No OneTemporary
Actions

Size

63 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/src/aphront/AphrontRequest.php b/src/aphront/AphrontRequest.php
	index a65566e867..38eb5a6ffc 100644
	--- a/src/aphront/AphrontRequest.php
	+++ b/src/aphront/AphrontRequest.php
	@@ -1,910 +1,913 @@
	<?php

	/**
	* @task data Accessing Request Data
	* @task cookie Managing Cookies
	* @task cluster Working With a Phabricator Cluster
	*/
	final class AphrontRequest extends Phobject {

	// NOTE: These magic request-type parameters are automatically included in
	// certain requests (e.g., by phabricator_form(), JX.Request,
	// JX.Workflow, and ConduitClient) and help us figure out what sort of
	// response the client expects.

	const TYPE_AJAX = '__ajax__';
	const TYPE_FORM = '__form__';
	const TYPE_CONDUIT = '__conduit__';
	const TYPE_WORKFLOW = '__wflow__';
	const TYPE_CONTINUE = '__continue__';
	const TYPE_PREVIEW = '__preview__';
	const TYPE_HISEC = '__hisec__';
	const TYPE_QUICKSAND = '__quicksand__';

	private $host;
	private $path;
	private $requestData;
	private $user;
	private $applicationConfiguration;
	private $site;
	private $controller;
	private $uriData = array();
	private $cookiePrefix;

	public function __construct($host, $path) {
	$this->host = $host;
	$this->path = $path;
	}

	public function setURIMap(array $uri_data) {
	$this->uriData = $uri_data;
	return $this;
	}

	public function getURIMap() {
	return $this->uriData;
	}

	public function getURIData($key, $default = null) {
	return idx($this->uriData, $key, $default);
	}

	/**
	* Read line range parameter data from the request.
	*
	* Applications like Paste, Diffusion, and Harbormaster use "$12-14" in the
	* URI to allow users to link to particular lines.
	*
	* @param string URI data key to pull line range information from.
	* @param int\|null Maximum length of the range.
	* @return null\|pair<int, int> Null, or beginning and end of the range.
	*/
	public function getURILineRange($key, $limit) {
	$range = $this->getURIData($key);
	return self::parseURILineRange($range, $limit);
	}

	public static function parseURILineRange($range, $limit) {
	if (!strlen($range)) {
	return null;
	}

	$range = explode('-', $range, 2);

	foreach ($range as $key => $value) {
	$value = (int)$value;
	if (!$value) {
	// If either value is "0", discard the range.
	return null;
	}
	$range[$key] = $value;
	}

	// If the range is like "$10", treat it like "$10-10".
	if (count($range) == 1) {
	$range[] = head($range);
	}

	// If the range is "$7-5", treat it like "$5-7".
	if ($range[1] < $range[0]) {
	$range = array_reverse($range);
	}

	// If the user specified something like "$1-999999999" and we have a limit,
	// clamp it to a more reasonable range.
	if ($limit !== null) {
	if ($range[1] - $range[0] > $limit) {
	$range[1] = $range[0] + $limit;
	}
	}

	return $range;
	}

	public function setApplicationConfiguration(
	$application_configuration) {
	$this->applicationConfiguration = $application_configuration;
	return $this;
	}

	public function getApplicationConfiguration() {
	return $this->applicationConfiguration;
	}

	public function setPath($path) {
	$this->path = $path;
	return $this;
	}

	public function getPath() {
	return $this->path;
	}

	public function getHost() {
	// The "Host" header may include a port number, or may be a malicious
	// header in the form "realdomain.com:ignored@evil.com". Invoke the full
	// parser to extract the real domain correctly. See here for coverage of
	// a similar issue in Django:
	//
	// https://www.djangoproject.com/weblog/2012/oct/17/security/
	$uri = new PhutilURI('http://'.$this->host);
	return $uri->getDomain();
	}

	public function setSite(AphrontSite $site) {
	$this->site = $site;
	return $this;
	}

	public function getSite() {
	return $this->site;
	}

	public function setController(AphrontController $controller) {
	$this->controller = $controller;
	return $this;
	}

	public function getController() {
	return $this->controller;
	}


	/* -( Accessing Request Data )--------------------------------------------- */


	/**
	* @task data
	*/
	public function setRequestData(array $request_data) {
	$this->requestData = $request_data;
	return $this;
	}


	/**
	* @task data
	*/
	public function getRequestData() {
	return $this->requestData;
	}


	/**
	* @task data
	*/
	public function getInt($name, $default = null) {
	if (isset($this->requestData[$name])) {
	// Converting from array to int is "undefined". Don't rely on whatever
	// PHP decides to do.
	if (is_array($this->requestData[$name])) {
	return $default;
	}
	return (int)$this->requestData[$name];
	} else {
	return $default;
	}
	}


	/**
	* @task data
	*/
	public function getBool($name, $default = null) {
	if (isset($this->requestData[$name])) {
	if ($this->requestData[$name] === 'true') {
	return true;
	} else if ($this->requestData[$name] === 'false') {
	return false;
	} else {
	return (bool)$this->requestData[$name];
	}
	} else {
	return $default;
	}
	}


	/**
	* @task data
	*/
	public function getStr($name, $default = null) {
	if (isset($this->requestData[$name])) {
	$str = (string)$this->requestData[$name];
	// Normalize newline craziness.
	$str = str_replace(
	array("\r\n", "\r"),
	array("\n", "\n"),
	$str);
	return $str;
	} else {
	return $default;
	}
	}


	/**
	* @task data
	*/
	public function getArr($name, $default = array()) {
	if (isset($this->requestData[$name]) &&
	is_array($this->requestData[$name])) {
	return $this->requestData[$name];
	} else {
	return $default;
	}
	}


	/**
	* @task data
	*/
	public function getStrList($name, $default = array()) {
	if (!isset($this->requestData[$name])) {
	return $default;
	}
	$list = $this->getStr($name);
	$list = preg_split('/[\s,]+/', $list, $limit = -1, PREG_SPLIT_NO_EMPTY);
	return $list;
	}


	/**
	* @task data
	*/
	public function getExists($name) {
	return array_key_exists($name, $this->requestData);
	}

	public function getFileExists($name) {
	return isset($_FILES[$name]) &&
	(idx($_FILES[$name], 'error') !== UPLOAD_ERR_NO_FILE);
	}

	public function isHTTPGet() {
	return ($_SERVER['REQUEST_METHOD'] == 'GET');
	}

	public function isHTTPPost() {
	return ($_SERVER['REQUEST_METHOD'] == 'POST');
	}

	public function isAjax() {
	return $this->getExists(self::TYPE_AJAX) && !$this->isQuicksand();
	}

	public function isWorkflow() {
	return $this->getExists(self::TYPE_WORKFLOW) && !$this->isQuicksand();
	}

	public function isQuicksand() {
	return $this->getExists(self::TYPE_QUICKSAND);
	}

	public function isConduit() {
	return $this->getExists(self::TYPE_CONDUIT);
	}

	public static function getCSRFTokenName() {
	return '__csrf__';
	}

	public static function getCSRFHeaderName() {
	return 'X-Phabricator-Csrf';
	}

	public static function getViaHeaderName() {
	return 'X-Phabricator-Via';
	}

	public function validateCSRF() {
	$token_name = self::getCSRFTokenName();
	$token = $this->getStr($token_name);

	// No token in the request, check the HTTP header which is added for Ajax
	// requests.
	if (empty($token)) {
	$token = self::getHTTPHeader(self::getCSRFHeaderName());
	}

