Safe mode - MediaWiki-l - lists.wikimedia.org

List overview All Threads
Download

Safe mode

case insensitive links

How to tweak xhtml_slim.pt?

Lorenzo Breda

8 Feb 2005 8 Feb '05

6:54 p.m.

On my website I must have the SafeMode on. Is there a way to upload files with the SafeMode on? Lorenzo Breda

Reply

Show replies by date

Jan Steinman

8 Feb 8 Feb

8:05 p.m.

New subject: [Mediawiki-l] Safe mode

On 8 Feb 2005, at 10:54, Lorenzo Breda wrote:

On my website I must have the SafeMode on. Is there a way to upload files with the SafeMode on?

Sorry to sound glib, but it wouldn't be "safe" then, would it? I think the only way to implement such a policy would be to hack the code. But keep in mind that since MediaWiki stores images in a database, allowing uploads possibly exposes you to SQL injection hacks. :::: Beware of the military-industrial complex. -- Dwight D. Eisenhower :::: Jan Steinman <http://www.Bytesmiths.com>

Reply

Evan Prodromou

9 Feb 9 Feb

11:39 a.m.

New subject: [Mediawiki-l] Safe mode

On Tue, 2005-08-02 at 12:05 -0800, Jan Steinman wrote:

But keep in mind that since MediaWiki stores images in a database, [...]

Don't keep that in mind; it's not true. Put that out of mind. MediaWiki stores some image metadata in the database, but the actual image blob is stored externally, in the "upload" dir. ~Evan -- Evan Prodromou <evan(a)wikitravel.org>

Reply

Jan Steinman

8:17 p.m.

New subject: [Mediawiki-l] Safe mode

On 9 Feb 2005, at 03:39, Evan Prodromou wrote:

On Tue, 2005-08-02 at 12:05 -0800, Jan Steinman wrote:

But keep in mind that since MediaWiki stores images in a database, [...]

Don't keep that in mind; it's not true. Put that out of mind. MediaWiki stores some image metadata in the database, but the actual image blob is stored externally, in the "upload" dir.

Oh, I thought that was just a cache, but I see that the mw_image table has no image data blob. (Mine is in the "images" directory, not upload. It appears to be a hashed directory structure, which is why I didn't notice my images were there.) Sorry for the misinformation! :::: My parents went on a long vacation in their SUV, :::: and all I got was a year in Iraq. :::: CORRECTION: 18 months, the last six against my will... :::: Jan Steinman <http://www.Bytesmiths.com/Item/99BA01>

Reply

Brion Vibber

8 Feb 8 Feb

8:27 p.m.

New subject: [Mediawiki-l] Safe mode

Lorenzo Breda wrote:

On my website I must have the SafeMode on. Is there a way to upload files with the SafeMode on?

Unless file uploads have also been disabled in your PHP configuration, then yes. But you have to go to some extra effort. In safe mode, your PHP scripts can't write to directories that are not owned by the user account that owns the script, and this creates the main problem with uploads. MediaWiki uses subdirectories in the upload area for generated thumbnails and to temporarily hold files for confirmation. Additionally, it divides up uploaded files into subdirectories based on the MD5 hash of the filename. This keeps the individual directories smaller and relatively manageable (remember MediaWiki was created for Wikipedia, which is a relatively large site). These subdirectories are created when they are needed, which usually means they are owned by the 'nobody' account or the web server's limited user ('web' or 'www' or 'apache' etc). Thus once the subdirectory is created, it can't actually put files in! To work around this, you have to create the subdirectories in images/ ahead of time, as your own account: thumb archive temp For the numbered hash subdirectories, you can either create them all or you can disable the subdivision and let all files go into one place. (This is not supported on 1.3 unless you backport the change; it is available in 1.4beta.) To skip turn it off, set $wgHashedUploadDirectory = false in your LocalSettings.php. To create them manually, they go in the pattern: N/NM where N and M are each hexadecimal number 0-f. You should end up with 16 top level subdirectories and 256 second-level subdirectories. Create these in each of images, images/thumb, images/archive, and images/temp. -- brion vibber (brion @ pobox.com)

Reply

John Yu

11:17 p.m.

New subject: [Mediawiki-l] Safe mode

Brion, Doesn't v1.4 has a new feature to use a flat directory for file uploading? -- John Brion Vibber wrote:

Lorenzo Breda wrote:

On my website I must have the SafeMode on. Is there a way to upload files with the SafeMode on?

Unless file uploads have also been disabled in your PHP configuration, then yes. But you have to go to some extra effort. In safe mode, your PHP scripts can't write to directories that are not owned by the user account that owns the script, and this creates the main problem with uploads. MediaWiki uses subdirectories in the upload area for generated thumbnails and to temporarily hold files for confirmation. Additionally, it divides up uploaded files into subdirectories based on the MD5 hash of the filename. This keeps the individual directories smaller and relatively manageable (remember MediaWiki was created for Wikipedia, which is a relatively large site). These subdirectories are created when they are needed, which usually means they are owned by the 'nobody' account or the web server's limited user ('web' or 'www' or 'apache' etc). Thus once the subdirectory is created, it can't actually put files in! To work around this, you have to create the subdirectories in images/ ahead of time, as your own account: thumb archive temp For the numbered hash subdirectories, you can either create them all or you can disable the subdivision and let all files go into one place. (This is not supported on 1.3 unless you backport the change; it is available in 1.4beta.) To skip turn it off, set $wgHashedUploadDirectory = false in your LocalSettings.php. To create them manually, they go in the pattern: N/NM where N and M are each hexadecimal number 0-f. You should end up with 16 top level subdirectories and 256 second-level subdirectories. Create these in each of images, images/thumb, images/archive, and images/temp. -- brion vibber (brion @ pobox.com) ------------------------------------------------------------------------ _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)Wikimedia.org http://mail.wikipedia.org/mailman/listinfo/mediawiki-l

-- John Yu ObjectMastery Pty. Ltd. Level 4, 854 Glenferrie Road, Hawthorn 3122, Australia. Tel: (+613) 8862 3222 Fax: (+613) 9818 7867

Reply

Brion Vibber

11:22 p.m.

New subject: [Mediawiki-l] Safe mode

John Yu wrote:

Doesn't v1.4 has a new feature to use a flat directory for file uploading?

Yes it does:

> you can disable the subdivision and let all files go into one place. > (This is not supported on 1.3 unless you backport the change; it is > available in 1.4beta.) To skip turn it off, set $wgHashedUploadDirectory > = false in your LocalSettings.php.

-- brion vibber (brion @ pobox.com)

Reply

John Yu

9 Feb 9 Feb

12:53 a.m.

New subject: [Mediawiki-l] Safe mode

Oops. I think I need some sleep. :-) -- John Brion Vibber wrote:

John Yu wrote:

Doesn't v1.4 has a new feature to use a flat directory for file uploading?

Yes it does:

you can disable the subdivision and let all files go into one place. (This is not supported on 1.3 unless you backport the change; it is available in 1.4beta.) To skip turn it off, set $wgHashedUploadDirectory = false in your LocalSettings.php.

-- brion vibber (brion @ pobox.com) ------------------------------------------------------------------------

Reply

7021

days inactive

7022

days old

mediawiki-l@lists.wikimedia.org

Manage subscription

7 comments

5 participants

tags (0)

participants (5)

Brion Vibber
Evan Prodromou
Jan Steinman
John Yu
Lorenzo Breda