Manual:Configuring file uploads/ja

MediaWikiはメディアファイルのアップロードと統合をサポートします. このページはこの機能の技術的な面を説明します. 一般的な使い方の情報についてはManual:Image administration/jaとHelp:Images/jaをご覧下さい.

MediaWikiバージョン 1.1から始まりますが、セキュリティを考慮するため、アップロードはデフォルトでは無効になっています. アップロードはコンフィギュレーション設定で有効にすることが出来ますが、まずは前提条件を確認することをお勧めします:

アップロードがPHPで有効になっていることを確認する
次の項目はphp.iniで設定する必要があります(/etc/php/php.ini、/etc/php4/php.ini、/usr/local/lib/php.iniもしくはWindowsの場合 C:\Windows\php.iniのような場所に設置されています).

設定されていない場合、PHPスクリプトはアップロード機能を使用できないのでMediaWikiのアップロード機能も有効になりません.

If the open_basedir directive is set, it must include both the destination upload folder in your MediaWiki installation ("{$IP}/images") and the 'upload_tmp_dir' folder (default system folder if not set). The addition of the 'upload_tmp_dir' can avoid messages like "Could not find file "/var/tmp/php31aWnF" (where in this example the 'upload_tmp_dir' is '/var/tmp'). Read more about PHP file uploads at File upload basics and in particular move_uploaded_file.

Note: The formal value for the variable is a boolean expression. PHP treats each string not recognised as a False value as true, hence the often used "on" value yields the same result.

Check for Windows and IIS users
Set %SystemRoot%\TEMP to have permissions for the Internet Guest Account (IUSR_MachineName, or IUSR for IIS 7+): Read, write and execute;

ディレクトリのセキュリティを調査する
アップロードディレクトリはend userのためにアップロードとウェブディレクトリに不正なアクセスをしてwikiもしくはウェブサイトに損害を与える可能性のある他のスクリプトを実行できないように設定することが必要です.


 * どのunixセキュリティ設定をすればよいのか？ chmod755？　そしてWindowsは？


 * User can read, write and execute;
 * Group can read and execute;
 * World can read and execute.

If using safe_mode, make sure the directory is owned by the user used for running the php script (that is, the apache user or, in case of suphp, the script owner).

If using CentOS 6 or Mageia the owner:group in the chown command should be "apache:apache" instead of "www-data:www-data".

If using SELinux, make sure to adjust the ACLs accordingly (see there).

If using suphp, make sure the umask is set to 0022 (or less) in /etc/suphp.conf.

If you don't want a public user to list your images folder, an option is to set this up in your apache configuration:
 * Restrict directory listing on images folder

.htaccess ファイルの確認
The images directory in the MediaWiki installation folder contains an .htaccess file with some configurations on it. The goal of this file is to make the upload folder more secure, and if you place your upload directory somewhere else, it's recommended to also copy the .htaccess file to the new location, or apply that configuration on the server directly. However, some of those configurations may cause conflicts or errors, depending on how the server is configured.

Some things to take into account:


 * If the server doesn't allow to set or override directives in .htaccess files, accessing any file under that folder may result in a generic "HTTP 500 error". If that's the case, you should comment-out the lines, and apply those directives directly on the server configuration files. The directives that are most likely causing the problems are  —which prevents HTML and PHP files from being served as HTML—, and   —which would prevent PHP files from being parsed and executed on the server as such.
 * Before MediaWiki 1.27, if you have a custom 404 handler to generate thumbnails with the script, the rewrite rules in this .htaccess file may disable previous rules, because it lacks the   option.

アップロードをon/offに設定する
MediaWiki バージョン 1.5以降は、設定する属性はLocalSettings.phpに存在し、内容は以下の通りです:

期待通りこれはアップロードを有効にします. 無効にするためにはこの属性をfalseに設定します:

ソフトウェアの古いバージョンでは、設定する属性はLocalSettings.phpに存在しますが、逆転しています、すなわち$wgDisableUploadsです. デフォルトは次の通りです:

アップロードを有効にするために値を反転させる:

Using a central repository
InstantCommons is a feature, enabled with a configuration change, which gives you immediate access to the millions of free (freely licensed) files in Wikimedia Commons.

