diff --git a/src/aphront/configuration/AphrontDefaultApplicationConfiguration.php b/src/aphront/configuration/AphrontDefaultApplicationConfiguration.php
index be23895bec..fb67919576 100644
--- a/src/aphront/configuration/AphrontDefaultApplicationConfiguration.php
+++ b/src/aphront/configuration/AphrontDefaultApplicationConfiguration.php
@@ -1,68 +1,121 @@
 <?php
 
 /**
  * NOTE: Do not extend this!
  *
  * @concrete-extensible
  */
 class AphrontDefaultApplicationConfiguration
   extends AphrontApplicationConfiguration {
 
   /**
    * @phutil-external-symbol class PhabricatorStartup
    */
   public function buildRequest() {
     $parser = new PhutilQueryStringParser();
     $data   = array();
 
-    // If the request has "multipart/form-data" content, we can't use
-    // PhutilQueryStringParser to parse it, and the raw data supposedly is not
-    // available anyway (according to the PHP documentation, "php://input" is
-    // not available for "multipart/form-data" requests). However, it is
-    // available at least some of the time (see T3673), so double check that
-    // we aren't trying to parse data we won't be able to parse correctly by
-    // examining the Content-Type header.
-    $content_type = idx($_SERVER, 'CONTENT_TYPE');
-    $is_form_data = preg_match('@^multipart/form-data@i', $content_type);
-
     $request_method = idx($_SERVER, 'REQUEST_METHOD');
     if ($request_method === 'PUT') {
       // For PUT requests, do nothing: in particular, do NOT read input. This
       // allows us to stream input later and process very large PUT requests,
       // like those coming from Git LFS.
     } else {
+      // For POST requests, we're going to read the raw input ourselves here
+      // if we can. Among other things, this corrects variable names with
+      // the "." character in them, which PHP normally converts into "_".
+
+      // There are two major considerations here: whether the
+      // `enable_post_data_reading` option is set, and whether the content
+      // type is "multipart/form-data" or not.
+
+      // If `enable_post_data_reading` is off, we're free to read the entire
+      // raw request body and parse it -- and we must, because $_POST and
+      // $_FILES are not built for us. If `enable_post_data_reading` is on,
+      // which is the default, we may not be able to read the body (the
+      // documentation says we can't, but empirically we can at least some
+      // of the time).
+
+      // If the content type is "multipart/form-data", we need to build both
+      // $_POST and $_FILES, which is involved. The body itself is also more
+      // difficult to parse than other requests.
       $raw_input = PhabricatorStartup::getRawInput();
-      if (strlen($raw_input) && !$is_form_data) {
-        $data += $parser->parseQueryString($raw_input);
+      if (strlen($raw_input)) {
+        $content_type = idx($_SERVER, 'CONTENT_TYPE');
+        $is_multipart = preg_match('@^multipart/form-data@i', $content_type);
+        if ($is_multipart && !ini_get('enable_post_data_reading')) {
+          $multipart_parser = id(new AphrontMultipartParser())
+            ->setContentType($content_type);
+
+          $multipart_parser->beginParse();
+          $multipart_parser->continueParse($raw_input);
+          $parts = $multipart_parser->endParse();
+
+          $query_string = array();
+          foreach ($parts as $part) {
+            if (!$part->isVariable()) {
+              continue;
+            }
+
+            $name = $part->getName();
+            $value = $part->getVariableValue();
+
+            $query_string[] = urlencode($name).'='.urlencode($value);
+          }
+          $query_string = implode('&', $query_string);
+          $post = $parser->parseQueryString($query_string);
+
+          $files = array();
+          foreach ($parts as $part) {
+            if ($part->isVariable()) {
+              continue;
+            }
+
+            $files[$part->getName()] = $part->getPHPFileDictionary();
+          }
+          $_FILES = $files;
+        } else {
+          $post = $parser->parseQueryString($raw_input);
+        }
+
+        $_POST = $post;
+        PhabricatorStartup::rebuildRequest();
+
+        $data += $post;
       } else if ($_POST) {
+        $post = filter_input_array(INPUT_POST, FILTER_UNSAFE_RAW);
+        if (is_array($post)) {
+          $_POST = $post;
+          PhabricatorStartup::rebuildRequest();
+        }
         $data += $_POST;
       }
     }
 