	$valid = $this->getUser()->validateCSRFToken($token);
	if (!$valid) {

	// Add some diagnostic details so we can figure out if some CSRF issues
	// are JS problems or people accessing Ajax URIs directly with their
	// browsers.
	$info = array();

	$info[] = pht(
	'You are trying to save some data to Phabricator, but the request '.
	'your browser made included an incorrect token. Reload the page '.
	'and try again. You may need to clear your cookies.');

	if ($this->isAjax()) {
	$info[] = pht('This was an Ajax request.');
	} else {
	$info[] = pht('This was a Web request.');
	}

	if ($token) {
	$info[] = pht('This request had an invalid CSRF token.');
	} else {
	$info[] = pht('This request had no CSRF token.');
	}

	// Give a more detailed explanation of how to avoid the exception
	// in developer mode.
	if (PhabricatorEnv::getEnvConfig('phabricator.developer-mode')) {
	// TODO: Clean this up, see T1921.
	$info[] = pht(
	"To avoid this error, use %s to construct forms. If you are already ".
	"using %s, make sure the form 'action' uses a relative URI (i.e., ".
	"begins with a '%s'). Forms using absolute URIs do not include CSRF ".
	"tokens, to prevent leaking tokens to external sites.\n\n".
	"If this page performs writes which do not require CSRF protection ".
	"(usually, filling caches or logging), you can use %s to ".
	"temporarily bypass CSRF protection while writing. You should use ".
	"this only for writes which can not be protected with normal CSRF ".
	"mechanisms.\n\n".
	"Some UI elements (like %s) also have methods which will allow you ".
	"to render links as forms (like %s).",
	'phabricator_form()',
	'phabricator_form()',
	'/',
	'AphrontWriteGuard::beginScopedUnguardedWrites()',
	'PhabricatorActionListView',
	'setRenderAsForm(true)');
	}

	$message = implode("\n", $info);

	// This should only be able to happen if you load a form, pull your
	// internet for 6 hours, and then reconnect and immediately submit,
	// but give the user some indication of what happened since the workflow
	// is incredibly confusing otherwise.
	throw new AphrontMalformedRequestException(
	pht('Invalid Request (CSRF)'),
	$message,
	true);
	}

	return true;
	}

	public function isFormPost() {
	$post = $this->getExists(self::TYPE_FORM) &&
	!$this->getExists(self::TYPE_HISEC) &&
	$this->isHTTPPost();

	if (!$post) {
	return false;
	}

	return $this->validateCSRF();
	}

	public function isFormOrHisecPost() {
	$post = $this->getExists(self::TYPE_FORM) &&
	$this->isHTTPPost();

	if (!$post) {
	return false;
	}

	return $this->validateCSRF();
	}


	public function setCookiePrefix($prefix) {
	$this->cookiePrefix = $prefix;
	return $this;
	}

	private function getPrefixedCookieName($name) {
	if (strlen($this->cookiePrefix)) {
	return $this->cookiePrefix.'_'.$name;
	} else {
	return $name;
	}
	}

	public function getCookie($name, $default = null) {
	$name = $this->getPrefixedCookieName($name);
	$value = idx($_COOKIE, $name, $default);

	// Internally, PHP deletes cookies by setting them to the value 'deleted'
	// with an expiration date in the past.

	// At least in Safari, the browser may send this cookie anyway in some
	// circumstances. After logging out, the 302'd GET to /login/ consistently
	// includes deleted cookies on my local install. If a cookie value is
	// literally 'deleted', pretend it does not exist.

	if ($value === 'deleted') {
	return null;
	}

	return $value;
	}

	public function clearCookie($name) {
	$this->setCookieWithExpiration($name, '', time() - (60 * 60 * 24 * 30));
	unset($_COOKIE[$name]);
	}

	/**
	* Get the domain which cookies should be set on for this request, or null
	* if the request does not correspond to a valid cookie domain.
	*
	* @return PhutilURI\|null Domain URI, or null if no valid domain exists.
	*
	* @task cookie
	*/
	private function getCookieDomainURI() {
	if (PhabricatorEnv::getEnvConfig('security.require-https') &&
	!$this->isHTTPS()) {
	return null;
	}

	$host = $this->getHost();

	// If there's no base domain configured, just use whatever the request
	// domain is. This makes setup easier, and we'll tell administrators to
	// configure a base domain during the setup process.
	$base_uri = PhabricatorEnv::getEnvConfig('phabricator.base-uri');
	if (!strlen($base_uri)) {
	return new PhutilURI('http://'.$host.'/');
	}

	$alternates = PhabricatorEnv::getEnvConfig('phabricator.allowed-uris');
	$allowed_uris = array_merge(
	array($base_uri),
	$alternates);

	foreach ($allowed_uris as $allowed_uri) {
	$uri = new PhutilURI($allowed_uri);
	if ($uri->getDomain() == $host) {
	return $uri;
	}
	}

	return null;
	}

	/**
	* Determine if security policy rules will allow cookies to be set when
	* responding to the request.
	*
	* @return bool True if setCookie() will succeed. If this method returns
	* false, setCookie() will throw.
	*
	* @task cookie
	*/
	public function canSetCookies() {
	return (bool)$this->getCookieDomainURI();
	}


	/**
	* Set a cookie which does not expire for a long time.
	*
	* To set a temporary cookie, see @{method:setTemporaryCookie}.
	*
	* @param string Cookie name.
	* @param string Cookie value.
	* @return this
	* @task cookie
	*/
	public function setCookie($name, $value) {
	$far_future = time() + (60 * 60 * 24 * 365 * 5);
	return $this->setCookieWithExpiration($name, $value, $far_future);
	}


	/**
	* Set a cookie which expires soon.
	*
	* To set a durable cookie, see @{method:setCookie}.
	*
	* @param string Cookie name.
	* @param string Cookie value.
	* @return this
	* @task cookie
	*/
	public function setTemporaryCookie($name, $value) {
	return $this->setCookieWithExpiration($name, $value, 0);
	}


	/**
	* Set a cookie with a given expiration policy.
	*
	* @param string Cookie name.
	* @param string Cookie value.
	* @param int Epoch timestamp for cookie expiration.
	* @return this
	* @task cookie
	*/
	private function setCookieWithExpiration(
	$name,
	$value,
	$expire) {

	$is_secure = false;

	$base_domain_uri = $this->getCookieDomainURI();
	if (!$base_domain_uri) {
	$configured_as = PhabricatorEnv::getEnvConfig('phabricator.base-uri');
	$accessed_as = $this->getHost();

	throw new AphrontMalformedRequestException(
	pht('Bad Host Header'),
	pht(
	'This Phabricator install is configured as "%s", but you are '.
	'using the domain name "%s" to access a page which is trying to '.
	'set a cookie. Access Phabricator on the configured primary '.
	'domain or a configured alternate domain. Phabricator will not '.
	'set cookies on other domains for security reasons.',
	$configured_as,
	$accessed_as),
	true);
	}

	$base_domain = $base_domain_uri->getDomain();
	$is_secure = ($base_domain_uri->getProtocol() == 'https');

	$name = $this->getPrefixedCookieName($name);

	if (php_sapi_name() == 'cli') {
	// Do nothing, to avoid triggering "Cannot modify header information"
	// warnings.