アップロードの権限
Per default, all registered users can upload files. To restrict this, you have to change $wgGroupPermissions:

$wgGroupPermissions['user']['upload'] = false; $wgGroupPermissions['uploadaccess']['upload'] = true; $wgGroupPermissions['autoconfirmed']['upload'] = true;
 * To prevent normal users from uploading files:
 * To create a special group called "uploadaccess", and allow members of that group to upload files:
 * To allow "autoconfirmed" (non-newbie) users to upload files:

The right to replace existing files is handled by an extra permission, called reupload: $wgGroupPermissions['user']['reupload'] = false;</tt> $wgGroupPermissions['autoconfirmed']['reupload'] = true;</tt>
 * To prevent normal users from overriding existing files:
 * To allow "autoconfirmed" (non-newbie) users to replace existing files:

If a ForeignFileRepo is set, the right to replace those files locally is handled by an special permission, called reupload-shared</tt>: $wgGroupPermissions['user']['reupload-shared'] = false;</tt> $wgGroupPermissions['autoconfirmed']['reupload-shared'] = true;</tt>
 * To prevent normal users from overriding filerepo files locally:
 * To allow "autoconfirmed" (non-newbie) users to replace filerepo files locally:

See Manual:User rights for details on user rights, and Manual:Preventing access for more information about restricting access.

ファイルタイプを設定する
望むファイルのタイプのアップロードをできるようにするために$wgFileExtensionsに追加することが出来ます 含まれていないのであれば$wgFileExtensionsの行に次のように追加されます もしくは もしくは ブラックリストに掲載されているファイルタイプの制限があります. To upload files with blacklisted extensions, you must modify the blacklist. For instance, to allow users to upload executables: In addition, $wgMimeTypeBlacklist prevents certain file types based on MIME type; .zip files, for example, are prohibited based on MIME type (MediaWiki version 1.14 up to 1.17).

You can also set $wgStrictFileExtensions to allow most types of file to be uploaded. However, blacklisted filetypes and MIME types will still not be permitted.

If you are getting the error "The file is corrupt or has an incorrect extension", make sure mime type detection is working properly.

If you decide to allow any kind of file, make sure your mime detection is working and think about enabling virus scans for uploads.

To enable zip extension (tested in MediaWiki v1.19.23) the following will be necessary in the LocalSettings.php file:

ログイン
By default anonymous uploads are not allowed. You must register and logon before the upload file option appears in the toolbox.

サムネイル
自動的な画像のレンダリング/サムネイリングの情報については、Manual:Image administration/jaをご覧下さい For problems with thumbnailing, see Image Thumbnails not working and/or appearing.

If the file is not visual (like an Image or Video) a fileicon is used instead. These are generated by the  function in the File class in the FileRepo group. Icons stored in " " in a " "-format.

ファイルのアップロードのための最大サイズを設定する
デフォルトでは、PHPはファイルのアップロードは2MBまでしか許可しません. さらに大きなファイルをアップロードしたい場合、post_max_sizeとupload_max_filesizeパラメータを変更して下さい.
 * post_max_size, 8 megabytes large by default
 * upload_max_filesize, 2 megabytes large by default

これはサーバにアクセスするroot権限が必要です - 共有サーバ上にある場合、サーバの管理者に連絡をして下さい. Ubuntu 向け:

php.iniファイルの位置は使用しているディストリビューションによって異なります. The location of the php.ini file varies on the distribution you are using. (Try "locate php.ini" or "php -i" to find the location of your config file.)
 * Locating the php.ini file

It is important to change the php.ini file in the apache2 folder. For example, there may be a core default php.ini at /etc/php5/cli/php.ini as well as one at /etc/php5/apache2/php.ini. If you are using mod_php (most common), it is the php.ini file in /etc/php5/apache2 that is important to change. For php-fastcgi, edit /etc/php5/cgi/php.ini.

