Manual:Configuring file uploads
From MediaWiki.org
MediaWiki supports uploading and integration of media files. This page describes the technical aspects of this feature, see Manual:Image Administration and Help:Images for general usage information.
Starting from MediaWiki version 1.1, uploads are initially disabled by default, due to security considerations. Uploads can be enabled via a configuration setting, although it is recommended that you check certain prerequisites first:
Contents |
[edit] Prerequisites
[edit] Make sure uploads are enabled in PHP
The following needs to be set in php.ini (which may be located somewhere like /etc/php/php.ini, /etc/php4/php.ini, /usr/local/lib/php.ini or on Win32 C:\Windows\php.ini):
file_uploads = On
If this is not set, no PHP scripts can use the upload functions, and MediaWiki's uploads will not be enabled.
If the open_basedir directive is set, it must include both the destination upload folder in your MediaWiki installation ("{$IP}/images") and the 'upload_tmp_dir' folder (default system folder if not set). The addition of the 'upload_tmp_dir' can avoid messages like "Could not find file "/var/tmp/php31aWnF" (where in this example the 'upload_tmp_dir' is '/var/tmp'). Read more about PHP file uploads at File upload basics and in particular move_uploaded_file.
Note: The formal value for the variable is a boolean expression. PHP treats each string not recognised as a False value as true, hence the often used "on" value yields the same result.
[edit] Check Apache aliases
Some Apache configurations have the following alias set in httpd.conf:
Alias /images/ /usr/share/images/ #Fixed in Apache 02:16, 2 June 2008 (UTC)
If this is the case, either
- remove this alias
or
- How to test this? if you do not have access to the httpd.conf file of the web server?
- Either ask your webserver admin or just try it, a commercial webhoster will have the above line disabled in most cases.
[edit] Check directory security
The upload directory needs to be configured so that it is not possible for an end user to upload and execute other scripts, which could then exploit access to your web directory and damage your wiki or web site.
Set the /images folder (or the /uploads folder in previous versions) to have permission "755":
- User can read, write and execute;
- Group can read and execute;
- World can read and execute.
If using safe_mode, make sure the directory is owned by the user used for running the php script (that is, the apache user or, in case of suphp, the script owner).
If using SELinux, make sure to adjust the ACLs accordingly (see there).
If using suphp, make sure the umask is set to 0022 (or less) in /etc/suphp.conf.
[edit] Setting uploads on/off
[edit] 1.5 upwards
In MediaWiki version 1.5 and later, the attribute to be set resides in LocalSettings.php and is as follows:
$wgEnableUploads = true; # Enable uploads
This enables uploads, as one might expect. To disable them, set the attribute to false:
$wgEnableUploads = false; # Disable uploads
[edit] Pre-1.5
In older versions of the software, the attribute to be set resides in LocalSettings.php, but is backwards, i.e. $wgDisableUploads. The default is as shown:
$wgDisableUploads = true; # Disable uploads
Invert the value to enable uploads:
$wgDisableUploads = false; # Enable uploads
[edit] Upload permissions
Per default, all registered users can upload files. To restrict this, you have to change Manual:$wgGroupPermissions:
- To prevent normal users from uploading files:
$wgGroupPermissions['user']['upload'] = false; - To create a special group called "uploadaccess", and allow members of that group to upload files:
$wgGroupPermissions['uploadaccess']['upload'] = true; - To allow "autoconfirmed" (non-newbie) users to upload files:
$wgGroupPermissions['autoconfirmed']['upload'] = true;
The right to replace existing files is handled by an extra permission, called reupload:
- To prevent normal users from overriding existing files:
$wgGroupPermissions['user']['reupload'] = false; - To allow "autoconfirmed" (non-newbie) users to replace existing files:
$wgGroupPermissions['autoconfirmed']['reupload'] = true;
See Manual:User rights for details on user rights, and Manual:Preventing access for more information about restricting access.