	// TODO: This is effectively a test for whether we're running in a unit
	// test or not. Move this actual call to HTTPSink?
	} else {
	setcookie(
	$name,
	$value,
	$expire,
	$path = '/',
	$base_domain,
	$is_secure,
	$http_only = true);
	}

	$_COOKIE[$name] = $value;

	return $this;
	}

	public function setUser($user) {
	$this->user = $user;
	return $this;
	}

	public function getUser() {
	return $this->user;
	}

	public function getViewer() {
	return $this->user;
	}

	public function getRequestURI() {
	$request_uri = idx($_SERVER, 'REQUEST_URI', '/');

	$uri = new PhutilURI($request_uri);
	$uri->setQueryParam('__path__', null);

	$path = phutil_escape_uri($this->getPath());
	$uri->setPath($path);

	return $uri;
	}

	public function getAbsoluteRequestURI() {
	$uri = $this->getRequestURI();
	$uri->setDomain($this->getHost());

	if ($this->isHTTPS()) {
	$protocol = 'https';
	} else {
	$protocol = 'http';
	}

	$uri->setProtocol($protocol);

	// If the request used a nonstandard port, preserve it while building the
	// absolute URI.

	// First, get the default port for the request protocol.
	$default_port = id(new PhutilURI($protocol.'://example.com/'))
	->getPortWithProtocolDefault();

	// NOTE: See note in getHost() about malicious "Host" headers. This
	// construction defuses some obscure potential attacks.
	$port = id(new PhutilURI($protocol.'://'.$this->host))
	->getPort();

	if (($port !== null) && ($port !== $default_port)) {
	$uri->setPort($port);
	}

	return $uri;
	}

	public function isDialogFormPost() {
	return $this->isFormPost() && $this->getStr('__dialog__');
	}

	public function getRemoteAddress() {
	$address = PhabricatorEnv::getRemoteAddress();

	if (!$address) {
	return null;
	}

	return $address->getAddress();
	}

	public function isHTTPS() {
	if (empty($_SERVER['HTTPS'])) {
	return false;
	}
	if (!strcasecmp($_SERVER['HTTPS'], 'off')) {
	return false;
	}
	return true;
	}

	public function isContinueRequest() {
	return $this->isFormPost() && $this->getStr('__continue__');
	}

	public function isPreviewRequest() {
	return $this->isFormPost() && $this->getStr('__preview__');
	}

	/**
	* Get application request parameters in a flattened form suitable for
	* inclusion in an HTTP request, excluding parameters with special meanings.
	* This is primarily useful if you want to ask the user for more input and
	* then resubmit their request.
	*
	* @return dict<string, string> Original request parameters.
	*/
	public function getPassthroughRequestParameters($include_quicksand = false) {
	return self::flattenData(
	$this->getPassthroughRequestData($include_quicksand));
	}

	/**
	* Get request data other than "magic" parameters.
	*
	* @return dict<string, wild> Request data, with magic filtered out.
	*/
	public function getPassthroughRequestData($include_quicksand = false) {
	$data = $this->getRequestData();

	// Remove magic parameters like __dialog__ and __ajax__.
	foreach ($data as $key => $value) {
	if ($include_quicksand && $key == self::TYPE_QUICKSAND) {
	continue;
	}
	if (!strncmp($key, '__', 2)) {
	unset($data[$key]);
	}
	}

	return $data;
	}


	/**
	* Flatten an array of key-value pairs (possibly including arrays as values)
	* into a list of key-value pairs suitable for submitting via HTTP request
	* (with arrays flattened).
	*
	* @param dict<string, wild> Data to flatten.
	* @return dict<string, string> Flat data suitable for inclusion in an HTTP
	* request.
	*/
	public static function flattenData(array $data) {
	$result = array();
	foreach ($data as $key => $value) {
	if (is_array($value)) {
	foreach (self::flattenData($value) as $fkey => $fvalue) {
	$fkey = '['.preg_replace('/(?=\[)\|$/', ']', $fkey, $limit = 1);
	$result[$key.$fkey] = $fvalue;
	}
	} else {
	$result[$key] = (string)$value;
	}
	}

	ksort($result);

	return $result;
	}


	/**
	* Read the value of an HTTP header from `$_SERVER`, or a similar datasource.
	*
	* This function accepts a canonical header name, like `"Accept-Encoding"`,
	* and looks up the appropriate value in `$_SERVER` (in this case,
	* `"HTTP_ACCEPT_ENCODING"`).
	*
	* @param string Canonical header name, like `"Accept-Encoding"`.
	* @param wild Default value to return if header is not present.
	* @param array? Read this instead of `$_SERVER`.
	* @return string\|wild Header value if present, or `$default` if not.
	*/
	public static function getHTTPHeader($name, $default = null, $data = null) {
	// PHP mangles HTTP headers by uppercasing them and replacing hyphens with
	// underscores, then prepending 'HTTP_'.
	$php_index = strtoupper($name);
	$php_index = str_replace('-', '_', $php_index);

	$try_names = array();

	$try_names[] = 'HTTP_'.$php_index;
	if ($php_index == 'CONTENT_TYPE' \|\| $php_index == 'CONTENT_LENGTH') {
	// These headers may be available under alternate names. See
	// http://www.php.net/manual/en/reserved.variables.server.php#110763
	$try_names[] = $php_index;
	}

	if ($data === null) {
	$data = $_SERVER;
	}

	foreach ($try_names as $try_name) {
	if (array_key_exists($try_name, $data)) {
	return $data[$try_name];
	}
	}

	return $default;
	}


	/* -( Working With a Phabricator Cluster )--------------------------------- */


	/**
	* Is this a proxied request originating from within the Phabricator cluster?
	*
	* IMPORTANT: This means the request is dangerous!
	*
	* These requests are more dangerous than normal requests (they can not
	* be safely proxied, because proxying them may cause a loop). Cluster
	* requests are not guaranteed to come from a trusted source, and should
	* never be treated as safer than normal requests. They are strictly less
	* safe.
	*/
	public function isProxiedClusterRequest() {
	return (bool)self::getHTTPHeader('X-Phabricator-Cluster');
	}


	/**
	* Build a new @{class:HTTPSFuture} which proxies this request to another
	* node in the cluster.
	*
	* IMPORTANT: This is very dangerous!
	*
	* The future forwards authentication information present in the request.
	* Proxied requests must only be sent to trusted hosts. (We attempt to
	* enforce this.)
	*
	* This is not a general-purpose proxying method; it is a specialized
	* method with niche applications and severe security implications.
	*
	* @param string URI identifying the host we are proxying the request to.
	* @return HTTPSFuture New proxy future.
	*
	* @phutil-external-symbol class PhabricatorStartup
	*/
	public function newClusterProxyFuture($uri) {
	$uri = new PhutilURI($uri);

	$domain = $uri->getDomain();
	$ip = gethostbyname($domain);
	if (!$ip) {
	throw new Exception(
	pht(
	'Unable to resolve domain "%s"!',
	$domain));
	}

	if (!PhabricatorEnv::isClusterAddress($ip)) {
	throw new Exception(
	pht(
	'Refusing to proxy a request to IP address ("%s") which is not '.
	'in the cluster address block (this address was derived by '.
	'resolving the domain "%s").',
	$ip,
	$domain));
	}

	$uri->setPath($this->getPath());
	- $uri->setQueryParams(self::flattenData($_GET));
	+ $uri->removeAllQueryParams();
	+ foreach (self::flattenData($_GET) as $query_key => $query_value) {
	+ $uri->appendQueryParam($query_key, $query_value);
	+ }

	$input = PhabricatorStartup::getRawInput();