If you have more than one website hosted on a server and want to change only for Mediawiki, insert into your /etc/apache2/sites-enabled/your_wiki_site.com inside <Virtual Host>:
 * Multiple websites hosted on a server

Both above settings also work in a .htaccess file if your site uses mod_php. If your site uses PHP >= 5.3 and allows it, you can place php.ini directives in .user.ini files instead.


 * web server limits

Your web server may impose further limits on the size of files allowed for upload. For Apache, one of the relevant settings is LimitRequestBody. For Nginx, client_max_body_size is the relevant setting. For Lighttpd, server.max-request-size is what may need modification.

You may need to restart Apache or IIS after altering your PHP or web server configuration. (sudo /etc/init.d/apache2 restart in Linux, for example.)

You may also need to restart php5-fpm after altering your PHP (or ngingx server?) configuration. (sudo /etc/init.d/php5-fpm restart in Linux, for example.)


 * uploading too large of files warning

MediaWikiは$wgUploadSizeWarningオプションよりも大きなファイルをアップロードしようとすると警告を発します. これはPHPによる制限とは独立しています. MediaWiki also has a $wgMaxUploadSize option, but that is currently not enforced for normal uploads (when uploading a local file). The only way of restricting the upload size is through the use of modifying the php configuration.

Temporary changes to upload limits (when using multiple wikis on a farm, for example) can be altered by adding the lines:
 * temporary upload limits

to the MediaWiki LocalSettings.php configuration file for each wiki. In this example the PHP limit is set at 50 Mb. Note that these settings will not override the maximum settings set above (since the core php.ini and apache2 php.ini files set the absolute maximum). This method sets maximums that are less than the absolute maximum.


 * IIS7 upload limit

By default, IIS7 on Windows 2008 allows only 30MB to be uploaded via a web application. Larger files will return a 404 error after the upload. If you have this problem, you can solve it by increasing the maximum file size by adding the following code to <system.webServer> in the web.config file:

<requestFiltering> <requestLimits maxAllowedContentLength="50000000" /> </requestFiltering>

With the above maxAllowedContentLength, users can upload files that are 50,000,000 bytes (50 MB) in size. This setting will work immediately without restarting IIS services. The web.config file is located in the root directory of your web site.

To allow uploading files up to 2G:

add the following lines to LocalSettings.php:

Also, modify the following lines in PHP.INI:

In the IIS web.config file, override the value of maxRequestLength. For example, the following entry in web.config allows files that are less than or equal to 2 gigabytes (GB) to be uploaded:

<httpRuntime maxRequestLength="2097151" executionTimeout="18000"/>

With IIS 7, you also need to configure it to allow large uploads. This is found by clicking “Request Filtering > Edit Feature Settings” in the IIS section in the middle of the window. Set the ”Maximum allowed content length (Bytes)” field to 2147482624. If you don’t see "Request Filtering" in the IIS section, it needs enabled via Internet Information Services > World Wide Web Services > Security in the "Turn Windows features on or off" area in Control Panel.

If the above tip does not enable large uploads, then open a command prompt and execute this command as well:

%windir%\system32\inetsrv\appcmd set config -section:requestFiltering -requestLimits.maxAllowedContentLength: 2147482624

Java JAR のアップロードの許可
By default, MediaWiki will scan all uploads that appear to be ZIP archives and reject any that contain Java .class files. This is a security measure to prevent users uploading a malicious Java applet. For non-public sites only, use the following to disable this check:

This setting can be used as a work around for allowing mimetypes to be accepted indiscriminately. For example, if you attempt to upload a .doc file created by Word 2007, no matter the ext list you provide and mimetype checking you invoke or prohibit, you will receive the message:


 * The file is a corrupt or otherwise unreadable ZIP file. It cannot be properly checked for security.

.doc files saved by Word 2007 (and possibly later versions) contain a small embedded ZIP archive storing metadata that is not representable in the binary .doc format as used by earlier versions of Word. This embedded ZIP data confuses the Java archive scanner, causing the .doc file to be rejected. Files in the newer .docx file format are valid ZIP archives in their entirety, and can be uploaded successfully without setting.

