-11

conf/default.conf.php

reviewed

··· 856 856 'image/vnd.microsoft.icon' => true, 857 857 ), 858 858 859 859 - // Phabricator can proxy images from other servers so you can paste the URI 860 860 - // to a funny picture of a cat into the comment box and have it show up as an 861 861 - // image. However, this means the webserver Phabricator is running on will 862 862 - // make HTTP requests to arbitrary URIs. If the server has access to internal 863 863 - // resources, this could be a security risk. You should only enable it if you 864 864 - // are installed entirely a VPN and VPN access is required to access 865 865 - // Phabricator, or if the webserver has no special access to anything. If 866 866 - // unsure, it is safer to leave this disabled. 867 867 - 'files.enable-proxy' => false, 868 868 - 869 869 - 870 859 // -- Storage --------------------------------------------------------------- // 871 860 872 861 // Phabricator allows users to upload files, and can keep them in various

+1

resources/sql/patches/dropfileproxyimage.sql

reviewed

··· 1 1 + DROP TABLE {$NAMESPACE}_file.file_proxyimage;

-6

src/__phutil_library_map__.php

reviewed

··· 744 744 'PhabricatorFileLinkListView' => 'view/layout/PhabricatorFileLinkListView.php', 745 745 'PhabricatorFileLinkView' => 'view/layout/PhabricatorFileLinkView.php', 746 746 'PhabricatorFileListController' => 'applications/files/controller/PhabricatorFileListController.php', 747 747 - 'PhabricatorFileProxyController' => 'applications/files/controller/PhabricatorFileProxyController.php', 748 748 - 'PhabricatorFileProxyImage' => 'applications/files/storage/PhabricatorFileProxyImage.php', 749 747 'PhabricatorFileQuery' => 'applications/files/query/PhabricatorFileQuery.php', 750 748 'PhabricatorFileShortcutController' => 'applications/files/controller/PhabricatorFileShortcutController.php', 751 749 'PhabricatorFileSideNavView' => 'applications/files/view/PhabricatorFileSideNavView.php', ··· 987 985 'PhabricatorRemarkupRuleObjectName' => 'infrastructure/markup/rule/PhabricatorRemarkupRuleObjectName.php', 988 986 'PhabricatorRemarkupRulePaste' => 'infrastructure/markup/rule/PhabricatorRemarkupRulePaste.php', 989 987 'PhabricatorRemarkupRulePhriction' => 'infrastructure/markup/rule/PhabricatorRemarkupRulePhriction.php', 990 990 - 'PhabricatorRemarkupRuleProxyImage' => 'infrastructure/markup/rule/PhabricatorRemarkupRuleProxyImage.php', 991 988 'PhabricatorRemarkupRuleYoutube' => 'infrastructure/markup/rule/PhabricatorRemarkupRuleYoutube.php', 992 989 'PhabricatorRepository' => 'applications/repository/storage/PhabricatorRepository.php', 993 990 'PhabricatorRepositoryArcanistProject' => 'applications/repository/storage/PhabricatorRepositoryArcanistProject.php', ··· 1955 1952 'PhabricatorFileLinkListView' => 'AphrontView', 1956 1953 'PhabricatorFileLinkView' => 'AphrontView', 1957 1954 'PhabricatorFileListController' => 'PhabricatorFileController', 1958 1958 - 'PhabricatorFileProxyController' => 'PhabricatorFileController', 1959 1959 - 'PhabricatorFileProxyImage' => 'PhabricatorFileDAO', 1960 1955 'PhabricatorFileQuery' => 'PhabricatorCursorPagedPolicyAwareQuery', 1961 1956 'PhabricatorFileShortcutController' => 'PhabricatorFileController', 1962 1957 'PhabricatorFileSideNavView' => 'AphrontView', ··· 2172 2167 'PhabricatorRemarkupRuleObjectName' => 'PhutilRemarkupRule', 2173 2168 'PhabricatorRemarkupRulePaste' => 'PhabricatorRemarkupRuleObjectName', 2174 2169 'PhabricatorRemarkupRulePhriction' => 'PhutilRemarkupRule', 2175 2175 - 'PhabricatorRemarkupRuleProxyImage' => 'PhutilRemarkupRule', 2176 2170 'PhabricatorRemarkupRuleYoutube' => 'PhutilRemarkupRule', 2177 2171 'PhabricatorRepository' => 'PhabricatorRepositoryDAO', 2178 2172 'PhabricatorRepositoryArcanistProject' => 'PhabricatorRepositoryDAO',

