This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * Handler for JPEG images. |
||
4 | * |
||
5 | * This program is free software; you can redistribute it and/or modify |
||
6 | * it under the terms of the GNU General Public License as published by |
||
7 | * the Free Software Foundation; either version 2 of the License, or |
||
8 | * (at your option) any later version. |
||
9 | * |
||
10 | * This program is distributed in the hope that it will be useful, |
||
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
13 | * GNU General Public License for more details. |
||
14 | * |
||
15 | * You should have received a copy of the GNU General Public License along |
||
16 | * with this program; if not, write to the Free Software Foundation, Inc., |
||
17 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||
18 | * http://www.gnu.org/copyleft/gpl.html |
||
19 | * |
||
20 | * @file |
||
21 | * @ingroup Media |
||
22 | */ |
||
23 | |||
24 | /** |
||
25 | * JPEG specific handler. |
||
26 | * Inherits most stuff from BitmapHandler, just here to do the metadata handler differently. |
||
27 | * |
||
28 | * Metadata stuff common to Jpeg and built-in Tiff (not PagedTiffHandler) is |
||
29 | * in ExifBitmapHandler. |
||
30 | * |
||
31 | * @ingroup Media |
||
32 | */ |
||
33 | class JpegHandler extends ExifBitmapHandler { |
||
34 | |||
35 | function normaliseParams( $image, &$params ) { |
||
36 | if ( !parent::normaliseParams( $image, $params ) ) { |
||
37 | return false; |
||
38 | } |
||
39 | if ( isset( $params['quality'] ) && !self::validateQuality( $params['quality'] ) ) { |
||
40 | return false; |
||
41 | } |
||
42 | return true; |
||
43 | } |
||
44 | |||
45 | public function validateParam( $name, $value ) { |
||
46 | if ( $name === 'quality' ) { |
||
47 | return self::validateQuality( $value ); |
||
48 | } else { |
||
49 | return parent::validateParam( $name, $value ); |
||
50 | } |
||
51 | } |
||
52 | |||
53 | /** Validate and normalize quality value to be between 1 and 100 (inclusive). |
||
54 | * @param int $value Quality value, will be converted to integer or 0 if invalid |
||
55 | * @return bool True if the value is valid |
||
56 | */ |
||
57 | private static function validateQuality( $value ) { |
||
58 | return $value === 'low'; |
||
0 ignored issues
–
show
Unused Code
Bug
introduced
by
![]() |
|||
59 | } |
||
60 | |||
61 | View Code Duplication | public function makeParamString( $params ) { |
|
62 | // Prepend quality as "qValue-". This has to match parseParamString() below |
||
63 | $res = parent::makeParamString( $params ); |
||
64 | if ( $res && isset( $params['quality'] ) ) { |
||
65 | $res = "q{$params['quality']}-$res"; |
||
66 | } |
||
67 | return $res; |
||
68 | } |
||
69 | |||
70 | public function parseParamString( $str ) { |
||
71 | // $str contains "qlow-200px" or "200px" strings because thumb.php would strip the filename |
||
72 | // first - check if the string begins with "qlow-", and if so, treat it as quality. |
||
73 | // Pass the first portion, or the whole string if "qlow-" not found, to the parent |
||
74 | // The parsing must match the makeParamString() above |
||
75 | $res = false; |
||
76 | $m = false; |
||
77 | if ( preg_match( '/q([^-]+)-(.*)$/', $str, $m ) ) { |
||
78 | $v = $m[1]; |
||
79 | if ( self::validateQuality( $v ) ) { |
||
80 | $res = parent::parseParamString( $m[2] ); |
||
81 | if ( $res ) { |
||
82 | $res['quality'] = $v; |
||
83 | } |
||
84 | } |
||
85 | } else { |
||
86 | $res = parent::parseParamString( $str ); |
||
