3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License as published by
5 * the Free Software Foundation; either version 2 of the License, or
6 * (at your option) any later version.
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 * GNU General Public License for more details.
13 * You should have received a copy of the GNU General Public License along
14 * with this program; if not, write to the Free Software Foundation, Inc.,
15 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
16 * http://www.gnu.org/copyleft/gpl.html
21 class PhpHttpRequest extends MWHttpRequest {
23 private $fopenErrors = [];
29 protected function urlToTcp( $url ) {
30 $parsedUrl = parse_url( $url );
32 return 'tcp://' . $parsedUrl['host'] . ':' . $parsedUrl['port'];
36 * Returns an array with a 'capath' or 'cafile' key
37 * that is suitable to be merged into the 'ssl' sub-array of
38 * a stream context options array.
39 * Uses the 'caInfo' option of the class if it is provided, otherwise uses the system
40 * default CA bundle if PHP supports that, or searches a few standard locations.
42 * @throws DomainException
44 protected function getCertOptions() {
47 if ( $this->caInfo ) {
48 $certLocations = [ 'manual' => $this->caInfo ];
49 } elseif ( version_compare( PHP_VERSION, '5.6.0', '<' ) ) {
50 // @codingStandardsIgnoreStart Generic.Files.LineLength
51 // Default locations, based on
52 // https://www.happyassassin.net/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/
53 // PHP 5.5 and older doesn't have any defaults, so we try to guess ourselves.
54 // PHP 5.6+ gets the CA location from OpenSSL as long as it is not set manually,
55 // so we should leave capath/cafile empty there.
56 // @codingStandardsIgnoreEnd
57 $certLocations = array_filter( [
58 getenv( 'SSL_CERT_DIR' ),
59 getenv( 'SSL_CERT_PATH' ),
60 '/etc/pki/tls/certs/ca-bundle.crt', # Fedora et al
61 '/etc/ssl/certs', # Debian et al
62 '/etc/pki/tls/certs/ca-bundle.trust.crt',
63 '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem',
64 '/System/Library/OpenSSL', # OSX
68 foreach ( $certLocations as $key => $cert ) {
69 if ( is_dir( $cert ) ) {
70 $certOptions['capath'] = $cert;
72 } elseif ( is_file( $cert ) ) {
73 $certOptions['cafile'] = $cert;
75 } elseif ( $key === 'manual' ) {
76 // fail more loudly if a cert path was manually configured and it is not valid
77 throw new DomainException( "Invalid CA info passed: $cert" );
85 * Custom error handler for dealing with fopen() errors.
86 * fopen() tends to fire multiple errors in succession, and the last one
87 * is completely useless (something like "fopen: failed to open stream")
88 * so normal methods of handling errors programmatically
89 * like get_last_error() don't work.
92 * @param string $errstr
94 public function errorHandler( $errno, $errstr ) {
95 $n = count( $this->fopenErrors ) + 1;
96 $this->fopenErrors += [ "errno$n" => $errno, "errstr$n" => $errstr ];
100 * @see MWHttpRequest::execute
104 public function execute() {
107 if ( is_array( $this->postData ) ) {
108 $this->postData = wfArrayToCgi( $this->postData );
111 if ( $this->parsedUrl['scheme'] != 'http'
112 && $this->parsedUrl['scheme'] != 'https' ) {
113 $this->status->fatal( 'http-invalid-scheme', $this->parsedUrl['scheme'] );
116 $this->reqHeaders['Accept'] = "*/*";
117 $this->reqHeaders['Connection'] = 'Close';
118 if ( $this->method == 'POST' ) {
119 // Required for HTTP 1.0 POSTs
120 $this->reqHeaders['Content-Length'] = strlen( $this->postData );
121 if ( !isset( $this->reqHeaders['Content-Type'] ) ) {
122 $this->reqHeaders['Content-Type'] = "application/x-www-form-urlencoded";
126 // Set up PHP stream context
129 'method' => $this->method,
130 'header' => implode( "\r\n", $this->getHeaderList() ),
131 'protocol_version' => '1.1',
132 'max_redirects' => $this->followRedirects ? $this->maxRedirects : 0,
133 'ignore_errors' => true,
134 'timeout' => $this->timeout,
135 // Curl options in case curlwrappers are installed
136 'curl_verify_ssl_host' => $this->sslVerifyHost ? 2 : 0,
137 'curl_verify_ssl_peer' => $this->sslVerifyCert,
140 'verify_peer' => $this->sslVerifyCert,
141 'SNI_enabled' => true,
142 'ciphers' => 'HIGH:!SSLv2:!SSLv3:-ADH:-kDH:-kECDH:-DSS',
143 'disable_compression' => true,
147 if ( $this->proxy ) {
148 $options['http']['proxy'] = $this->urlToTcp( $this->proxy );
149 $options['http']['request_fulluri'] = true;
152 if ( $this->postData ) {
153 $options['http']['content'] = $this->postData;
156 if ( $this->sslVerifyHost ) {
157 // PHP 5.6.0 deprecates CN_match, in favour of peer_name which
158 // actually checks SubjectAltName properly.