-54

src/applications/files/controller/PhabricatorFileProxyController.php

reviewed

··· 1 1 - <?php 2 2 - 3 3 - final class PhabricatorFileProxyController extends PhabricatorFileController { 4 4 - 5 5 - private $uri; 6 6 - 7 7 - public function processRequest() { 8 8 - 9 9 - if (!PhabricatorEnv::getEnvConfig('files.enable-proxy')) { 10 10 - return new Aphront400Response(); 11 11 - } 12 12 - 13 13 - $request = $this->getRequest(); 14 14 - $uri = $request->getStr('uri'); 15 15 - 16 16 - $proxy = id(new PhabricatorFileProxyImage())->loadOneWhere( 17 17 - 'uri = %s', 18 18 - $uri); 19 19 - 20 20 - if (!$proxy) { 21 21 - // This write is fine to skip CSRF checks for, we're just building a 22 22 - // cache of some remote image. 23 23 - $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites(); 24 24 - 25 25 - $file = PhabricatorFile::newFromFileDownload( 26 26 - $uri, 27 27 - nonempty(basename($uri), 'proxied-file')); 28 28 - if ($file) { 29 29 - $proxy = new PhabricatorFileProxyImage(); 30 30 - $proxy->setURI($uri); 31 31 - $proxy->setFilePHID($file->getPHID()); 32 32 - $proxy->save(); 33 33 - } 34 34 - 35 35 - unset($unguarded); 36 36 - } 37 37 - 38 38 - if ($proxy) { 39 39 - $file = id(new PhabricatorFile())->loadOneWhere('phid = %s', 40 40 - $proxy->getFilePHID()); 41 41 - if ($file) { 42 42 - $view_uri = $file->getBestURI(); 43 43 - } else { 44 44 - $bad_phid = $proxy->getFilePHID(); 45 45 - throw new Exception( 46 46 - "Unable to load file with phid {$bad_phid}." 47 47 - ); 48 48 - } 49 49 - return id(new AphrontRedirectResponse())->setURI($view_uri); 50 50 - } 51 51 - 52 52 - return new Aphront400Response(); 53 53 - } 54 54 - }

-18

src/applications/files/storage/PhabricatorFileProxyImage.php

reviewed

··· 1 1 - <?php 2 2 - 3 3 - final class PhabricatorFileProxyImage extends PhabricatorFileDAO { 4 4 - 5 5 - protected $uri; 6 6 - protected $filePHID; 7 7 - 8 8 - public function getConfiguration() { 9 9 - return array( 10 10 - self::CONFIG_TIMESTAMPS => false, 11 11 - ) + parent::getConfiguration(); 12 12 - } 13 13 - 14 14 - static public function getProxyImageURI($uri) { 15 15 - return '/file/proxy/?uri='.phutil_escape_uri($uri); 16 16 - } 17 17 - } 18 18 -

+4 -6

src/docs/userguide/remarkup.diviner

reviewed

··· 307 307 308 308 = Embedding Media = 309 309 310 310 - If you set configuration flags, you can embed media directly in text: 310 310 + If you set a configuration flag, you can embed media directly in text: 311 311 312 312 - - **files.enable-proxy**: allows you to paste in image URLs and have them 313 313 - render inline. 314 312 - **remarkup.enable-embedded-youtube**: allows you to paste in YouTube videos 315 313 and have them render inline. 316 314 317 317 - These options are disabled by default because they have security and/or 318 318 - silliness implications, read their descriptions in ##default.conf.php## before 319 319 - enabling them. 315 315 + This option is disabled by default because it has security and/or 316 316 + silliness implications. Read the description in ##default.conf.php## before 317 317 + enabling it. 320 318 321 319 = Image Macros = 322 320