87 | } |
||
88 | return $res; |
||
89 | } |
||
90 | |||
91 | View Code Duplication | function getScriptParams( $params ) { |
|
92 | $res = parent::getScriptParams( $params ); |
||
93 | if ( isset( $params['quality'] ) ) { |
||
94 | $res['quality'] = $params['quality']; |
||
95 | } |
||
96 | return $res; |
||
97 | } |
||
98 | |||
99 | View Code Duplication | function getMetadata( $image, $filename ) { |
|
100 | try { |
||
101 | $meta = BitmapMetadataHandler::Jpeg( $filename ); |
||
102 | if ( !is_array( $meta ) ) { |
||
103 | // This should never happen, but doesn't hurt to be paranoid. |
||
104 | throw new MWException( 'Metadata array is not an array' ); |
||
105 | } |
||
106 | $meta['MEDIAWIKI_EXIF_VERSION'] = Exif::version(); |
||
107 | |||
108 | return serialize( $meta ); |
||
109 | } catch ( Exception $e ) { |
||
110 | // BitmapMetadataHandler throws an exception in certain exceptional |
||
111 | // cases like if file does not exist. |
||
112 | wfDebug( __METHOD__ . ': ' . $e->getMessage() . "\n" ); |
||
113 | |||
114 | /* This used to use 0 (ExifBitmapHandler::OLD_BROKEN_FILE) for the cases |
||
115 | * * No metadata in the file |
||
116 | * * Something is broken in the file. |
||
117 | * However, if the metadata support gets expanded then you can't tell if the 0 is from |
||
118 | * a broken file, or just no props found. A broken file is likely to stay broken, but |
||
119 | * a file which had no props could have props once the metadata support is improved. |
||
120 | * Thus switch to using -1 to denote only a broken file, and use an array with only |
||
121 | * MEDIAWIKI_EXIF_VERSION to denote no props. |
||
122 | */ |
||
123 | |||
124 | return ExifBitmapHandler::BROKEN_FILE; |
||
125 | } |
||
126 | } |
||
127 | |||
128 | /** |
||
129 | * @param File $file |
||
130 | * @param array $params Rotate parameters. |
||
131 | * 'rotation' clockwise rotation in degrees, allowed are multiples of 90 |
||
132 | * @since 1.21 |
||
133 | * @return bool |
||
134 | */ |
||
135 | public function rotate( $file, $params ) { |
||
136 | global $wgJpegTran; |
||
137 | |||
138 | $rotation = ( $params['rotation'] + $this->getRotation( $file ) ) % 360; |
||
139 | |||
140 | if ( $wgJpegTran && is_executable( $wgJpegTran ) ) { |
||
141 | $cmd = wfEscapeShellArg( $wgJpegTran ) . |
||
142 | " -rotate " . wfEscapeShellArg( $rotation ) . |
||
143 | " -outfile " . wfEscapeShellArg( $params['dstPath'] ) . |
||
144 | " " . wfEscapeShellArg( $params['srcPath'] ); |
||
145 | wfDebug( __METHOD__ . ": running jpgtran: $cmd\n" ); |
||
146 | $retval = 0; |
||
147 | $err = wfShellExecWithStderr( $cmd, $retval ); |
||
148 | View Code Duplication | if ( $retval !== 0 ) { |
|
149 | $this->logErrorForExternalProcess( $retval, $err, $cmd ); |
||
150 | |||
151 | return new MediaTransformError( 'thumbnail_error', 0, 0, $err ); |
||
152 | } |
||
153 | |||
154 | return false; |
||
155 | } else { |
||
156 | return parent::rotate( $file, $params ); |
||
157 | } |
||
158 | } |
||
159 | |||
160 | public function supportsBucketing() { |
||
161 | return true; |
||
162 | } |
||
163 | |||
164 | View Code Duplication | public function sanitizeParamsForBucketing( $params ) { |
|
165 | $params = parent::sanitizeParamsForBucketing( $params ); |
||
166 | |||
167 | // Quality needs to be cleared for bucketing. Buckets need to be default quality |
||
168 | if ( isset( $params['quality'] ) ) { |
||
169 | unset( $params['quality'] ); |
||
170 | } |
||
171 | |||
172 | return $params; |
||
173 | } |
||
174 | } |
||
175 |