	$future = id(new HTTPSFuture($uri))
	->addHeader('Host', self::getHost())
	->addHeader('X-Phabricator-Cluster', true)
	->setMethod($_SERVER['REQUEST_METHOD'])
	->write($input);

	if (isset($_SERVER['PHP_AUTH_USER'])) {
	$future->setHTTPBasicAuthCredentials(
	$_SERVER['PHP_AUTH_USER'],
	new PhutilOpaqueEnvelope(idx($_SERVER, 'PHP_AUTH_PW', '')));
	}

	$headers = array();
	$seen = array();

	// NOTE: apache_request_headers() might provide a nicer way to do this,
	// but isn't available under FCGI until PHP 5.4.0.
	foreach ($_SERVER as $key => $value) {
	if (!preg_match('/^HTTP_/', $key)) {
	continue;
	}

	// Unmangle the header as best we can.
	$key = substr($key, strlen('HTTP_'));
	$key = str_replace('_', ' ', $key);
	$key = strtolower($key);
	$key = ucwords($key);
	$key = str_replace(' ', '-', $key);

	// By default, do not forward headers.
	$should_forward = false;

	// Forward "X-Hgarg-..." headers.
	if (preg_match('/^X-Hgarg-/', $key)) {
	$should_forward = true;
	}

	if ($should_forward) {
	$headers[] = array($key, $value);
	$seen[$key] = true;
	}
	}

	// In some situations, this may not be mapped into the HTTP_X constants.
	// CONTENT_LENGTH is similarly affected, but we trust cURL to take care
	// of that if it matters, since we're handing off a request body.
	if (empty($seen['Content-Type'])) {
	if (isset($_SERVER['CONTENT_TYPE'])) {
	$headers[] = array('Content-Type', $_SERVER['CONTENT_TYPE']);
	}
	}

	foreach ($headers as $header) {
	list($key, $value) = $header;
	switch ($key) {
	case 'Host':
	case 'Authorization':
	// Don't forward these headers, we've already handled them elsewhere.
	unset($headers[$key]);
	break;
	default:
	break;
	}
	}

	foreach ($headers as $header) {
	list($key, $value) = $header;
	$future->addHeader($key, $value);
	}

	return $future;
	}


	}
	diff --git a/src/aphront/response/AphrontResponse.php b/src/aphront/response/AphrontResponse.php
	index 0eab91b2af..9cfda0f5c1 100644
	--- a/src/aphront/response/AphrontResponse.php
	+++ b/src/aphront/response/AphrontResponse.php
	@@ -1,434 +1,434 @@
	<?php

	abstract class AphrontResponse extends Phobject {

	private $request;
	private $cacheable = false;
	private $canCDN;
	private $responseCode = 200;
	private $lastModified = null;
	private $contentSecurityPolicyURIs;
	private $disableContentSecurityPolicy;
	protected $frameable;


	public function setRequest($request) {
	$this->request = $request;
	return $this;
	}

	public function getRequest() {
	return $this->request;
	}

	final public function addContentSecurityPolicyURI($kind, $uri) {
	if ($this->contentSecurityPolicyURIs === null) {
	$this->contentSecurityPolicyURIs = array(
	'script-src' => array(),
	'connect-src' => array(),
	'frame-src' => array(),
	'form-action' => array(),
	'object-src' => array(),
	);
	}

	if (!isset($this->contentSecurityPolicyURIs[$kind])) {
	throw new Exception(
	pht(
	'Unknown Content-Security-Policy URI kind "%s".',
	$kind));
	}

	$this->contentSecurityPolicyURIs[$kind][] = (string)$uri;

	return $this;
	}

	final public function setDisableContentSecurityPolicy($disable) {
	$this->disableContentSecurityPolicy = $disable;
	return $this;
	}


	/* -( Content )------------------------------------------------------------ */


	public function getContentIterator() {
	// By default, make sure responses are truly returning a string, not some
	// kind of object that behaves like a string.

	// We're going to remove the execution time limit before dumping the
	// response into the sink, and want any rendering that's going to occur
	// to happen BEFORE we release the limit.

	return array(
	(string)$this->buildResponseString(),
	);
	}

	public function buildResponseString() {
	throw new PhutilMethodNotImplementedException();
	}


	/* -( Metadata )----------------------------------------------------------- */


	public function getHeaders() {
	$headers = array();
	if (!$this->frameable) {
	$headers[] = array('X-Frame-Options', 'Deny');
	}

	if ($this->getRequest() && $this->getRequest()->isHTTPS()) {
	$hsts_key = 'security.strict-transport-security';
	$use_hsts = PhabricatorEnv::getEnvConfig($hsts_key);
	if ($use_hsts) {
	$duration = phutil_units('365 days in seconds');
	} else {
	// If HSTS has been disabled, tell browsers to turn it off. This may
	// not be effective because we can only disable it over a valid HTTPS
	// connection, but it best represents the configured intent.
	$duration = 0;
	}

	$headers[] = array(
	'Strict-Transport-Security',
	"max-age={$duration}; includeSubdomains; preload",
	);
	}

	$csp = $this->newContentSecurityPolicyHeader();
	if ($csp !== null) {
	$headers[] = array('Content-Security-Policy', $csp);
	}

	$headers[] = array('Referrer-Policy', 'no-referrer');

	return $headers;
	}

	private function newContentSecurityPolicyHeader() {
	if ($this->disableContentSecurityPolicy) {
	return null;
	}

	// NOTE: We may return a response during preflight checks (for example,
	// if a user has a bad version of PHP).

	// In this case, setup isn't complete yet and we can't access environmental
	// configuration. If we aren't able to read the environment, just decline
	// to emit a Content-Security-Policy header.

	try {
	$cdn = PhabricatorEnv::getEnvConfig('security.alternate-file-domain');
	$base_uri = PhabricatorEnv::getURI('/');
	} catch (Exception $ex) {
	return null;
	}

	$csp = array();
	if ($cdn) {
	$default = $this->newContentSecurityPolicySource($cdn);
	} else {
	// If an alternate file domain is not configured and the user is viewing
	// a Phame blog on a custom domain or some other custom site, we'll still
	// serve resources from the main site. Include the main site explicitly.
	$base_uri = $this->newContentSecurityPolicySource($base_uri);

	$default = "'self' {$base_uri}";
	}

	$csp[] = "default-src {$default}";

	// We use "data:" URIs to inline small images into CSS. This policy allows
	// "data:" URIs to be used anywhere, but there doesn't appear to be a way
	// to say that "data:" URIs are okay in CSS files but not in the document.
	$csp[] = "img-src {$default} data:";

	// We use inline style="..." attributes in various places, many of which
	// are legitimate. We also currently use a <style> tag to implement the
	// "Monospaced Font Preference" setting.
	$csp[] = "style-src {$default} 'unsafe-inline'";

	// On a small number of pages, including the Stripe workflow and the
	// ReCAPTCHA challenge, we embed external Javascript directly.
	$csp[] = $this->newContentSecurityPolicy('script-src', $default);

	// We need to specify that we can connect to ourself in order for AJAX
	// requests to work.
	$csp[] = $this->newContentSecurityPolicy('connect-src', "'self'");

	// DarkConsole and PHPAST both use frames to render some content.
	$csp[] = $this->newContentSecurityPolicy('frame-src', "'self'");

	// This is a more modern flavor of of "X-Frame-Options" and prevents
	// clickjacking attacks where the page is included in a tiny iframe and
	// the user is convinced to click a element on the page, which really
	// clicks a dangerous button hidden under a picture of a cat.
	if ($this->frameable) {
	$csp[] = "frame-ancestors 'self'";
	} else {
	$csp[] = "frame-ancestors 'none'";
	}

	// Block relics of the old world: Flash, Java applets, and so on. Note
	// that Chrome prevents the user from viewing PDF documents if they are
	// served with a policy which excludes the domain they are served from.
	$csp[] = $this->newContentSecurityPolicy('object-src', "'none'");

	// Don't allow forms to submit offsite.