159 if ( version_compare( PHP_VERSION, '5.6.0', '>=' ) ) {
160 $options['ssl']['peer_name'] = $this->parsedUrl['host'];
162 $options['ssl']['CN_match'] = $this->parsedUrl['host'];
166 $options['ssl'] += $this->getCertOptions();
168 $context = stream_context_create( $options );
170 $this->headerList = [];
176 if ( $this->profiler ) {
177 $profileSection = $this->profiler->scopedProfileIn(
178 __METHOD__ . '-' . $this->profileName
183 $this->fopenErrors = [];
184 set_error_handler( [ $this, 'errorHandler' ] );
185 $fh = fopen( $url, "r", false, $context );
186 restore_error_handler();
189 // HACK for instant commons.
190 // If we are contacting (commons|upload).wikimedia.org
191 // try again with CN_match for en.wikipedia.org
192 // as php does not handle SubjectAltName properly
193 // prior to "peer_name" option in php 5.6
194 if ( isset( $options['ssl']['CN_match'] )
195 && ( $options['ssl']['CN_match'] === 'commons.wikimedia.org'
196 || $options['ssl']['CN_match'] === 'upload.wikimedia.org' )
198 $options['ssl']['CN_match'] = 'en.wikipedia.org';
199 $context = stream_context_create( $options );
205 $result = stream_get_meta_data( $fh );
206 $this->headerList = $result['wrapper_data'];
207 $this->parseHeader();
209 if ( !$this->followRedirects ) {
213 # Handle manual redirection
214 if ( !$this->isRedirect() || $reqCount > $this->maxRedirects ) {
217 # Check security of URL
218 $url = $this->getResponseHeader( "Location" );
220 if ( !Http::isValidURI( $url ) ) {
221 $this->logger->debug( __METHOD__ . ": insecure redirection\n" );
225 if ( $this->profiler ) {
226 $this->profiler->scopedProfileOut( $profileSection );
231 if ( $fh === false ) {
232 if ( $this->fopenErrors ) {
233 $this->logger->warning( __CLASS__
234 . ': error opening connection: {errstr1}', $this->fopenErrors );
236 $this->status->fatal( 'http-request-error' );
237 return Status::wrap( $this->status ); // TODO B/C; move this to callers
240 if ( $result['timed_out'] ) {
241 $this->status->fatal( 'http-timed-out', $this->url );
242 return Status::wrap( $this->status ); // TODO B/C; move this to callers
245 // If everything went OK, or we received some error code
246 // get the response body content.
247 if ( $this->status->isOK() || (int)$this->respStatus >= 300 ) {
248 while ( !feof( $fh ) ) {
249 $buf = fread( $fh, 8192 );
251 if ( $buf === false ) {
252 $this->status->fatal( 'http-read-error' );
256 if ( strlen( $buf ) ) {
257 call_user_func( $this->callback, $fh, $buf );
263 return Status::wrap( $this->status ); // TODO B/C; move this to callers