+1 -7

src/infrastructure/markup/PhabricatorMarkupEngine.php

reviewed

··· 41 41 42 42 private $objects = array(); 43 43 private $viewer; 44 44 - private $version = 0; 44 44 + private $version = 1; 45 45 46 46 47 47 /* -( Markup Pipeline )---------------------------------------------------- */ ··· 286 286 return self::newMarkupEngine( 287 287 array( 288 288 'macros' => false, 289 289 - 'fileproxy' => false, 290 289 'youtube' => false, 291 290 292 291 )); ··· 345 344 private static function getMarkupEngineDefaultConfiguration() { 346 345 return array( 347 346 'pygments' => PhabricatorEnv::getEnvConfig('pygments.enabled'), 348 348 - 'fileproxy' => PhabricatorEnv::getEnvConfig('files.enable-proxy'), 349 347 'youtube' => PhabricatorEnv::getEnvConfig( 350 348 'remarkup.enable-embedded-youtube'), 351 349 'custom-inline' => array(), ··· 393 391 } 394 392 395 393 $rules[] = new PhutilRemarkupRuleDocumentLink(); 396 396 - 397 397 - if ($options['fileproxy']) { 398 398 - $rules[] = new PhabricatorRemarkupRuleProxyImage(); 399 399 - } 400 394 401 395 if ($options['youtube']) { 402 396 $rules[] = new PhabricatorRemarkupRuleYoutube();

-45

src/infrastructure/markup/rule/PhabricatorRemarkupRuleProxyImage.php

reviewed

··· 1 1 - <?php 2 2 - 3 3 - /** 4 4 - * @group markup 5 5 - */ 6 6 - final class PhabricatorRemarkupRuleProxyImage 7 7 - extends PhutilRemarkupRule { 8 8 - 9 9 - public function apply($text) { 10 10 - 11 11 - $filetypes = '\.(?:jpe?g|png|gif)'; 12 12 - 13 13 - $text = preg_replace_callback( 14 14 - '@[<](\w{3,}://.+?'.$filetypes.')[>]@', 15 15 - array($this, 'markupProxyImage'), 16 16 - $text); 17 17 - 18 18 - $text = preg_replace_callback( 19 19 - '@(?<=^|\s)(\w{3,}://\S+'.$filetypes.')(?=\s|$)@', 20 20 - array($this, 'markupProxyImage'), 21 21 - $text); 22 22 - 23 23 - return $text; 24 24 - } 25 25 - 26 26 - public function markupProxyImage($matches) { 27 27 - 28 28 - $uri = PhabricatorFileProxyImage::getProxyImageURI($matches[1]); 29 29 - 30 30 - return $this->getEngine()->storeText( 31 31 - phutil_render_tag( 32 32 - 'a', 33 33 - array( 34 34 - 'href' => $uri, 35 35 - 'target' => '_blank', 36 36 - ), 37 37 - phutil_render_tag( 38 38 - 'img', 39 39 - array( 40 40 - 'src' => $uri, 41 41 - 'class' => 'remarkup-proxy-image', 42 42 - )))); 43 43 - } 44 44 - 45 45 - }

+4

src/infrastructure/storage/patch/PhabricatorBuiltinPatchList.php

reviewed

··· 1020 1020 'type' => 'php', 1021 1021 'name' => $this->getPatchPath('liskcounters.php'), 1022 1022 ), 1023 1023 + 'dropfileproxyimage.sql' => array( 1024 1024 + 'type' => 'sql', 1025 1025 + 'name' => $this->getPatchPath('dropfileproxyimage.sql'), 1026 1026 + ), 1023 1027 ); 1024 1028 } 1025 1029