	// This can result in some trickiness with file downloads if applications
	// try to start downloads by submitting a dialog. Redirect to the file's
	// download URI instead of submitting a form to it.
	$csp[] = $this->newContentSecurityPolicy('form-action', "'self'");

	// Block use of "<base>" to change the origin of relative URIs on the page.
	$csp[] = "base-uri 'none'";

	$csp = implode('; ', $csp);

	return $csp;
	}

	private function newContentSecurityPolicy($type, $defaults) {
	if ($defaults === null) {
	$sources = array();
	} else {
	$sources = (array)$defaults;
	}

	$uris = $this->contentSecurityPolicyURIs;
	if (isset($uris[$type])) {
	foreach ($uris[$type] as $uri) {
	$sources[] = $this->newContentSecurityPolicySource($uri);
	}
	}
	$sources = array_unique($sources);

	return $type.' '.implode(' ', $sources);
	}

	private function newContentSecurityPolicySource($uri) {
	// Some CSP URIs are ultimately user controlled (like notification server
	// URIs and CDN URIs) so attempt to stop an attacker from injecting an
	// unsafe source (like 'unsafe-eval') into the CSP header.

	$uri = id(new PhutilURI($uri))
	->setPath(null)
	->setFragment(null)
	- ->setQueryParams(array());
	+ ->removeAllQueryParams();

	$uri = (string)$uri;
	if (preg_match('/[ ;\']/', $uri)) {
	throw new Exception(
	pht(
	'Attempting to emit a response with an unsafe source ("%s") in the '.
	'Content-Security-Policy header.',
	$uri));
	}

	return $uri;
	}

	public function setCacheDurationInSeconds($duration) {
	$this->cacheable = $duration;
	return $this;
	}

	public function setCanCDN($can_cdn) {
	$this->canCDN = $can_cdn;
	return $this;
	}

	public function setLastModified($epoch_timestamp) {
	$this->lastModified = $epoch_timestamp;
	return $this;
	}

	public function setHTTPResponseCode($code) {
	$this->responseCode = $code;
	return $this;
	}

	public function getHTTPResponseCode() {
	return $this->responseCode;
	}

	public function getHTTPResponseMessage() {
	switch ($this->getHTTPResponseCode()) {
	case 100: return 'Continue';
	case 101: return 'Switching Protocols';
	case 200: return 'OK';
	case 201: return 'Created';
	case 202: return 'Accepted';
	case 203: return 'Non-Authoritative Information';
	case 204: return 'No Content';
	case 205: return 'Reset Content';
	case 206: return 'Partial Content';
	case 300: return 'Multiple Choices';
	case 301: return 'Moved Permanently';
	case 302: return 'Found';
	case 303: return 'See Other';
	case 304: return 'Not Modified';
	case 305: return 'Use Proxy';
	case 306: return 'Switch Proxy';
	case 307: return 'Temporary Redirect';
	case 400: return 'Bad Request';
	case 401: return 'Unauthorized';
	case 402: return 'Payment Required';
	case 403: return 'Forbidden';
	case 404: return 'Not Found';
	case 405: return 'Method Not Allowed';
	case 406: return 'Not Acceptable';
	case 407: return 'Proxy Authentication Required';
	case 408: return 'Request Timeout';
	case 409: return 'Conflict';
	case 410: return 'Gone';
	case 411: return 'Length Required';
	case 412: return 'Precondition Failed';
	case 413: return 'Request Entity Too Large';
	case 414: return 'Request-URI Too Long';
	case 415: return 'Unsupported Media Type';
	case 416: return 'Requested Range Not Satisfiable';
	case 417: return 'Expectation Failed';
	case 418: return "I'm a teapot";
	case 426: return 'Upgrade Required';
	case 500: return 'Internal Server Error';
	case 501: return 'Not Implemented';
	case 502: return 'Bad Gateway';
	case 503: return 'Service Unavailable';
	case 504: return 'Gateway Timeout';
	case 505: return 'HTTP Version Not Supported';
	default: return '';
	}
	}

	public function setFrameable($frameable) {
	$this->frameable = $frameable;
	return $this;
	}

	public static function processValueForJSONEncoding(&$value, $key) {
	if ($value instanceof PhutilSafeHTMLProducerInterface) {
	// This renders the producer down to PhutilSafeHTML, which will then
	// be simplified into a string below.
	$value = hsprintf('%s', $value);
	}

	if ($value instanceof PhutilSafeHTML) {
	// TODO: Javelin supports implicity conversion of '__html' objects to
	// JX.HTML, but only for Ajax responses, not behaviors. Just leave things
	// as they are for now (where behaviors treat responses as HTML or plain
	// text at their discretion).
	$value = $value->getHTMLContent();
	}
	}

	public static function encodeJSONForHTTPResponse(array $object) {

	array_walk_recursive(
	$object,
	array(__CLASS__, 'processValueForJSONEncoding'));

	$response = phutil_json_encode($object);

	// Prevent content sniffing attacks by encoding "<" and ">", so browsers
	// won't try to execute the document as HTML even if they ignore
	// Content-Type and X-Content-Type-Options. See T865.
	$response = str_replace(
	array('<', '>'),
	array('\u003c', '\u003e'),
	$response);

	return $response;
	}

	protected function addJSONShield($json_response) {
	// Add a shield to prevent "JSON Hijacking" attacks where an attacker
	// requests a JSON response using a normal <script /> tag and then uses
	// Object.prototype.__defineSetter__() or similar to read response data.
	// This header causes the browser to loop infinitely instead of handing over
	// sensitive data.

	$shield = 'for (;;);';

	$response = $shield.$json_response;

	return $response;
	}

	public function getCacheHeaders() {
	$headers = array();
	if ($this->cacheable) {
	$cache_control = array();
	$cache_control[] = sprintf('max-age=%d', $this->cacheable);

	if ($this->canCDN) {
	$cache_control[] = 'public';
	} else {
	$cache_control[] = 'private';
	}

	$headers[] = array(
	'Cache-Control',
	implode(', ', $cache_control),
	);

	$headers[] = array(
	'Expires',
	$this->formatEpochTimestampForHTTPHeader(time() + $this->cacheable),
	);
	} else {
	$headers[] = array(
	'Cache-Control',
	'no-store',
	);
	$headers[] = array(
	'Expires',
	'Sat, 01 Jan 2000 00:00:00 GMT',
	);
	}

	if ($this->lastModified) {
	$headers[] = array(
	'Last-Modified',
	$this->formatEpochTimestampForHTTPHeader($this->lastModified),
	);
	}

