefslogtreecommitdiff
path: root/img_auth.php
diff options
context:
space:
mode:
Diffstat (limited to 'img_auth.php')
-rw-r--r--img_auth.php19
1 files changed, 6 insertions, 13 deletions
diff --git a/img_auth.php b/img_auth.php
index fb58ba28..cfe005e9 100644
--- a/img_auth.php
+++ b/img_auth.php
@@ -7,18 +7,9 @@
* to an array of pages you want everyone to be able to access. Your server must
* support PATH_INFO, CGI-based configurations generally don't.
*/
-# Valid web server entry point, enable includes
-define( 'MEDIAWIKI', true );
-
-if ( isset( $_REQUEST['GLOBALS'] ) ) {
- echo '<a href="http://www.hardened-php.net/index.76.html">$GLOBALS overwrite vulnerability</a>';
- die( -1 );
-}
-
-require_once( 'includes/Defines.php' );
-require_once( './LocalSettings.php' );
-require_once( 'includes/Setup.php' );
-require_once( 'includes/StreamFile.php' );
+require_once( './includes/WebStart.php' );
+wfProfileIn( 'img_auth.php' );
+require_once( './includes/StreamFile.php' );
if( !isset( $_SERVER['PATH_INFO'] ) ) {
wfForbidden();
@@ -27,7 +18,7 @@ if( !isset( $_SERVER['PATH_INFO'] ) ) {
# Get filenames/directories
$filename = realpath( $wgUploadDirectory . $_SERVER['PATH_INFO'] );
$realUploadDirectory = realpath( $wgUploadDirectory );
-$imageName = $wgLang->getNsText( NS_IMAGE ) . ":" . basename( $_SERVER['PATH_INFO'] );
+$imageName = $wgContLang->getNsText( NS_IMAGE ) . ":" . wfBaseName( $_SERVER['PATH_INFO'] );
# Check if the filename is in the correct directory
if ( substr( $filename, 0, strlen( $realUploadDirectory ) ) != $realUploadDirectory ) {
@@ -47,6 +38,7 @@ if( is_dir( $filename ) ) {
# Write file
wfStreamFile( $filename );
+wfLogProfilingData();
function wfForbidden() {
header( 'HTTP/1.0 403 Forbidden' );
@@ -55,6 +47,7 @@ function wfForbidden() {
<h1>Access denied</h1>
<p>You need to log in to access files on this server</p>
</body></html>";
+ wfLogProfilingData();
exit;
}