HttpFunctions.php

Go to the documentation of this file.

<?php
class Http {
    static $httpEngine = false;

    public static function request( $method, $url, $options = array() ) {
        wfDebug( "HTTP: $method: $url\n" );
        wfProfileIn( __METHOD__ . "-$method" );

        $options['method'] = strtoupper( $method );

        if ( !isset( $options['timeout'] ) ) {
            $options['timeout'] = 'default';
        }
        if ( !isset( $options['connectTimeout'] ) ) {
            $options['connectTimeout'] = 'default';
        }

        $req = MWHttpRequest::factory( $url, $options );
        $status = $req->execute();

        $content = false;
        if ( $status->isOK() ) {
            $content = $req->getContent();
        }
        wfProfileOut( __METHOD__ . "-$method" );
        return $content;
    }

    public static function get( $url, $timeout = 'default', $options = array() ) {
        $options['timeout'] = $timeout;
        return Http::request( 'GET', $url, $options );
    }

    public static function post( $url, $options = array() ) {
        return Http::request( 'POST', $url, $options );
    }

    public static function isLocalURL( $url ) {
        global $wgCommandLineMode, $wgConf;

        if ( $wgCommandLineMode ) {
            return false;
        }

        // Extract host part
        $matches = array();
        if ( preg_match( '!^http://([\w.-]+)[/:].*$!', $url, $matches ) ) {
            $host = $matches[1];
            // Split up dotwise
            $domainParts = explode( '.', $host );
            // Check if this domain or any superdomain is listed in $wgConf as a local virtual host
            $domainParts = array_reverse( $domainParts );

            $domain = '';
            for ( $i = 0; $i < count( $domainParts ); $i++ ) {
                $domainPart = $domainParts[$i];
                if ( $i == 0 ) {
                    $domain = $domainPart;
                } else {
                    $domain = $domainPart . '.' . $domain;
                }

                if ( $wgConf->isLocalVHost( $domain ) ) {
                    return true;
                }
            }
        }

        return false;
    }

    public static function userAgent() {
        global $wgVersion;
        return "MediaWiki/$wgVersion";
    }

    public static function isValidURI( $uri ) {
        return preg_match(
            '/^https?:\/\/[^\/\s]\S*$/D',
            $uri
        );
    }
}

class MWHttpRequest {
    const SUPPORTS_FILE_POSTS = false;

    protected $content;
    protected $timeout = 'default';
    protected $headersOnly = null;
    protected $postData = null;
    protected $proxy = null;
    protected $noProxy = false;
    protected $sslVerifyHost = true;
    protected $sslVerifyCert = true;
    protected $caInfo = null;
    protected $method = "GET";
    protected $reqHeaders = array();
    protected $url;
    protected $parsedUrl;
    protected $callback;
    protected $maxRedirects = 5;
    protected $followRedirects = false;

    protected $cookieJar;

    protected $headerList = array();
    protected $respVersion = "0.9";
    protected $respStatus = "200 Ok";
    protected $respHeaders = array();

    public $status;

    protected function __construct( $url, $options = array() ) {
        global $wgHTTPTimeout, $wgHTTPConnectTimeout;

        $this->url = wfExpandUrl( $url, PROTO_HTTP );
        $this->parsedUrl = wfParseUrl( $this->url );

        if ( !$this->parsedUrl || !Http::isValidURI( $this->url ) ) {
            $this->status = Status::newFatal( 'http-invalid-url' );
        } else {
            $this->status = Status::newGood( 100 ); // continue
        }

        if ( isset( $options['timeout'] ) && $options['timeout'] != 'default' ) {
            $this->timeout = $options['timeout'];
        } else {
            $this->timeout = $wgHTTPTimeout;
        }
        if ( isset( $options['connectTimeout'] ) && $options['connectTimeout'] != 'default' ) {
            $this->connectTimeout = $options['connectTimeout'];
        } else {
            $this->connectTimeout = $wgHTTPConnectTimeout;
        }
        if ( isset( $options['userAgent'] ) ) {
            $this->setUserAgent( $options['userAgent'] );
        }