	// IE has a feature where it may override an explicit Content-Type
	// declaration by inferring a content type. This can be a security risk
	// and we always explicitly transmit the correct Content-Type header, so
	// prevent IE from using inferred content types. This only offers protection
	// on recent versions of IE; IE6/7 and Opera currently ignore this header.
	$headers[] = array('X-Content-Type-Options', 'nosniff');

	return $headers;
	}

	private function formatEpochTimestampForHTTPHeader($epoch_timestamp) {
	return gmdate('D, d M Y H:i:s', $epoch_timestamp).' GMT';
	}

	protected function shouldCompressResponse() {
	return true;
	}

	public function willBeginWrite() {
	if ($this->shouldCompressResponse()) {
	// Enable automatic compression here. Webservers sometimes do this for
	// us, but we now detect the absence of compression and warn users about
	// it so try to cover our bases more thoroughly.
	ini_set('zlib.output_compression', 1);
	} else {
	ini_set('zlib.output_compression', 0);
	}
	}

	public function didCompleteWrite($aborted) {
	return;
	}

	}
	diff --git a/src/applications/auth/provider/PhabricatorAuthProvider.php b/src/applications/auth/provider/PhabricatorAuthProvider.php
	index 78aeebd810..dfdc7c6a5b 100644
	--- a/src/applications/auth/provider/PhabricatorAuthProvider.php
	+++ b/src/applications/auth/provider/PhabricatorAuthProvider.php
	@@ -1,534 +1,534 @@
	<?php

	abstract class PhabricatorAuthProvider extends Phobject {

	private $providerConfig;

	public function attachProviderConfig(PhabricatorAuthProviderConfig $config) {
	$this->providerConfig = $config;
	return $this;
	}

	public function hasProviderConfig() {
	return (bool)$this->providerConfig;
	}

	public function getProviderConfig() {
	if ($this->providerConfig === null) {
	throw new PhutilInvalidStateException('attachProviderConfig');
	}
	return $this->providerConfig;
	}

	public function getConfigurationHelp() {
	return null;
	}

	public function getDefaultProviderConfig() {
	return id(new PhabricatorAuthProviderConfig())
	->setProviderClass(get_class($this))
	->setIsEnabled(1)
	->setShouldAllowLogin(1)
	->setShouldAllowRegistration(1)
	->setShouldAllowLink(1)
	->setShouldAllowUnlink(1);
	}

	public function getNameForCreate() {
	return $this->getProviderName();
	}

	public function getDescriptionForCreate() {
	return null;
	}

	public function getProviderKey() {
	return $this->getAdapter()->getAdapterKey();
	}

	public function getProviderType() {
	return $this->getAdapter()->getAdapterType();
	}

	public function getProviderDomain() {
	return $this->getAdapter()->getAdapterDomain();
	}

	public static function getAllBaseProviders() {
	return id(new PhutilClassMapQuery())
	->setAncestorClass(__CLASS__)
	->execute();
	}

	public static function getAllProviders() {
	static $providers;

	if ($providers === null) {
	$objects = self::getAllBaseProviders();

	$configs = id(new PhabricatorAuthProviderConfigQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->execute();

	$providers = array();
	foreach ($configs as $config) {
	if (!isset($objects[$config->getProviderClass()])) {
	// This configuration is for a provider which is not installed.
	continue;
	}

	$object = clone $objects[$config->getProviderClass()];
	$object->attachProviderConfig($config);

	$key = $object->getProviderKey();
	if (isset($providers[$key])) {
	throw new Exception(
	pht(
	"Two authentication providers use the same provider key ".
	"('%s'). Each provider must be identified by a unique key.",
	$key));
	}
	$providers[$key] = $object;
	}
	}

	return $providers;
	}

	public static function getAllEnabledProviders() {
	$providers = self::getAllProviders();
	foreach ($providers as $key => $provider) {
	if (!$provider->isEnabled()) {
	unset($providers[$key]);
	}
	}
	return $providers;
	}

	public static function getEnabledProviderByKey($provider_key) {
	return idx(self::getAllEnabledProviders(), $provider_key);
	}

	abstract public function getProviderName();
	abstract public function getAdapter();

	public function isEnabled() {
	return $this->getProviderConfig()->getIsEnabled();
	}

	public function shouldAllowLogin() {
	return $this->getProviderConfig()->getShouldAllowLogin();
	}

	public function shouldAllowRegistration() {
	if (!$this->shouldAllowLogin()) {
	return false;
	}

	return $this->getProviderConfig()->getShouldAllowRegistration();
	}

	public function shouldAllowAccountLink() {
	return $this->getProviderConfig()->getShouldAllowLink();
	}

	public function shouldAllowAccountUnlink() {
	return $this->getProviderConfig()->getShouldAllowUnlink();
	}

	public function shouldTrustEmails() {
	return $this->shouldAllowEmailTrustConfiguration() &&
	$this->getProviderConfig()->getShouldTrustEmails();
	}

	/**
	* Should we allow the adapter to be marked as "trusted". This is true for
	* all adapters except those that allow the user to type in emails (see
	* @{class:PhabricatorPasswordAuthProvider}).
	*/
	public function shouldAllowEmailTrustConfiguration() {
	return true;
	}

	public function buildLoginForm(PhabricatorAuthStartController $controller) {
	return $this->renderLoginForm($controller->getRequest(), $mode = 'start');
	}

	public function buildInviteForm(PhabricatorAuthStartController $controller) {
	return $this->renderLoginForm($controller->getRequest(), $mode = 'invite');
	}

	abstract public function processLoginRequest(
	PhabricatorAuthLoginController $controller);

	public function buildLinkForm(PhabricatorAuthLinkController $controller) {
	return $this->renderLoginForm($controller->getRequest(), $mode = 'link');
	}

	public function shouldAllowAccountRefresh() {
	return true;
	}

	public function buildRefreshForm(
	PhabricatorAuthLinkController $controller) {
	return $this->renderLoginForm($controller->getRequest(), $mode = 'refresh');
	}

	protected function renderLoginForm(AphrontRequest $request, $mode) {
	throw new PhutilMethodNotImplementedException();
	}

	public function createProviders() {
	return array($this);
	}

	protected function willSaveAccount(PhabricatorExternalAccount $account) {
	return;
	}

	public function willRegisterAccount(PhabricatorExternalAccount $account) {
	return;
	}

	protected function loadOrCreateAccount($account_id) {
	if (!strlen($account_id)) {
	throw new Exception(pht('Empty account ID!'));
	}

	$adapter = $this->getAdapter();
	$adapter_class = get_class($adapter);

	if (!strlen($adapter->getAdapterType())) {
	throw new Exception(
	pht(
	"AuthAdapter (of class '%s') has an invalid implementation: ".
	"no adapter type.",
	$adapter_class));
	}

	if (!strlen($adapter->getAdapterDomain())) {
	throw new Exception(
	pht(
	"AuthAdapter (of class '%s') has an invalid implementation: ".
	"no adapter domain.",
	$adapter_class));
	}

	$account = id(new PhabricatorExternalAccount())->loadOneWhere(
	'accountType = %s AND accountDomain = %s AND accountID = %s',
	$adapter->getAdapterType(),
	$adapter->getAdapterDomain(),
	$account_id);
	if (!$account) {
	$account = $this->newExternalAccount()
	->setAccountID($account_id);
	}

	$account->setUsername($adapter->getAccountName());
	$account->setRealName($adapter->getAccountRealName());
	$account->setEmail($adapter->getAccountEmail());
	$account->setAccountURI($adapter->getAccountURI());

	$account->setProfileImagePHID(null);
	$image_uri = $adapter->getAccountImageURI();
	if ($image_uri) {
	try {
	$name = PhabricatorSlug::normalize($this->getProviderName());
	$name = $name.'-profile.jpg';

	// TODO: If the image has not changed, we do not need to make a new
	// file entry for it, but there's no convenient way to do this with
	// PhabricatorFile right now. The storage will get shared, so the impact
	// here is negligible.
	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	$image_file = PhabricatorFile::newFromFileDownload(
	$image_uri,
	array(
	'name' => $name,
	'viewPolicy' => PhabricatorPolicies::POLICY_NOONE,
	));
	if ($image_file->isViewableImage()) {
	$image_file
	->setViewPolicy(PhabricatorPolicies::getMostOpenPolicy())
	->setCanCDN(true)
	->save();
	$account->setProfileImagePHID($image_file->getPHID());
	} else {
	$image_file->delete();
	}
	unset($unguarded);