[edit] Configuring file types
You can add to $wgFileExtensions to allow uploads of other desired file types. For example, you can change the $wgFileExtensions line to look something like
$wgFileExtensions = array('png', 'gif', 'jpg', 'jpeg', 'doc', 'xls', 'mpp', 'pdf', 'ppt', 'tiff', 'bmp', 'docx', 'xlsx', 'pptx', 'ps');
or
$wgFileExtensions = array_merge($wgFileExtensions, array('doc', 'xls', 'mpp', 'pdf'));
or
# Add new types to the existing list from DefaultSettings.php $wgFileExtensions[] = 'doc'; $wgFileExtensions[] = 'xls'; $wgFileExtensions[] = 'pdf'; $wgFileExtensions[] = 'mpp';
However, certain file extensions are blacklisted ($wgFileBlacklist) and cannot be uploaded even if added to $wgFileExtensions. In addition, $wgMimeTypeBlacklist prevents certain file types based on MIME type; .zip files, for example, are prohibited based on MIME type (as of MediaWiki version 1.14).
You can also set $wgStrictFileExtensions
$wgStrictFileExtensions = false;
to allow most types of file to be uploaded. However, blacklisted filetypes and MIME types will still not be permitted.
If you are getting the error "The file is corrupt or has an incorrect extension", make sure mime type detection is working properly.
If you decide to allow any kind of file, make sure your mime detection is working and think about enabling virus scans for uploads.
[edit] Logon
By default anonymous uploads are not allowed. You must register and logon before the upload file option appears in the toolbox.
[edit] Thumbnailing
For information about automatic rendering/thumbnailing of images, see Manual:Image_thumbnailing, and/or Manual:Image_Administration#Image_thumbnailing. For problems with thumbnailing, see Image Thumbnails not working and/or appearing.
[edit] Set maximum size for file uploads
Per default, PHP allows uploaded files to be no more than 2 megabytes large. If you want to upload even larger files, change in the config file php.ini the post_max_size[1] and upload_max_filesize[2] parameters. This may require root access to the server - if you are on a shared host, contact your server administrator. The location of the php.ini file varies on the distribution you are using. Try e.g., "locate php.ini", or better yet, just "php -i" to find the location of your config file. Your web server may impose further limits on the size of files allowed for upload. For Apache, one of the relevant settings is LimitRequestBody[3].
Note: You may need to restart Apache or IIS after altering your PHP or web server configuration.
MediaWiki itself issues a warning if you try to upload files larger than what is specified by $wgUploadSizeWarning option. This is independent of the hard limit imposed by PHP. MediaWiki also has a $wgMaxUploadSize option, but that is currently not enforced for local file uploads. This is not enforced for normal uploads, as for this upload method the only way of restricting the upload size is through the use of modifying the php configuration, or utilising JavaScript on the client side to check the file size before it is uploaded. If JavaScript is used to check the file size, and disabled it will still upload using the Normal Upload feature.
[edit] Uploading directly from a URL ("Sideloading")
If you want to allow a user to directly upload files from a URL, instead of from a file on their local computer, set $wgAllowCopyUploads = true. On the upload form, you will then see an additional field for the URL, below the usual filename field. The URL field is greyed out per default, but can be activated by activating the radiobutton (checkbox) to the left of the field.
In order to use this feature, users must have the user right upload_by_url, which is granted only to sysops per default. To allow this to normal users, set $wgGroupPermissions['user']['upload_by_url'] = true. Keep in mind that allowing uploads directly from an arbitrary location on the web makes it easier to upload random, unwanted material, and it might be misunderstood as an invitation to upload anything that people might come across on the web.
Note: PHP's cURL support must be enabled to support this feature.
[edit] Undeleting images
Undeleting images is possible as an option since MediaWiki 1.8, and enabled per default since MediaWiki 1.11.
Prior to MediaWiki 1.11, you can enable undeletion of images by setting $wgSaveDeletedFiles = true. Since version 1.11, the behavior is controlled by $wgFileStore, and deleted files are per default stored in $wgUploadDirectory/deleted.
[edit] See also
- Manual:Configuration settings#Uploads for a list of all configuration variables related to file uploads
- Category:Upload variables - similar list as a category (ordered alphabetically)
[edit] References
- ↑ post-max-size, PHP Core Manual.
- ↑ upload-max-filesize, PHP Core Manual.
- ↑ LimitRequestBody, Apache manual
