Clean internal ids in ml(), that it matches with fetch.php

The resize token was broken because fetch.php cleans the id before the token calculation, while ml() uses the raw id

2 files changed, 50 insertions, 9 deletions

diff --git a/_test/tests/inc/common_ml.test.php b/_test/tests/inc/common_ml.test.php
index 0abfde37a..9f3d87598 100644
--- a/_test/tests/inc/common_ml.test.php
+++ b/_test/tests/inc/common_ml.test.php
@@ -20,8 +20,8 @@ class common_ml_test extends DokuWikiTest {
 
         $args = array('a' => 'b', 'c' => 'd', 'q' => '&ä');
 
-        $expect = DOKU_BASE . $this->script . '?a=b&c=d&q=%26%C3%A4&media=some:';
-        $this->assertEquals($expect, ml('some:', $args));
+        $expect = DOKU_BASE . $this->script . '?a=b&c=d&q=%26%C3%A4&media=some:img.jpg';
+        $this->assertEquals($expect, ml('some:img.jpg', $args));
     }
 
     function test_ml_args_string() {
@@ -31,8 +31,8 @@ class common_ml_test extends DokuWikiTest {
 
         $args = 'a=b&c=d';
 
-        $expect = DOKU_BASE . $this->script . '?a=b&c=d&media=some:';
-        $this->assertEquals($expect, ml('some:', $args));
+        $expect = DOKU_BASE . $this->script . '?a=b&c=d&media=some:img.png';
+        $this->assertEquals($expect, ml('some:img.png', $args));
     }
 
     function test_ml_args_comma_string() {
@@ -42,8 +42,8 @@ class common_ml_test extends DokuWikiTest {
 
         $args = 'a=b,c=d';
 
-        $expect = DOKU_BASE . $this->script . '?a=b&c=d&media=some:';
-        $this->assertEquals($expect, ml('some:', $args));
+        $expect = DOKU_BASE . $this->script . '?a=b&c=d&media=some:img.gif';
+        $this->assertEquals($expect, ml('some:img.gif', $args));
     }
 
 
@@ -52,7 +52,7 @@ class common_ml_test extends DokuWikiTest {
         $conf['useslash'] = 0;
         $conf['userewrite'] = 0;
 
-        $id = 'some:';
+        $id = 'some:img.png';
         $w = 80;
         $args = array('w' => $w);
         $tok = media_get_token($id,$w,0);
@@ -66,7 +66,7 @@ class common_ml_test extends DokuWikiTest {
         $conf['useslash'] = 0;
         $conf['userewrite'] = 0;
 
-        $id = 'some:';
+        $id = 'some:img.png';
         $w = 80;
         $args = 'w='.$w;
         $tok = media_get_token($id,$w,0);
@@ -74,4 +74,40 @@ class common_ml_test extends DokuWikiTest {
         $expect = DOKU_BASE . $this->script . '?w='.$w.'&tok='.$tok.'&media='.$id;
         $this->assertEquals($expect, ml($id, $args));
     }
+
+    function test_ml_imgresize_array_rootid() {
+        global $conf;
+        $conf['useslash']   = 0;
+        $conf['userewrite'] = 0;
+
+        $id      = ':wiki:dokuwiki-128.png';
+        $cleanid = 'wiki:dokuwiki-128.png';
+        $w       = 80;
+        $args    = array('w' => $w);
+        $tok     = media_get_token($cleanid, $w, 0);
+
+        $expect = DOKU_BASE.$this->script.'?w='.$w.'&tok='.$tok.'&media='.$cleanid;
+        $this->assertEquals($expect, ml($id, $args));
+    }
+
+    function test_ml_imgresize_array_external() {
+        global $conf;
+        $conf['useslash']   = 0;
+        $conf['userewrite'] = 0;
+
+        $ids  = array(
+            'https://example.com/lib/tpl/dokuwiki/images/logo.png',
+            'http://example.com/lib/tpl/dokuwiki/images/logo.png',
+            'ftp://example.com/lib/tpl/dokuwiki/images/logo.png'
+        );
+        $w    = 80;
+        $args = array('w' => $w);
+
+        foreach($ids as $id) {
+            $tok = media_get_token($id, $w, 0);
+
+            $expect = DOKU_BASE.$this->script.'?hash='.substr(md5(auth_cookiesalt().$id), 0, 6).'&w='.$w.'&tok='.$tok.'&media='.rawurlencode($id);
+            $this->assertEquals($expect, ml($id, $args));
+        }
+    }
 }
diff --git a/inc/common.php b/inc/common.php
index 4d939ac77..03236f7d4 100644
--- a/inc/common.php
+++ b/inc/common.php
@@ -435,6 +435,11 @@ function exportlink($id = '', $format = 'raw', $more = '', $abs = false, $sep =
  */
 function ml($id = '', $more = '', $direct = true, $sep = '&', $abs = false) {
     global $conf;
+    $isexternalimage = preg_match('#^(https?|ftp)://#i', $id);
+    if(!$isexternalimage) {
+        $id = cleanID($id);
+    }
+
     if(is_array($more)) {
         // add token for resized images
         if($more['w'] || $more['h']){
@@ -467,7 +472,7 @@ function ml($id = '', $more = '', $direct = true, $sep = '&', $abs = false)
     }
 
     // external URLs are always direct without rewriting
-    if(preg_match('#^(https?|ftp)://#i', $id)) {
+    if($isexternalimage) {
         $xlink .= 'lib/exe/fetch.php';
         // add hash:
         $xlink .= '?hash='.substr(md5(auth_cookiesalt().$id), 0, 6);