	} catch (Exception $ex) {
	// Log this but proceed, it's not especially important that we
	// be able to pull profile images.
	phlog($ex);
	}
	}

	$this->willSaveAccount($account);

	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	$account->save();
	unset($unguarded);

	return $account;
	}

	public function getLoginURI() {
	$app = PhabricatorApplication::getByClass('PhabricatorAuthApplication');
	return $app->getApplicationURI('/login/'.$this->getProviderKey().'/');
	}

	public function getSettingsURI() {
	return '/settings/panel/external/';
	}

	public function getStartURI() {
	$app = PhabricatorApplication::getByClass('PhabricatorAuthApplication');
	$uri = $app->getApplicationURI('/start/');
	return $uri;
	}

	public function isDefaultRegistrationProvider() {
	return false;
	}

	public function shouldRequireRegistrationPassword() {
	return false;
	}

	public function newDefaultExternalAccount() {
	return $this->newExternalAccount();
	}

	protected function newExternalAccount() {
	$config = $this->getProviderConfig();
	$adapter = $this->getAdapter();

	return id(new PhabricatorExternalAccount())
	->setAccountType($adapter->getAdapterType())
	->setAccountDomain($adapter->getAdapterDomain())
	->setProviderConfigPHID($config->getPHID());
	}

	public function getLoginOrder() {
	return '500-'.$this->getProviderName();
	}

	protected function getLoginIcon() {
	return 'Generic';
	}

	public function newIconView() {
	return id(new PHUIIconView())
	->setSpriteSheet(PHUIIconView::SPRITE_LOGIN)
	->setSpriteIcon($this->getLoginIcon());
	}

	public function isLoginFormAButton() {
	return false;
	}

	public function renderConfigPropertyTransactionTitle(
	PhabricatorAuthProviderConfigTransaction $xaction) {

	return null;
	}

	public function readFormValuesFromProvider() {
	return array();
	}

	public function readFormValuesFromRequest(AphrontRequest $request) {
	return array();
	}

	public function processEditForm(
	AphrontRequest $request,
	array $values) {

	$errors = array();
	$issues = array();

	return array($errors, $issues, $values);
	}

	public function extendEditForm(
	AphrontRequest $request,
	AphrontFormView $form,
	array $values,
	array $issues) {

	return;
	}

	public function willRenderLinkedAccount(
	PhabricatorUser $viewer,
	PHUIObjectItemView $item,
	PhabricatorExternalAccount $account) {

	$account_view = id(new PhabricatorAuthAccountView())
	->setExternalAccount($account)
	->setAuthProvider($this);

	$item->appendChild(
	phutil_tag(
	'div',
	array(
	'class' => 'mmr mml mst mmb',
	),
	$account_view));
	}

	/**
	* Return true to use a two-step configuration (setup, configure) instead of
	* the default single-step configuration. In practice, this means that
	* creating a new provider instance will redirect back to the edit page
	* instead of the provider list.
	*
	* @return bool True if this provider uses two-step configuration.
	*/
	public function hasSetupStep() {
	return false;
	}

	/**
	* Render a standard login/register button element.
	*
	* The `$attributes` parameter takes these keys:
	*
	* - `uri`: URI the button should take the user to when clicked.
	* - `method`: Optional HTTP method the button should use, defaults to GET.
	*
	* @param AphrontRequest HTTP request.
	* @param string Request mode string.
	* @param map Additional parameters, see above.
	* @return wild Log in button.
	*/
	protected function renderStandardLoginButton(
	AphrontRequest $request,
	$mode,
	array $attributes = array()) {

	PhutilTypeSpec::checkMap(
	$attributes,
	array(
	'method' => 'optional string',
	'uri' => 'string',
	'sigil' => 'optional string',
	));

	$viewer = $request->getUser();
	$adapter = $this->getAdapter();

	if ($mode == 'link') {
	$button_text = pht('Link External Account');
	} else if ($mode == 'refresh') {
	$button_text = pht('Refresh Account Link');
	} else if ($mode == 'invite') {
	$button_text = pht('Register Account');
	} else if ($this->shouldAllowRegistration()) {
	$button_text = pht('Log In or Register');
	} else {
	$button_text = pht('Log In');
	}

	$icon = id(new PHUIIconView())
	->setSpriteSheet(PHUIIconView::SPRITE_LOGIN)
	->setSpriteIcon($this->getLoginIcon());

	$button = id(new PHUIButtonView())
	->setSize(PHUIButtonView::BIG)
	->setColor(PHUIButtonView::GREY)
	->setIcon($icon)
	->setText($button_text)
	->setSubtext($this->getProviderName());

	$uri = $attributes['uri'];
	$uri = new PhutilURI($uri);
	$params = $uri->getQueryParamsAsPairList();
	- $uri->setQueryParams(array());
	+ $uri->removeAllQueryParams();

	$content = array($button);

	foreach ($params as $pair) {
	list($key, $value) = $pair;
	$content[] = phutil_tag(
	'input',
	array(
	'type' => 'hidden',
	'name' => $key,
	'value' => $value,
	));
	}

	$static_response = CelerityAPI::getStaticResourceResponse();
	$static_response->addContentSecurityPolicyURI('form-action', (string)$uri);

	foreach ($this->getContentSecurityPolicyFormActions() as $csp_uri) {
	$static_response->addContentSecurityPolicyURI('form-action', $csp_uri);
	}

	return phabricator_form(
	$viewer,
	array(
	'method' => idx($attributes, 'method', 'GET'),
	'action' => (string)$uri,
	'sigil' => idx($attributes, 'sigil'),
	),
	$content);
	}

	public function renderConfigurationFooter() {
	return null;
	}

	public function getAuthCSRFCode(AphrontRequest $request) {
	$phcid = $request->getCookie(PhabricatorCookies::COOKIE_CLIENTID);
	if (!strlen($phcid)) {
	throw new AphrontMalformedRequestException(
	pht('Missing Client ID Cookie'),
	pht(
	'Your browser did not submit a "%s" cookie with client state '.
	'information in the request. Check that cookies are enabled. '.
	'If this problem persists, you may need to clear your cookies.',
	PhabricatorCookies::COOKIE_CLIENTID),
	true);
	}

	return PhabricatorHash::weakDigest($phcid);
	}

	protected function verifyAuthCSRFCode(AphrontRequest $request, $actual) {
	$expect = $this->getAuthCSRFCode($request);

	if (!strlen($actual)) {
	throw new Exception(
	pht(
	'The authentication provider did not return a client state '.
	'parameter in its response, but one was expected. If this '.
	'problem persists, you may need to clear your cookies.'));
	}

	if (!phutil_hashes_are_identical($actual, $expect)) {
	throw new Exception(
	pht(
	'The authentication provider did not return the correct client '.
	'state parameter in its response. If this problem persists, you may '.
	'need to clear your cookies.'));
	}
	}

	public function supportsAutoLogin() {
	return false;
	}

	public function getAutoLoginURI(AphrontRequest $request) {
	throw new PhutilMethodNotImplementedException();
	}

	protected function getContentSecurityPolicyFormActions() {
	return array();
	}

	}
	diff --git a/src/applications/files/controller/PhabricatorFileDataController.php b/src/applications/files/controller/PhabricatorFileDataController.php
	index dd5e0adb7d..8ceb1e7907 100644
	--- a/src/applications/files/controller/PhabricatorFileDataController.php
	+++ b/src/applications/files/controller/PhabricatorFileDataController.php
	@@ -1,227 +1,227 @@
	<?php

	final class PhabricatorFileDataController extends PhabricatorFileController {

	private $phid;
	private $key;
	private $file;

	public function shouldRequireLogin() {
	return false;
	}

	public function shouldAllowPartialSessions() {
	return true;
	}

	public function handleRequest(AphrontRequest $request) {
	$viewer = $request->getViewer();
	$this->phid = $request->getURIData('phid');
	$this->key = $request->getURIData('key');