     $data += $parser->parseQueryString(idx($_SERVER, 'QUERY_STRING', ''));
 
     $cookie_prefix = PhabricatorEnv::getEnvConfig('phabricator.cookie-prefix');
 
     $request = new AphrontRequest($this->getHost(), $this->getPath());
     $request->setRequestData($data);
     $request->setApplicationConfiguration($this);
     $request->setCookiePrefix($cookie_prefix);
 
     return $request;
   }
 
   public function build404Controller() {
     return array(new Phabricator404Controller(), array());
   }
 
   public function buildRedirectController($uri, $external) {
     return array(
       new PhabricatorRedirectController(),
       array(
         'uri' => $uri,
         'external' => $external,
       ),
     );
   }
 
 }
diff --git a/src/applications/files/storage/PhabricatorFile.php b/src/applications/files/storage/PhabricatorFile.php
index 19f0bed90a..9636b5b017 100644
--- a/src/applications/files/storage/PhabricatorFile.php
+++ b/src/applications/files/storage/PhabricatorFile.php
@@ -1,1612 +1,1620 @@
 <?php
 
 /**
  * Parameters
  * ==========
  *
  * When creating a new file using a method like @{method:newFromFileData}, these
  * parameters are supported:
  *
  *   | name | Human readable filename.
  *   | authorPHID | User PHID of uploader.
  *   | ttl.absolute | Temporary file lifetime as an epoch timestamp.
  *   | ttl.relative | Temporary file lifetime, relative to now, in seconds.
  *   | viewPolicy | File visibility policy.
  *   | isExplicitUpload | Used to show users files they explicitly uploaded.
  *   | canCDN | Allows the file to be cached and delivered over a CDN.
  *   | profile | Marks the file as a profile image.
  *   | format | Internal encoding format.
  *   | mime-type | Optional, explicit file MIME type.
  *   | builtin | Optional filename, identifies this as a builtin.
  *
  */
 final class PhabricatorFile extends PhabricatorFileDAO
   implements
     PhabricatorApplicationTransactionInterface,
     PhabricatorTokenReceiverInterface,
     PhabricatorSubscribableInterface,
     PhabricatorFlaggableInterface,
     PhabricatorPolicyInterface,
     PhabricatorDestructibleInterface,
     PhabricatorConduitResultInterface,
     PhabricatorIndexableInterface,
     PhabricatorNgramsInterface {
 
   const METADATA_IMAGE_WIDTH  = 'width';
   const METADATA_IMAGE_HEIGHT = 'height';
   const METADATA_CAN_CDN = 'canCDN';
   const METADATA_BUILTIN = 'builtin';
   const METADATA_PARTIAL = 'partial';
   const METADATA_PROFILE = 'profile';
   const METADATA_STORAGE = 'storage';
   const METADATA_INTEGRITY = 'integrity';
 
   const STATUS_ACTIVE = 'active';
   const STATUS_DELETED = 'deleted';
 
   protected $name;
   protected $mimeType;
   protected $byteSize;
   protected $authorPHID;
   protected $secretKey;
   protected $contentHash;
   protected $metadata = array();
   protected $mailKey;
   protected $builtinKey;
 
   protected $storageEngine;
   protected $storageFormat;
   protected $storageHandle;
 
   protected $ttl;
   protected $isExplicitUpload = 1;
   protected $viewPolicy = PhabricatorPolicies::POLICY_USER;
   protected $isPartial = 0;
   protected $isDeleted = 0;
 
   private $objects = self::ATTACHABLE;
   private $objectPHIDs = self::ATTACHABLE;
   private $originalFile = self::ATTACHABLE;
   private $transforms = self::ATTACHABLE;
 
   public static function initializeNewFile() {
     $app = id(new PhabricatorApplicationQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withClasses(array('PhabricatorFilesApplication'))
       ->executeOne();
 