        $members = array( "postData", "proxy", "noProxy", "sslVerifyHost", "caInfo",
                "method", "followRedirects", "maxRedirects", "sslVerifyCert", "callback" );

        foreach ( $members as $o ) {
            if ( isset( $options[$o] ) ) {
                // ensure that MWHttpRequest::method is always
                // uppercased. Bug 36137
                if ( $o == 'method' ) {
                    $options[$o] = strtoupper( $options[$o] );
                }
                $this->$o = $options[$o];
            }
        }

        if ( $this->noProxy ) {
            $this->proxy = ''; // noProxy takes precedence
        }
    }

    public static function canMakeRequests() {
        return function_exists( 'curl_init' ) || wfIniGetBool( 'allow_url_fopen' );
    }

    public static function factory( $url, $options = null ) {
        if ( !Http::$httpEngine ) {
            Http::$httpEngine = function_exists( 'curl_init' ) ? 'curl' : 'php';
        } elseif ( Http::$httpEngine == 'curl' && !function_exists( 'curl_init' ) ) {
            throw new MWException( __METHOD__ . ': curl (http://php.net/curl) is not installed, but' .
                ' Http::$httpEngine is set to "curl"' );
        }

        switch ( Http::$httpEngine ) {
            case 'curl':
                return new CurlHttpRequest( $url, $options );
            case 'php':
                if ( !wfIniGetBool( 'allow_url_fopen' ) ) {
                    throw new MWException( __METHOD__ . ': allow_url_fopen needs to be enabled for pure PHP' .
                        ' http requests to work. If possible, curl should be used instead. See http://php.net/curl.' );
                }
                return new PhpHttpRequest( $url, $options );
            default:
                throw new MWException( __METHOD__ . ': The setting of Http::$httpEngine is not valid.' );
        }
    }

    public function getContent() {
        return $this->content;
    }

    public function setData( $args ) {
        $this->postData = $args;
    }

    public function proxySetup() {
        global $wgHTTPProxy;

        // If there is an explicit proxy set and proxies are not disabled, then use it
        if ( $this->proxy && !$this->noProxy ) {
            return;
        }

        // Otherwise, fallback to $wgHTTPProxy/http_proxy (when set) if this is not a machine
        // local URL and proxies are not disabled
        if ( Http::isLocalURL( $this->url ) || $this->noProxy ) {
            $this->proxy = '';
        } elseif ( $wgHTTPProxy ) {
            $this->proxy = $wgHTTPProxy;
        } elseif ( getenv( "http_proxy" ) ) {
            $this->proxy = getenv( "http_proxy" );
        }
    }

    public function setReferer( $url ) {
        $this->setHeader( 'Referer', $url );
    }

    public function setUserAgent( $UA ) {
        $this->setHeader( 'User-Agent', $UA );
    }

    public function setHeader( $name, $value ) {
        // I feel like I should normalize the case here...
        $this->reqHeaders[$name] = $value;
    }

    public function getHeaderList() {
        $list = array();

        if ( $this->cookieJar ) {
            $this->reqHeaders['Cookie'] =
                $this->cookieJar->serializeToHttpRequest(
                    $this->parsedUrl['path'],
                    $this->parsedUrl['host']
                );
        }

        foreach ( $this->reqHeaders as $name => $value ) {
            $list[] = "$name: $value";
        }

        return $list;
    }

    public function setCallback( $callback ) {
        if ( !is_callable( $callback ) ) {
            throw new MWException( 'Invalid MwHttpRequest callback' );
        }
        $this->callback = $callback;
    }

    public function read( $fh, $content ) {
        $this->content .= $content;
        return strlen( $content );
    }

    public function execute() {
        global $wgTitle;

        wfProfileIn( __METHOD__ );

        $this->content = "";

        if ( strtoupper( $this->method ) == "HEAD" ) {
            $this->headersOnly = true;
        }

        if ( is_object( $wgTitle ) && !isset( $this->reqHeaders['Referer'] ) ) {
            $this->setReferer( wfExpandUrl( $wgTitle->getFullURL(), PROTO_CURRENT ) );
        }

        $this->proxySetup(); // set up any proxy as needed

        if ( !$this->callback ) {
            $this->setCallback( array( $this, 'read' ) );
        }

        if ( !isset( $this->reqHeaders['User-Agent'] ) ) {
            $this->setUserAgent( Http::userAgent() );
        }

        wfProfileOut( __METHOD__ );
    }

    protected function parseHeader() {
        wfProfileIn( __METHOD__ );

