2011-01-24 15:52:35 -08:00
|
|
|
<?php
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Copyright 2011 Facebook, Inc.
|
|
|
|
|
*
|
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
|
*
|
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
*
|
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
|
* limitations under the License.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
final class PhabricatorFileURI {
|
|
|
|
|
|
|
|
|
|
public static function getViewURIForPHID($phid) {
|
Provide a setting which forces all file views to be served from an alternate
domain
Summary:
See D758, D759.
- Provide a strongly recommended setting which permits configuration of an
alternate domain.
- Lock cookies down better: set them on the exact domain, and use SSL-only if
the configuration is HTTPS.
- Prevent Phabriator from setting cookies on other domains.
This assumes D759 will land, it is not effective without that change.
Test Plan:
- Attempted to login from a different domain and was rejected.
- Logged out, logged back in normally.
- Put install in setup mode and verified it revealed a warning.
- Configured an alterate domain.
- Tried to view an image with an old URI, got a 400.
- Went to /files/ and verified links rendered to the alternate domain.
- Viewed an alternate domain file.
- Tried to view an alternate domain file without the secret key, got a 404.
Reviewers: andrewjcg, erling, aran, tuomaspelkonen, jungejason, codeblock
CC: aran
Differential Revision: 760
2011-08-01 22:24:00 -07:00
|
|
|
|
|
|
|
|
// TODO: Get rid of this class, the advent of the applet attack makes the
|
|
|
|
|
// tiny optimization it represented effectively obsolete.
|
|
|
|
|
|
|
|
|
|
$file = id(new PhabricatorFile())->loadOneWhere(
|
|
|
|
|
'phid = %s',
|
|
|
|
|
$phid);
|
|
|
|
|
if ($file) {
|
|
|
|
|
return $file->getViewURI();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return null;
|
2011-01-24 15:52:35 -08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
}
|