     $view_policy = $app->getPolicy(
       FilesDefaultViewCapability::CAPABILITY);
 
     return id(new PhabricatorFile())
       ->setViewPolicy($view_policy)
       ->setIsPartial(0)
       ->attachOriginalFile(null)
       ->attachObjects(array())
       ->attachObjectPHIDs(array());
   }
 
   protected function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
       self::CONFIG_SERIALIZATION => array(
         'metadata' => self::SERIALIZATION_JSON,
       ),
       self::CONFIG_COLUMN_SCHEMA => array(
         'name' => 'sort255?',
         'mimeType' => 'text255?',
         'byteSize' => 'uint64',
         'storageEngine' => 'text32',
         'storageFormat' => 'text32',
         'storageHandle' => 'text255',
         'authorPHID' => 'phid?',
         'secretKey' => 'bytes20?',
         'contentHash' => 'bytes64?',
         'ttl' => 'epoch?',
         'isExplicitUpload' => 'bool?',
         'mailKey' => 'bytes20',
         'isPartial' => 'bool',
         'builtinKey' => 'text64?',
         'isDeleted' => 'bool',
       ),
       self::CONFIG_KEY_SCHEMA => array(
         'key_phid' => null,
         'phid' => array(
           'columns' => array('phid'),
           'unique' => true,
         ),
         'authorPHID' => array(
           'columns' => array('authorPHID'),
         ),
         'contentHash' => array(
           'columns' => array('contentHash'),
         ),
         'key_ttl' => array(
           'columns' => array('ttl'),
         ),
         'key_dateCreated' => array(
           'columns' => array('dateCreated'),
         ),
         'key_partial' => array(
           'columns' => array('authorPHID', 'isPartial'),
         ),
         'key_builtin' => array(
           'columns' => array('builtinKey'),
           'unique' => true,
         ),
       ),
     ) + parent::getConfiguration();
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID(
       PhabricatorFileFilePHIDType::TYPECONST);
   }
 
   public function save() {
     if (!$this->getSecretKey()) {
       $this->setSecretKey($this->generateSecretKey());
     }
     if (!$this->getMailKey()) {
       $this->setMailKey(Filesystem::readRandomCharacters(20));
     }
     return parent::save();
   }
 
   public function saveAndIndex() {
     $this->save();
     PhabricatorSearchWorker::queueDocumentForIndexing($this->getPHID());
     return $this;
   }
 
   public function getMonogram() {
     return 'F'.$this->getID();
   }
 
   public function scrambleSecret() {
     return $this->setSecretKey($this->generateSecretKey());
   }
 
   public static function readUploadedFileData($spec) {
     if (!$spec) {
       throw new Exception(pht('No file was uploaded!'));
     }
 
     $err = idx($spec, 'error');
     if ($err) {
       throw new PhabricatorFileUploadException($err);
     }
 
     $tmp_name = idx($spec, 'tmp_name');
-    $is_valid = @is_uploaded_file($tmp_name);
-    if (!$is_valid) {
-      throw new Exception(pht('File is not an uploaded file.'));
+
+    // NOTE: If we parsed the request body ourselves, the files we wrote will
+    // not be registered in the `is_uploaded_file()` list. It's fine to skip
+    // this check: it just protects against sloppy code from the long ago era
+    // of "register_globals".
+
+    if (ini_get('enable_post_data_reading')) {
+      $is_valid = @is_uploaded_file($tmp_name);
+      if (!$is_valid) {
+        throw new Exception(pht('File is not an uploaded file.'));
+      }
     }
 
     $file_data = Filesystem::readFile($tmp_name);
     $file_size = idx($spec, 'size');
 
     if (strlen($file_data) != $file_size) {
       throw new Exception(pht('File size disagrees with uploaded size.'));
     }
 
     return $file_data;
   }
 
   public static function newFromPHPUpload($spec, array $params = array()) {
     $file_data = self::readUploadedFileData($spec);
 
     $file_name = nonempty(
       idx($params, 'name'),
       idx($spec,   'name'));
     $params = array(
       'name' => $file_name,
     ) + $params;
 
     return self::newFromFileData($file_data, $params);
   }
 
   public static function newFromXHRUpload($data, array $params = array()) {
     return self::newFromFileData($data, $params);
   }
 
 
   public static function newFileFromContentHash($hash, array $params) {
     if ($hash === null) {
       return null;
     }
 
     // Check to see if a file with same hash already exists.
     $file = id(new PhabricatorFile())->loadOneWhere(
       'contentHash = %s LIMIT 1',
       $hash);
     if (!$file) {
       return null;
     }
 
     $copy_of_storage_engine = $file->getStorageEngine();
     $copy_of_storage_handle = $file->getStorageHandle();
     $copy_of_storage_format = $file->getStorageFormat();
     $copy_of_storage_properties = $file->getStorageProperties();
     $copy_of_byte_size = $file->getByteSize();
     $copy_of_mime_type = $file->getMimeType();
 
     $new_file = self::initializeNewFile();
 
     $new_file->setByteSize($copy_of_byte_size);
 
     $new_file->setContentHash($hash);
     $new_file->setStorageEngine($copy_of_storage_engine);
     $new_file->setStorageHandle($copy_of_storage_handle);
     $new_file->setStorageFormat($copy_of_storage_format);
     $new_file->setStorageProperties($copy_of_storage_properties);
     $new_file->setMimeType($copy_of_mime_type);
     $new_file->copyDimensions($file);
 
     $new_file->readPropertiesFromParameters($params);
 
     $new_file->saveAndIndex();
 
     return $new_file;
   }
 
   public static function newChunkedFile(
     PhabricatorFileStorageEngine $engine,
     $length,
     array $params) {
 
     $file = self::initializeNewFile();
 
     $file->setByteSize($length);
 
     // NOTE: Once we receive the first chunk, we'll detect its MIME type and
     // update the parent file. This matters for large media files like video.
     $file->setMimeType('application/octet-stream');
 
     $chunked_hash = idx($params, 'chunkedHash');
 
     // Get rid of this parameter now; we aren't passing it any further down
     // the stack.
     unset($params['chunkedHash']);
 
     if ($chunked_hash) {
       $file->setContentHash($chunked_hash);
     } else {
       // See PhabricatorChunkedFileStorageEngine::getChunkedHash() for some
       // discussion of this.
       $seed = Filesystem::readRandomBytes(64);
       $hash = PhabricatorChunkedFileStorageEngine::getChunkedHashForInput(
         $seed);
       $file->setContentHash($hash);
     }
 
     $file->setStorageEngine($engine->getEngineIdentifier());
     $file->setStorageHandle(PhabricatorFileChunk::newChunkHandle());
 
     // Chunked files are always stored raw because they do not actually store
     // data. The chunks do, and can be individually formatted.
     $file->setStorageFormat(PhabricatorFileRawStorageFormat::FORMATKEY);
 
     $file->setIsPartial(1);
 
     $file->readPropertiesFromParameters($params);
 
     return $file;
   }
 
   private static function buildFromFileData($data, array $params = array()) {
 
     if (isset($params['storageEngines'])) {
       $engines = $params['storageEngines'];
     } else {
       $size = strlen($data);
       $engines = PhabricatorFileStorageEngine::loadStorageEngines($size);
 
       if (!$engines) {
         throw new Exception(
           pht(
             'No configured storage engine can store this file. See '.
             '"Configuring File Storage" in the documentation for '.
             'information on configuring storage engines.'));
       }
     }
 
     assert_instances_of($engines, 'PhabricatorFileStorageEngine');
     if (!$engines) {
       throw new Exception(pht('No valid storage engines are available!'));
     }
 
     $file = self::initializeNewFile();
 
     $aes_type = PhabricatorFileAES256StorageFormat::FORMATKEY;
     $has_aes = PhabricatorKeyring::getDefaultKeyName($aes_type);
     if ($has_aes !== null) {
       $default_key = PhabricatorFileAES256StorageFormat::FORMATKEY;
     } else {
       $default_key = PhabricatorFileRawStorageFormat::FORMATKEY;
     }
     $key = idx($params, 'format', $default_key);
 
     // Callers can pass in an object explicitly instead of a key. This is
     // primarily useful for unit tests.
     if ($key instanceof PhabricatorFileStorageFormat) {
       $format = clone $key;
     } else {
       $format = clone PhabricatorFileStorageFormat::requireFormat($key);
     }
 
     $format->setFile($file);
 
     $properties = $format->newStorageProperties();
     $file->setStorageFormat($format->getStorageFormatKey());
     $file->setStorageProperties($properties);
 
     $data_handle = null;
     $engine_identifier = null;
     $integrity_hash = null;
     $exceptions = array();
     foreach ($engines as $engine) {
       $engine_class = get_class($engine);
       try {
         $result = $file->writeToEngine(
           $engine,
           $data,
           $params);
 
         list($engine_identifier, $data_handle, $integrity_hash) = $result;
 
         // We stored the file somewhere so stop trying to write it to other
         // places.
         break;
       } catch (PhabricatorFileStorageConfigurationException $ex) {
         // If an engine is outright misconfigured (or misimplemented), raise
         // that immediately since it probably needs attention.
         throw $ex;
       } catch (Exception $ex) {
         phlog($ex);
 
         // If an engine doesn't work, keep trying all the other valid engines
         // in case something else works.
         $exceptions[$engine_class] = $ex;
       }
     }
 
     if (!$data_handle) {
       throw new PhutilAggregateException(
         pht('All storage engines failed to write file:'),
         $exceptions);
     }
 
     $file->setByteSize(strlen($data));
 
     $hash = self::hashFileContent($data);
     $file->setContentHash($hash);
 
     $file->setStorageEngine($engine_identifier);
     $file->setStorageHandle($data_handle);
 
     $file->setIntegrityHash($integrity_hash);
 
     $file->readPropertiesFromParameters($params);
 
     if (!$file->getMimeType()) {
       $tmp = new TempFile();
       Filesystem::writeFile($tmp, $data);
       $file->setMimeType(Filesystem::getMimeType($tmp));
       unset($tmp);
     }
 
     try {
       $file->updateDimensions(false);
     } catch (Exception $ex) {
       // Do nothing
     }
 
     $file->saveAndIndex();
 
     return $file;
   }
 
   public static function newFromFileData($data, array $params = array()) {
     $hash = self::hashFileContent($data);
 
     if ($hash !== null) {
       $file = self::newFileFromContentHash($hash, $params);
       if ($file) {
         return $file;
       }
     }
 
     return self::buildFromFileData($data, $params);
   }
 
   public function migrateToEngine(
     PhabricatorFileStorageEngine $engine,
     $make_copy) {
 
     if (!$this->getID() || !$this->getStorageHandle()) {
       throw new Exception(
         pht("You can not migrate a file which hasn't yet been saved."));
     }
 
     $data = $this->loadFileData();
     $params = array(
       'name' => $this->getName(),
     );
 
     list($new_identifier, $new_handle, $integrity_hash) = $this->writeToEngine(
       $engine,
       $data,
       $params);
 
     $old_engine = $this->instantiateStorageEngine();
     $old_identifier = $this->getStorageEngine();
     $old_handle = $this->getStorageHandle();
 
     $this->setStorageEngine($new_identifier);
     $this->setStorageHandle($new_handle);
     $this->setIntegrityHash($integrity_hash);
     $this->save();
 
     if (!$make_copy) {
       $this->deleteFileDataIfUnused(
         $old_engine,
         $old_identifier,
         $old_handle);
     }
 
     return $this;
   }
 
   public function migrateToStorageFormat(PhabricatorFileStorageFormat $format) {
     if (!$this->getID() || !$this->getStorageHandle()) {
       throw new Exception(
         pht("You can not migrate a file which hasn't yet been saved."));
     }
 
     $data = $this->loadFileData();
     $params = array(
       'name' => $this->getName(),
     );
 
     $engine = $this->instantiateStorageEngine();
     $old_handle = $this->getStorageHandle();
 
     $properties = $format->newStorageProperties();
     $this->setStorageFormat($format->getStorageFormatKey());
     $this->setStorageProperties($properties);
 
     list($identifier, $new_handle) = $this->writeToEngine(
       $engine,
       $data,
       $params);
 
     $this->setStorageHandle($new_handle);
     $this->save();
 
     $this->deleteFileDataIfUnused(
       $engine,
       $identifier,
       $old_handle);
 
     return $this;
   }
 
   public function cycleMasterStorageKey(PhabricatorFileStorageFormat $format) {
     if (!$this->getID() || !$this->getStorageHandle()) {
       throw new Exception(
         pht("You can not cycle keys for a file which hasn't yet been saved."));
     }
 
     $properties = $format->cycleStorageProperties();
     $this->setStorageProperties($properties);
     $this->save();
 
     return $this;
   }
 
   private function writeToEngine(
     PhabricatorFileStorageEngine $engine,
     $data,
     array $params) {
 
     $engine_class = get_class($engine);
 
     $format = $this->newStorageFormat();
 