        $lastname = "";

        foreach ( $this->headerList as $header ) {
            if ( preg_match( "#^HTTP/([0-9.]+) (.*)#", $header, $match ) ) {
                $this->respVersion = $match[1];
                $this->respStatus = $match[2];
            } elseif ( preg_match( "#^[ \t]#", $header ) ) {
                $last = count( $this->respHeaders[$lastname] ) - 1;
                $this->respHeaders[$lastname][$last] .= "\r\n$header";
            } elseif ( preg_match( "#^([^:]*):[\t ]*(.*)#", $header, $match ) ) {
                $this->respHeaders[strtolower( $match[1] )][] = $match[2];
                $lastname = strtolower( $match[1] );
            }
        }

        $this->parseCookies();

        wfProfileOut( __METHOD__ );
    }

    protected function setStatus() {
        if ( !$this->respHeaders ) {
            $this->parseHeader();
        }

        if ( (int)$this->respStatus > 399 ) {
            list( $code, $message ) = explode( " ", $this->respStatus, 2 );
            $this->status->fatal( "http-bad-status", $code, $message );
        }
    }

    public function getStatus() {
        if ( !$this->respHeaders ) {
            $this->parseHeader();
        }

        return (int)$this->respStatus;
    }

    public function isRedirect() {
        if ( !$this->respHeaders ) {
            $this->parseHeader();
        }

        $status = (int)$this->respStatus;

        if ( $status >= 300 && $status <= 303 ) {
            return true;
        }

        return false;
    }

    public function getResponseHeaders() {
        if ( !$this->respHeaders ) {
            $this->parseHeader();
        }

        return $this->respHeaders;
    }

    public function getResponseHeader( $header ) {
        if ( !$this->respHeaders ) {
            $this->parseHeader();
        }

        if ( isset( $this->respHeaders[strtolower( $header )] ) ) {
            $v = $this->respHeaders[strtolower( $header )];
            return $v[count( $v ) - 1];
        }

        return null;
    }

    public function setCookieJar( $jar ) {
        $this->cookieJar = $jar;
    }

    public function getCookieJar() {
        if ( !$this->respHeaders ) {
            $this->parseHeader();
        }

        return $this->cookieJar;
    }

    public function setCookie( $name, $value = null, $attr = null ) {
        if ( !$this->cookieJar ) {
            $this->cookieJar = new CookieJar;
        }

        $this->cookieJar->setCookie( $name, $value, $attr );
    }

    protected function parseCookies() {
        wfProfileIn( __METHOD__ );

        if ( !$this->cookieJar ) {
            $this->cookieJar = new CookieJar;
        }

        if ( isset( $this->respHeaders['set-cookie'] ) ) {
            $url = parse_url( $this->getFinalUrl() );
            foreach ( $this->respHeaders['set-cookie'] as $cookie ) {
                $this->cookieJar->parseCookieResponseHeader( $cookie, $url['host'] );
            }
        }

        wfProfileOut( __METHOD__ );
    }

    public function getFinalUrl() {
        $headers = $this->getResponseHeaders();

        //return full url (fix for incorrect but handled relative location)
        if ( isset( $headers['location'] ) ) {
            $locations = $headers['location'];
            $domain = '';
            $foundRelativeURI = false;
            $countLocations = count( $locations );

            for ( $i = $countLocations - 1; $i >= 0; $i-- ) {
                $url = parse_url( $locations[$i] );

                if ( isset( $url['host'] ) ) {
                    $domain = $url['scheme'] . '://' . $url['host'];
                    break; //found correct URI (with host)
                } else {
                    $foundRelativeURI = true;
                }
            }

            if ( $foundRelativeURI ) {
                if ( $domain ) {
                    return $domain . $locations[$countLocations - 1];
                } else {
                    $url = parse_url( $this->url );
                    if ( isset( $url['host'] ) ) {
                        return $url['scheme'] . '://' . $url['host'] . $locations[$countLocations - 1];
                    }
                }
            } else {
                return $locations[$countLocations - 1];
            }
        }

        return $this->url;
    }

    public function canFollowRedirects() {
        return true;
    }
}

class CurlHttpRequest extends MWHttpRequest {
    const SUPPORTS_FILE_POSTS = true;

    protected $curlOptions = array();
    protected $headerText = "";

    protected function readHeader( $fh, $content ) {
        $this->headerText .= $content;
        return strlen( $content );
    }

    public function execute() {
        wfProfileIn( __METHOD__ );

        parent::execute();

        if ( !$this->status->isOK() ) {
            wfProfileOut( __METHOD__ );
            return $this->status;
        }

        $this->curlOptions[CURLOPT_PROXY] = $this->proxy;
        $this->curlOptions[CURLOPT_TIMEOUT] = $this->timeout;

        // Only supported in curl >= 7.16.2
        if ( defined( 'CURLOPT_CONNECTTIMEOUT_MS' ) ) {
            $this->curlOptions[CURLOPT_CONNECTTIMEOUT_MS] = $this->connectTimeout * 1000;
        }

        $this->curlOptions[CURLOPT_HTTP_VERSION] = CURL_HTTP_VERSION_1_0;
        $this->curlOptions[CURLOPT_WRITEFUNCTION] = $this->callback;
        $this->curlOptions[CURLOPT_HEADERFUNCTION] = array( $this, "readHeader" );
        $this->curlOptions[CURLOPT_MAXREDIRS] = $this->maxRedirects;
        $this->curlOptions[CURLOPT_ENCODING] = ""; # Enable compression

        /* not sure these two are actually necessary */
        if ( isset( $this->reqHeaders['Referer'] ) ) {
            $this->curlOptions[CURLOPT_REFERER] = $this->reqHeaders['Referer'];
        }
        $this->curlOptions[CURLOPT_USERAGENT] = $this->reqHeaders['User-Agent'];

        $this->curlOptions[CURLOPT_SSL_VERIFYHOST] = $this->sslVerifyHost ? 2 : 0;
        $this->curlOptions[CURLOPT_SSL_VERIFYPEER] = $this->sslVerifyCert;

        if ( $this->caInfo ) {
            $this->curlOptions[CURLOPT_CAINFO] = $this->caInfo;
        }

        if ( $this->headersOnly ) {
            $this->curlOptions[CURLOPT_NOBODY] = true;
            $this->curlOptions[CURLOPT_HEADER] = true;
        } elseif ( $this->method == 'POST' ) {
            $this->curlOptions[CURLOPT_POST] = true;
            $this->curlOptions[CURLOPT_POSTFIELDS] = $this->postData;
            // Suppress 'Expect: 100-continue' header, as some servers
            // will reject it with a 417 and Curl won't auto retry
            // with HTTP 1.0 fallback
            $this->reqHeaders['Expect'] = '';
        } else {
            $this->curlOptions[CURLOPT_CUSTOMREQUEST] = $this->method;
        }

        $this->curlOptions[CURLOPT_HTTPHEADER] = $this->getHeaderList();

        $curlHandle = curl_init( $this->url );

        if ( !curl_setopt_array( $curlHandle, $this->curlOptions ) ) {
            wfProfileOut( __METHOD__ );
            throw new MWException( "Error setting curl options." );
        }

        if ( $this->followRedirects && $this->canFollowRedirects() ) {
            wfSuppressWarnings();
            if ( ! curl_setopt( $curlHandle, CURLOPT_FOLLOWLOCATION, true ) ) {
                wfDebug( __METHOD__ . ": Couldn't set CURLOPT_FOLLOWLOCATION. " .
                    "Probably safe_mode or open_basedir is set.\n" );
                // Continue the processing. If it were in curl_setopt_array,
                // processing would have halted on its entry
            }
            wfRestoreWarnings();
        }

        $curlRes = curl_exec( $curlHandle );
        if ( curl_errno( $curlHandle ) == CURLE_OPERATION_TIMEOUTED ) {
            $this->status->fatal( 'http-timed-out', $this->url );
        } elseif ( $curlRes === false ) {
            $this->status->fatal( 'http-curl-error', curl_error( $curlHandle ) );
        } else {
            $this->headerList = explode( "\r\n", $this->headerText );
        }

        curl_close( $curlHandle );

        $this->parseHeader();
        $this->setStatus();

        wfProfileOut( __METHOD__ );

        return $this->status;
    }

    public function canFollowRedirects() {
        if ( strval( ini_get( 'open_basedir' ) ) !== '' || wfIniGetBool( 'safe_mode' ) ) {
            wfDebug( "Cannot follow redirects in safe mode\n" );
            return false;
        }

        if ( !defined( 'CURLOPT_REDIR_PROTOCOLS' ) ) {
            wfDebug( "Cannot follow redirects with libcurl < 7.19.4 due to CVE-2009-0037\n" );
            return false;
        }

        return true;
    }
}

class PhpHttpRequest extends MWHttpRequest {

    protected function urlToTcp( $url ) {
        $parsedUrl = parse_url( $url );

        return 'tcp://' . $parsedUrl['host'] . ':' . $parsedUrl['port'];
    }

    public function execute() {
        wfProfileIn( __METHOD__ );

        parent::execute();

        if ( is_array( $this->postData ) ) {
            $this->postData = wfArrayToCgi( $this->postData );
        }

        if ( $this->parsedUrl['scheme'] != 'http' &&
             $this->parsedUrl['scheme'] != 'https' ) {
            $this->status->fatal( 'http-invalid-scheme', $this->parsedUrl['scheme'] );
        }

        $this->reqHeaders['Accept'] = "*/*";
        $this->reqHeaders['Connection'] = 'Close';
        if ( $this->method == 'POST' ) {
            // Required for HTTP 1.0 POSTs
            $this->reqHeaders['Content-Length'] = strlen( $this->postData );
            if ( !isset( $this->reqHeaders['Content-Type'] ) ) {
                $this->reqHeaders['Content-Type'] = "application/x-www-form-urlencoded";
            }
        }

        // Set up PHP stream context
        $options = array(
            'http' => array(
                'method' => $this->method,
                'header' => implode( "\r\n", $this->getHeaderList() ),
                'protocol_version' => '1.1',
                'max_redirects' => $this->followRedirects ? $this->maxRedirects : 0,
                'ignore_errors' => true,
                'timeout' => $this->timeout,
                // Curl options in case curlwrappers are installed
                'curl_verify_ssl_host' => $this->sslVerifyHost ? 2 : 0,
                'curl_verify_ssl_peer' => $this->sslVerifyCert,
            ),
            'ssl' => array(
                'verify_peer' => $this->sslVerifyCert,
                'SNI_enabled' => true,
            ),
        );

        if ( $this->proxy ) {
            $options['http']['proxy'] = $this->urlToTCP( $this->proxy );
            $options['http']['request_fulluri'] = true;
        }

        if ( $this->postData ) {
            $options['http']['content'] = $this->postData;
        }

        if ( $this->sslVerifyHost ) {
            $options['ssl']['CN_match'] = $this->parsedUrl['host'];
        }

        if ( is_dir( $this->caInfo ) ) {
            $options['ssl']['capath'] = $this->caInfo;
        } elseif ( is_file( $this->caInfo ) ) {
            $options['ssl']['cafile'] = $this->caInfo;
        } elseif ( $this->caInfo ) {
            throw new MWException( "Invalid CA info passed: {$this->caInfo}" );
        }

        $context = stream_context_create( $options );

        $this->headerList = array();
        $reqCount = 0;
        $url = $this->url;

        $result = array();

        do {
            $reqCount++;
            wfSuppressWarnings();
            $fh = fopen( $url, "r", false, $context );
            wfRestoreWarnings();

            if ( !$fh ) {
                break;
            }

            $result = stream_get_meta_data( $fh );
            $this->headerList = $result['wrapper_data'];
            $this->parseHeader();

            if ( !$this->followRedirects ) {
                break;
            }

            # Handle manual redirection
            if ( !$this->isRedirect() || $reqCount > $this->maxRedirects ) {
                break;
            }
            # Check security of URL
            $url = $this->getResponseHeader( "Location" );

            if ( !Http::isValidURI( $url ) ) {
                wfDebug( __METHOD__ . ": insecure redirection\n" );
                break;
            }
        } while ( true );

        $this->setStatus();

        if ( $fh === false ) {
            $this->status->fatal( 'http-request-error' );
            wfProfileOut( __METHOD__ );
            return $this->status;
        }

        if ( $result['timed_out'] ) {
            $this->status->fatal( 'http-timed-out', $this->url );
            wfProfileOut( __METHOD__ );
            return $this->status;
        }

        // If everything went OK, or we received some error code
        // get the response body content.
        if ( $this->status->isOK() || (int)$this->respStatus >= 300 ) {
            while ( !feof( $fh ) ) {
                $buf = fread( $fh, 8192 );

                if ( $buf === false ) {
                    $this->status->fatal( 'http-read-error' );
                    break;
                }

                if ( strlen( $buf ) ) {
                    call_user_func( $this->callback, $fh, $buf );
                }
            }
        }
        fclose( $fh );

        wfProfileOut( __METHOD__ );

        return $this->status;
    }
}