From 8ea95b35cb7d995f11c567180e7f8080e794631e Mon Sep 17 00:00:00 2001 From: Matteo Scaramuccia Date: Sat, 28 Dec 2013 12:00:18 +0100 Subject: [PATCH] MDL-40379 Files Prevent mobile network providers from modifying content. --- lib/filelib.php | 16 ++++++++-------- lib/tests/filelib_test.php | 4 ++-- lib/weblib.php | 8 ++++---- theme/image.php | 4 ++-- theme/yui_image.php | 4 ++-- 5 files changed, 18 insertions(+), 18 deletions(-) diff --git a/lib/filelib.php b/lib/filelib.php index cb0047981fb..58b857d592e 100644 --- a/lib/filelib.php +++ b/lib/filelib.php @@ -2232,11 +2232,11 @@ function send_temp_file($path, $filename, $pathisstring=false) { header('Content-Disposition: attachment; filename="'.$filename.'"'); if (strpos($CFG->wwwroot, 'https://') === 0) { //https sites - watch out for IE! KB812935 and KB316431 - header('Cache-Control: private, max-age=10'); + header('Cache-Control: private, max-age=10, no-transform'); header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); header('Pragma: '); } else { //normal http - prevent caching at all cost - header('Cache-Control: private, must-revalidate, pre-check=0, post-check=0, max-age=0'); + header('Cache-Control: private, must-revalidate, pre-check=0, post-check=0, max-age=0, no-transform'); header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); header('Pragma: no-cache'); } @@ -2323,18 +2323,18 @@ function send_file($path, $filename, $lifetime = 'default' , $filter=0, $pathiss $private = ' private,'; } $nobyteserving = false; - header('Cache-Control:'.$private.' max-age='.$lifetime); + header('Cache-Control:'.$private.' max-age='.$lifetime.', no-transform'); header('Expires: '. gmdate('D, d M Y H:i:s', time() + $lifetime) .' GMT'); header('Pragma: '); } else { // Do not cache files in proxies and browsers $nobyteserving = true; if (strpos($CFG->wwwroot, 'https://') === 0) { //https sites - watch out for IE! KB812935 and KB316431 - header('Cache-Control: private, max-age=10'); + header('Cache-Control: private, max-age=10, no-transform'); header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); header('Pragma: '); } else { //normal http - prevent caching at all cost - header('Cache-Control: private, must-revalidate, pre-check=0, post-check=0, max-age=0'); + header('Cache-Control: private, must-revalidate, pre-check=0, post-check=0, max-age=0, no-transform'); header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); header('Pragma: no-cache'); } @@ -2490,17 +2490,17 @@ function send_stored_file($stored_file, $lifetime=86400 , $filter=0, $forcedownl if (isloggedin() and !isguestuser()) { $private = ' private,'; } - header('Cache-Control:'.$private.' max-age='.$lifetime); + header('Cache-Control:'.$private.' max-age='.$lifetime.', no-transform'); header('Expires: '. gmdate('D, d M Y H:i:s', time() + $lifetime) .' GMT'); header('Pragma: '); } else { // Do not cache files in proxies and browsers if (strpos($CFG->wwwroot, 'https://') === 0) { //https sites - watch out for IE! KB812935 and KB316431 - header('Cache-Control: private, max-age=10'); + header('Cache-Control: private, max-age=10, no-transform'); header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); header('Pragma: '); } else { //normal http - prevent caching at all cost - header('Cache-Control: private, must-revalidate, pre-check=0, post-check=0, max-age=0'); + header('Cache-Control: private, must-revalidate, pre-check=0, post-check=0, max-age=0, no-transform'); header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); header('Pragma: no-cache'); } diff --git a/lib/tests/filelib_test.php b/lib/tests/filelib_test.php index 7365a441311..26412ab168a 100644 --- a/lib/tests/filelib_test.php +++ b/lib/tests/filelib_test.php @@ -292,7 +292,7 @@ Connection: close HTTP/1.0 200 OK Server: Apache X-Lb-Nocache: true -Cache-Control: private, max-age=15 +Cache-Control: private, max-age=15, no-transform ETag: "4d69af5d8ba873ea9192c489e151bd7b" Content-Type: text/html Date: Thu, 08 Dec 2011 14:44:53 GMT @@ -308,7 +308,7 @@ EOF; HTTP/1.0 200 OK Server: Apache X-Lb-Nocache: true -Cache-Control: private, max-age=15 +Cache-Control: private, max-age=15, no-transform ETag: "4d69af5d8ba873ea9192c489e151bd7b" Content-Type: text/html Date: Thu, 08 Dec 2011 14:44:53 GMT diff --git a/lib/weblib.php b/lib/weblib.php index 141088b1c01..a97b5f3db98 100644 --- a/lib/weblib.php +++ b/lib/weblib.php @@ -1915,14 +1915,14 @@ function send_headers($contenttype, $cacheable = true) { } if ($cacheable) { - // Allow caching on "back" (but not on normal clicks) - @header('Cache-Control: private, pre-check=0, post-check=0, max-age=0'); + // Allow caching on "back" (but not on normal clicks). + @header('Cache-Control: private, pre-check=0, post-check=0, max-age=0, no-transform'); @header('Pragma: no-cache'); @header('Expires: '); } else { - // Do everything we can to always prevent clients and proxies caching + // Do everything we can to always prevent clients and proxies caching. @header('Cache-Control: no-store, no-cache, must-revalidate'); - @header('Cache-Control: post-check=0, pre-check=0', false); + @header('Cache-Control: post-check=0, pre-check=0, no-transform', false); @header('Pragma: no-cache'); @header('Expires: Mon, 20 Aug 1969 09:23:00 GMT'); @header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT'); diff --git a/theme/image.php b/theme/image.php index 556f966c447..f04c574d616 100644 --- a/theme/image.php +++ b/theme/image.php @@ -111,7 +111,7 @@ if ($rev > -1) { $mimetype = get_contenttype_from_ext($ext); header('HTTP/1.1 304 Not Modified'); header('Expires: '. gmdate('D, d M Y H:i:s', time() + $lifetime) .' GMT'); - header('Cache-Control: public, max-age='.$lifetime); + header('Cache-Control: public, max-age='.$lifetime.', no-transform'); header('Content-Type: '.$mimetype); header('Etag: "'.$etag.'"'); die; @@ -210,7 +210,7 @@ function send_cached_image($imagepath, $etag) { header('Last-Modified: '. gmdate('D, d M Y H:i:s', filemtime($imagepath)) .' GMT'); header('Expires: '. gmdate('D, d M Y H:i:s', time() + $lifetime) .' GMT'); header('Pragma: '); - header('Cache-Control: public, max-age='.$lifetime); + header('Cache-Control: public, max-age='.$lifetime.', no-transform'); header('Accept-Ranges: none'); header('Content-Type: '.$mimetype); header('Content-Length: '.filesize($imagepath)); diff --git a/theme/yui_image.php b/theme/yui_image.php index c88d33d0d2d..9a0d219875c 100644 --- a/theme/yui_image.php +++ b/theme/yui_image.php @@ -101,7 +101,7 @@ if (strpos($path, '/-1/') === false and (!empty($_SERVER['HTTP_IF_NONE_MATCH']) header('HTTP/1.1 304 Not Modified'); header('Last-Modified: '. gmdate('D, d M Y H:i:s', filemtime($imagepath)) .' GMT'); header('Expires: '. gmdate('D, d M Y H:i:s', time() + $lifetime) .' GMT'); - header('Cache-Control: public, max-age='.$lifetime); + header('Cache-Control: public, max-age='.$lifetime.', no-transform'); header('Content-Type: '.$mimetype); header('Etag: "'.$etag.'"'); die; @@ -120,7 +120,7 @@ function yui_image_cached($imagepath, $imagename, $mimetype, $etag) { header('Last-Modified: '. gmdate('D, d M Y H:i:s', filemtime($imagepath)) .' GMT'); header('Expires: '. gmdate('D, d M Y H:i:s', time() + $lifetime) .' GMT'); header('Pragma: '); - header('Cache-Control: public, max-age=315360000'); + header('Cache-Control: public, max-age=315360000, no-transform'); header('Accept-Ranges: none'); header('Content-Type: '.$mimetype); header('Content-Length: '.filesize($imagepath));