     $data_iterator = array($data);
     $formatted_iterator = $format->newWriteIterator($data_iterator);
     $formatted_data = $this->loadDataFromIterator($formatted_iterator);
 
     $integrity_hash = $engine->newIntegrityHash($formatted_data, $format);
 
     $data_handle = $engine->writeFile($formatted_data, $params);
 
     if (!$data_handle || strlen($data_handle) > 255) {
       // This indicates an improperly implemented storage engine.
       throw new PhabricatorFileStorageConfigurationException(
         pht(
           "Storage engine '%s' executed %s but did not return a valid ".
           "handle ('%s') to the data: it must be nonempty and no longer ".
           "than 255 characters.",
           $engine_class,
           'writeFile()',
           $data_handle));
     }
 
     $engine_identifier = $engine->getEngineIdentifier();
     if (!$engine_identifier || strlen($engine_identifier) > 32) {
       throw new PhabricatorFileStorageConfigurationException(
         pht(
           "Storage engine '%s' returned an improper engine identifier '{%s}': ".
           "it must be nonempty and no longer than 32 characters.",
           $engine_class,
           $engine_identifier));
     }
 
     return array($engine_identifier, $data_handle, $integrity_hash);
   }
 
 
   /**
    * Download a remote resource over HTTP and save the response body as a file.
    *
    * This method respects `security.outbound-blacklist`, and protects against
    * HTTP redirection (by manually following "Location" headers and verifying
    * each destination). It does not protect against DNS rebinding. See
    * discussion in T6755.
    */
   public static function newFromFileDownload($uri, array $params = array()) {
     $timeout = 5;
 
     $redirects = array();
     $current = $uri;
     while (true) {
       try {
         if (count($redirects) > 10) {
           throw new Exception(
             pht('Too many redirects trying to fetch remote URI.'));
         }
 
         $resolved = PhabricatorEnv::requireValidRemoteURIForFetch(
           $current,
           array(
             'http',
             'https',
           ));
 
         list($resolved_uri, $resolved_domain) = $resolved;
 
         $current = new PhutilURI($current);
         if ($current->getProtocol() == 'http') {
           // For HTTP, we can use a pre-resolved URI to defuse DNS rebinding.
           $fetch_uri = $resolved_uri;
           $fetch_host = $resolved_domain;
         } else {
           // For HTTPS, we can't: cURL won't verify the SSL certificate if
           // the domain has been replaced with an IP. But internal services
           // presumably will not have valid certificates for rebindable
           // domain names on attacker-controlled domains, so the DNS rebinding
           // attack should generally not be possible anyway.
           $fetch_uri = $current;
           $fetch_host = null;
         }
 
         $future = id(new HTTPSFuture($fetch_uri))
           ->setFollowLocation(false)
           ->setTimeout($timeout);
 
         if ($fetch_host !== null) {
           $future->addHeader('Host', $fetch_host);
         }
 
         list($status, $body, $headers) = $future->resolve();
 
         if ($status->isRedirect()) {
           // This is an HTTP 3XX status, so look for a "Location" header.
           $location = null;
           foreach ($headers as $header) {
             list($name, $value) = $header;
             if (phutil_utf8_strtolower($name) == 'location') {
               $location = $value;
               break;
             }
           }
 
           // HTTP 3XX status with no "Location" header, just treat this like
           // a normal HTTP error.
           if ($location === null) {
             throw $status;
           }
 
           if (isset($redirects[$location])) {
             throw new Exception(
               pht('Encountered loop while following redirects.'));
           }
 
           $redirects[$location] = $location;
           $current = $location;
           // We'll fall off the bottom and go try this URI now.
         } else if ($status->isError()) {
           // This is something other than an HTTP 2XX or HTTP 3XX status, so
           // just bail out.
           throw $status;
         } else {
           // This is HTTP 2XX, so use the response body to save the
           // file data.
           $params = $params + array(
             'name' => basename($uri),
           );
 
           return self::newFromFileData($body, $params);
         }
       } catch (Exception $ex) {
         if ($redirects) {
           throw new PhutilProxyException(
             pht(
               'Failed to fetch remote URI "%s" after following %s redirect(s) '.
               '(%s): %s',
               $uri,
               phutil_count($redirects),
               implode(' > ', array_keys($redirects)),
               $ex->getMessage()),
             $ex);
         } else {
           throw $ex;
         }
       }
     }
   }
 
   public static function normalizeFileName($file_name) {
     $pattern = "@[\\x00-\\x19#%&+!~'\$\"\/=\\\\?<> ]+@";
     $file_name = preg_replace($pattern, '_', $file_name);
     $file_name = preg_replace('@_+@', '_', $file_name);
     $file_name = trim($file_name, '_');
 