	$alt = PhabricatorEnv::getEnvConfig('security.alternate-file-domain');
	$base_uri = PhabricatorEnv::getEnvConfig('phabricator.base-uri');
	$alt_uri = new PhutilURI($alt);
	$alt_domain = $alt_uri->getDomain();
	$req_domain = $request->getHost();
	$main_domain = id(new PhutilURI($base_uri))->getDomain();

	$request_kind = $request->getURIData('kind');
	$is_download = ($request_kind === 'download');

	if (!strlen($alt) \|\| $main_domain == $alt_domain) {
	// No alternate domain.
	$should_redirect = false;
	$is_alternate_domain = false;
	} else if ($req_domain != $alt_domain) {
	// Alternate domain, but this request is on the main domain.
	$should_redirect = true;
	$is_alternate_domain = false;
	} else {
	// Alternate domain, and on the alternate domain.
	$should_redirect = false;
	$is_alternate_domain = true;
	}

	$response = $this->loadFile();
	if ($response) {
	return $response;
	}

	$file = $this->getFile();

	if ($should_redirect) {
	return id(new AphrontRedirectResponse())
	->setIsExternal(true)
	->setURI($file->getCDNURI($request_kind));
	}

	$response = new AphrontFileResponse();
	$response->setCacheDurationInSeconds(60 * 60 * 24 * 30);
	$response->setCanCDN($file->getCanCDN());

	$begin = null;
	$end = null;

	// NOTE: It's important to accept "Range" requests when playing audio.
	// If we don't, Safari has difficulty figuring out how long sounds are
	// and glitches when trying to loop them. In particular, Safari sends
	// an initial request for bytes 0-1 of the audio file, and things go south
	// if we can't respond with a 206 Partial Content.
	$range = $request->getHTTPHeader('range');
	if (strlen($range)) {
	list($begin, $end) = $response->parseHTTPRange($range);
	}

	if (!$file->isViewableInBrowser()) {
	$is_download = true;
	}

	$request_type = $request->getHTTPHeader('X-Phabricator-Request-Type');
	$is_lfs = ($request_type == 'git-lfs');

	if (!$is_download) {
	$response->setMimeType($file->getViewableMimeType());
	} else {
	$is_post = $request->isHTTPPost();
	$is_public = !$viewer->isLoggedIn();

	// NOTE: Require POST to download files from the primary domain. If the
	// request is not a POST request but arrives on the primary domain, we
	// render a confirmation dialog. For discussion, see T13094.

	// There are two exceptions to this rule:

	// Git LFS requests can download with GET. This is safe (Git LFS won't
	// execute files it downloads) and necessary to support Git LFS.

	// Requests with no credentials may also download with GET. This
	// primarily supports downloading files with `arc download` or other
	// API clients. This is only "mostly" safe: if you aren't logged in, you
	// are likely immune to XSS and CSRF. However, an attacker may still be
	// able to set cookies on this domain (for example, to fixate your
	// session). For now, we accept these risks because users running
	// Phabricator in this mode are knowingly accepting a security risk
	// against setup advice, and there's significant value in having
	// API development against test and production installs work the same
	// way.

	$is_safe = ($is_alternate_domain \|\| $is_post \|\| $is_lfs \|\| $is_public);
	if (!$is_safe) {
	return $this->newDialog()
	->setSubmitURI($file->getDownloadURI())
	->setTitle(pht('Download File'))
	->appendParagraph(
	pht(
	'Download file %s (%s)?',
	phutil_tag('strong', array(), $file->getName()),
	phutil_format_bytes($file->getByteSize())))
	->addCancelButton($file->getURI())
	->addSubmitButton(pht('Download File'));
	}

	$response->setMimeType($file->getMimeType());
	$response->setDownload($file->getName());
	}

	$iterator = $file->getFileDataIterator($begin, $end);

	$response->setContentLength($file->getByteSize());
	$response->setContentIterator($iterator);

	// In Chrome, we must permit this domain in "object-src" CSP when serving a
	// PDF or the browser will refuse to render it.
	if (!$is_download && $file->isPDF()) {
	$request_uri = id(clone $request->getAbsoluteRequestURI())
	->setPath(null)
	->setFragment(null)
	- ->setQueryParams(array());
	+ ->removeAllQueryParams();

	$response->addContentSecurityPolicyURI(
	'object-src',
	(string)$request_uri);
	}

	return $response;
	}

	private function loadFile() {
	// Access to files is provided by knowledge of a per-file secret key in
	// the URI. Knowledge of this secret is sufficient to retrieve the file.

	// For some requests, we also have a valid viewer. However, for many
	// requests (like alternate domain requests or Git LFS requests) we will
	// not. Even if we do have a valid viewer, use the omnipotent viewer to
	// make this logic simpler and more consistent.

	// Beyond making the policy check itself more consistent, this also makes
	// sure we're consistent about returning HTTP 404 on bad requests instead
	// of serving HTTP 200 with a login page, which can mislead some clients.

	$viewer = PhabricatorUser::getOmnipotentUser();

	$file = id(new PhabricatorFileQuery())
	->setViewer($viewer)
	->withPHIDs(array($this->phid))
	->withIsDeleted(false)
	->executeOne();

	if (!$file) {
	return new Aphront404Response();
	}

	// We may be on the CDN domain, so we need to use a fully-qualified URI
	// here to make sure we end up back on the main domain.
	$info_uri = PhabricatorEnv::getURI($file->getInfoURI());


	if (!$file->validateSecretKey($this->key)) {
	$dialog = $this->newDialog()
	->setTitle(pht('Invalid Authorization'))
	->appendParagraph(
	pht(
	'The link you followed to access this file is no longer '.
	'valid. The visibility of the file may have changed after '.
	'the link was generated.'))
	->appendParagraph(
	pht(
	'You can continue to the file detail page to get more '.
	'information and attempt to access the file.'))
	->addCancelButton($info_uri, pht('Continue'));

	return id(new AphrontDialogResponse())
	->setDialog($dialog)
	->setHTTPResponseCode(404);
	}

	if ($file->getIsPartial()) {
	$dialog = $this->newDialog()
	->setTitle(pht('Partial Upload'))
	->appendParagraph(
	pht(
	'This file has only been partially uploaded. It must be '.
	'uploaded completely before you can download it.'))
	->appendParagraph(
	pht(
	'You can continue to the file detail page to monitor the '.
	'upload progress of the file.'))
	->addCancelButton($info_uri, pht('Continue'));

	return id(new AphrontDialogResponse())
	->setDialog($dialog)
	->setHTTPResponseCode(404);
	}

	$this->file = $file;

	return null;
	}

	private function getFile() {
	if (!$this->file) {
	throw new PhutilInvalidStateException('loadFile');
	}
	return $this->file;
	}

	}

File Metadata

Mime Type: text/x-diff
Expires: Thu, Feb 6, 4:56 PM (1 d, 12 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 34036
Default Alt Text: (63 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions