Hello once again,
After receiving a few pointers to the ImageMagic problem (see: MediaWiki-I Digest, Vol 16, Issue 21 (&22) it looks like it that I have solved the problem. This is what I did:
Brion and Ashar suggested that the appearance of both / and \ in the image path might cause the problem. It turned out not to be so. After digging into the Image.php file (in /includes) I found out that the escapeshellarg() command in line 450/451 in the renderThumb() function was the culprit. After outputing the $cmd to the debug log I noticed the pathname of the source and destination file of the image was enclosed in single quotes: i.e.
<snip> C:/convert.exe -quality 85 -background white -geometry 800 'c:\easyphp\www\mediawiki/images/b/b0/IMG_4028.JPG' 'c:\easyphp\www\mediawiki/images/thumb/c/c7/800px-IMG_4028.JPG' </snip>
Cutting and pasting this command in a dos-shell returned the "invalid input error" I noticed earlier in the Apache error-log. After manually removing the quotes the command executed as it should.
I now have removed the escapeshellarg() command from the syntax leaving the following code:
<snip> $cmd = $wgImageMagickConvertCommand . " -quality 85 -background white -geometry {$width} ". $this->imagePath . " " . $thumbPath; </snip>
instead of:
<snip> $cmd = $wgImageMagickConvertCommand . " -quality 85 -background white -geometry {$width} ". escapeshellarg($this->imagePath) . " " . escapeshellarg($thumbPath); </snip>
I realize that this is a sort of a hack, because the escapeshellarg() was put there on purpose (I think...), so it leaves me with a couple of questions:
1) why does escapeshellarg(string arg) add quotes around arg? (the PHP.net manual didn't make me wiser), is it a *nix thingy? (alas, I'm still using Windows)
2) What is (might be) the penalty for removing escapeshellarg() from the code, what is the rational behind it?
3) Is there a more cleaner way to fix this?
thanks for your time
Diederik Oudshoorn
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Diederik Oudshoorn wrote: | 1) why does escapeshellarg(string arg) add quotes around arg? (the | PHP.net manual didn't make me wiser), is it a *nix thingy? (alas, I'm | still using Windows)
Apparently escapeshellarg() doesn't do the right thing on Windows. We have a wfEscapeShellArg() wrapper function which is meant to fix this; did you try replacing escapeshellarg() with wfEscapeShellArg() as Tim suggested?
| 2) What is (might be) the penalty for removing escapeshellarg() from the | code, what is the rational behind it?
The danger is that a parameter may contain characters which have special meaning to the shell (or to the parameter-parsing code of the program on Windows where parameters are passed as a single string rather than an array of strings as on Unix). This could allow a malicious user to inject a different command than was intended, which may have serious security implications.
You may remember a couple months back a lot of sites were hacked via a bug in TWiki, where it didn't correctly validate text that was placed on the command line calling out to a search tool.
More prosaically, without proper escaping some filenames simply won't work right (eg, containing spaces or quotes or other semi-special chars).
- -- brion vibber (brion @ pobox.com)
mediawiki-l@lists.wikimedia.org