diff options
| author | Christopher Smith <chris@jalakai.co.uk> | 2013-03-20 00:06:07 +0000 |
|---|---|---|
| committer | Christopher Smith <chris@jalakai.co.uk> | 2013-03-22 00:36:52 +0000 |
| commit | 0f4e009215bfa3136d334fa557335266637a7585 (patch) | |
| tree | 6a713cf999d4797534e5954c31e8b46654cc2db5 /lib/exe/fetch.php | |
| parent | 2ab296805f9b647d3fe46cad4a7f275c45f171a8 (diff) | |
| download | rpg-0f4e009215bfa3136d334fa557335266637a7585.tar.gz rpg-0f4e009215bfa3136d334fa557335266637a7585.tar.bz2 | |
add a token to fetch urls requiring image resize/crop to prevent external DDOS via fetch
Diffstat (limited to 'lib/exe/fetch.php')
| -rw-r--r-- | lib/exe/fetch.php | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/lib/exe/fetch.php b/lib/exe/fetch.php index a558a3db8..48aa22fe2 100644 --- a/lib/exe/fetch.php +++ b/lib/exe/fetch.php @@ -32,7 +32,7 @@ if(!defined('SIMPLE_TEST')) { } // check for permissions, preconditions and cache external files - list($STATUS, $STATUSMESSAGE) = checkFileStatus($MEDIA, $FILE, $REV); + list($STATUS, $STATUSMESSAGE) = checkFileStatus($MEDIA, $FILE, $REV, $WIDTH, $HEIGHT); // prepare data for plugin events $data = array( @@ -180,7 +180,7 @@ function sendFile($file, $mime, $dl, $cache, $public = false) { * @param $file reference to the file variable * @returns array(STATUS, STATUSMESSAGE) */ -function checkFileStatus(&$media, &$file, $rev = '') { +function checkFileStatus(&$media, &$file, $rev = '', $width=0, $height=0) { global $MIME, $EXT, $CACHE, $INPUT; //media to local file @@ -200,6 +200,10 @@ function checkFileStatus(&$media, &$file, $rev = '') { if(empty($media)) { return array(400, 'Bad request'); } + // check token for resized images + if (($width || $height) && media_get_token($media, $width, $height) !== $INPUT->str('tok')) { + return array(412, 'Precondition Failed'); + } //check permissions (namespace only) if(auth_quickaclcheck(getNS($media).':X') < AUTH_READ) { |