Uploading directly from a URL ("Sideloading")
If you want to allow a user to directly upload files from a URL, instead of from a file on their local computer, set $wgAllowCopyUploads = true</tt>.

By default, upload by URL are only possible using the API (or extensions such as UploadWizard). To make the option usable from Special:Upload, you need to set $wgCopyUploadsFromSpecialUpload to true as well. On the upload form, you will then see an additional field for the URL, below the usual filename field. The URL field is greyed out per default, but can be activated by activating the radiobutton (checkbox) to the left of the field.

In order to use this feature, users must have the user right upload_by_url</tt>. This right was granted to sysops by default until MediaWiki 1.20 but it now needs to be granted explicitly. To allow this to normal users, set Keep in mind that allowing uploads directly from an arbitrary location on the web makes it easier to upload random, unwanted material, and it might be misunderstood as an invitation to upload anything that people might come across on the web.

PHP's cURL support must be enabled to support this feature. Configure your PHP when installing using the --with-curl option. If your server is accessing internet through a proxy then $wgHTTPProxy</tt> needs to be set accordingly. Either you supply it directly or, if your server supplies the environment variable "http_proxy" see your phpinfo, then you could use the following code in your LocalSettings.php:

削除した画像の復元
Undeleting images is possible as an option since MediaWiki 1.8, and enabled by default since MediaWiki 1.11.

Prior to MediaWiki 1.11, you can enable undeletion of images by setting $wgSaveDeletedFiles = true. Since version 1.11, the behavior is controlled by $wgFileStore, and deleted files are per default stored in $wgUploadDirectory/deleted. Since version 1.17, $wgFileStore has been deprecated and should be used instead.

Mass uploading
A number of tools are available for uploading multiple files in one go rather than each file separately:

アップロード ディレクトリ
Whenever an image is uploaded, several things are created:


 * 1) An article in the file namespace with the name of the file, e.g. File:MyPicture.png. This page is stored and can be edited like any other page.
 * 2) The file itself is stored into the folder on the file system, which is configured in  or into one if its subfolders (see below).
 * 3) If necessary and thumbnailing is available, thumbnailed versions of the file will be created when necessary (such as for the usage on the file description page. These are stored in the thumb directory of the image directory, in a separate directory for each main file.

If $wgHashedUploadDirectory is enabled (by default), MediaWiki creates several subdirectories in the images directory.

If $wgHashedUploadDirectory</tt> is set to true</tt>, uploaded files will be distributed into sub-directories of $wgUploadDirectory based on the first two characters of the md5 hash of the filename. (e.g. $IP/images/a/ab/foo.jpg) Creation of such subdirectories is handled automatically. This is used to avoid having too many files in one folder because some filesystems don't perform well with large numbers of files in one folder.

If you only maintain a small wiki with few uploaded images, you could turn this off by setting $wgHashedUploadDirectory = false</tt>, all images are uploaded in $wgUploadDirectory itself. (e.g. $IP/images/foo.jpg)

Multiwiki sites
Not doing so will mysteriously break image uploads.
 * Make sure you've changed the site location in LocalSettings.php from, e.g. /var/lib/mediawiki to wherever your installation is, and created a writeable images directory (most of the rest can be symlinked).

Known problems on Windows
Running MediaWiki on Windows server has some restrictions in allowed filenames, due to a PHP bug. PHP can't handle filenames with non-ascii characters on it correctly, and MediaWiki will refuse to upload files containing such characters to prevent broken uploads, with the message .

Known problems with database names having non-alphanumeric characters
If $wgDBname contains non-alphanumeric characters, uploads may fail with errors like Could not create directory "mwstore://local-backend/local-public/&lt;path&gt;". . This is caused by an internal check for valid container name for file backend, but it's constructed using $wgDBname.

Since MediaWiki 1.26, it allows uploads when $wgDBname contains dots.

関連項目

 * Security section Upload security
 * Manual:Configuration settings for a list of all configuration variables related to file uploads
 * Category:Upload variables - similar list as a category (ordered alphabetically)
 * You see a blank page when trying to upload a file
 * Manual:Disabling file lock manager in case it's problematic in your installation