     $disallowed_filenames = array(
       '.'  => 'dot',
       '..' => 'dotdot',
       ''   => 'file',
     );
     $file_name = idx($disallowed_filenames, $file_name, $file_name);
 
     return $file_name;
   }
 
   public function delete() {
     // We want to delete all the rows which mark this file as the transformation
     // of some other file (since we're getting rid of it). We also delete all
     // the transformations of this file, so that a user who deletes an image
     // doesn't need to separately hunt down and delete a bunch of thumbnails and
     // resizes of it.
 
     $outbound_xforms = id(new PhabricatorFileQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withTransforms(
         array(
           array(
             'originalPHID' => $this->getPHID(),
             'transform'    => true,
           ),
         ))
       ->execute();
 
     foreach ($outbound_xforms as $outbound_xform) {
       $outbound_xform->delete();
     }
 
     $inbound_xforms = id(new PhabricatorTransformedFile())->loadAllWhere(
       'transformedPHID = %s',
       $this->getPHID());
 
     $this->openTransaction();
       foreach ($inbound_xforms as $inbound_xform) {
         $inbound_xform->delete();
       }
       $ret = parent::delete();
     $this->saveTransaction();
 
     $this->deleteFileDataIfUnused(
       $this->instantiateStorageEngine(),
       $this->getStorageEngine(),
       $this->getStorageHandle());
 
     return $ret;
   }
 
 
   /**
    * Destroy stored file data if there are no remaining files which reference
    * it.
    */
   public function deleteFileDataIfUnused(
     PhabricatorFileStorageEngine $engine,
     $engine_identifier,
     $handle) {
 
     // Check to see if any files are using storage.
     $usage = id(new PhabricatorFile())->loadAllWhere(
       'storageEngine = %s AND storageHandle = %s LIMIT 1',
       $engine_identifier,
       $handle);
 
     // If there are no files using the storage, destroy the actual storage.
     if (!$usage) {
       try {
         $engine->deleteFile($handle);
       } catch (Exception $ex) {
         // In the worst case, we're leaving some data stranded in a storage
         // engine, which is not a big deal.
         phlog($ex);
       }
     }
   }
 
   public static function hashFileContent($data) {
     // NOTE: Hashing can fail if the algorithm isn't available in the current
     // build of PHP. It's fine if we're unable to generate a content hash:
     // it just means we'll store extra data when users upload duplicate files
     // instead of being able to deduplicate it.
 
     $hash = hash('sha256', $data, $raw_output = false);
     if ($hash === false) {
       return null;
     }
 
     return $hash;
   }
 
   public function loadFileData() {
     $iterator = $this->getFileDataIterator();
     return $this->loadDataFromIterator($iterator);
   }
 
 
   /**
    * Return an iterable which emits file content bytes.
    *
    * @param int Offset for the start of data.
    * @param int Offset for the end of data.
    * @return Iterable Iterable object which emits requested data.
    */
   public function getFileDataIterator($begin = null, $end = null) {
     $engine = $this->instantiateStorageEngine();
 
     $format = $this->newStorageFormat();
 
     $iterator = $engine->getRawFileDataIterator(
       $this,
       $begin,
       $end,
       $format);
 
     return $iterator;
   }
 
   public function getURI() {
     return $this->getInfoURI();
   }
 
   public function getViewURI() {
     if (!$this->getPHID()) {
       throw new Exception(
         pht('You must save a file before you can generate a view URI.'));
     }
 
     return $this->getCDNURI();
   }
 
   public function getCDNURI() {
     $name = self::normalizeFileName($this->getName());
     $name = phutil_escape_uri($name);
 
     $parts = array();
     $parts[] = 'file';
     $parts[] = 'data';
 
     // If this is an instanced install, add the instance identifier to the URI.
     // Instanced configurations behind a CDN may not be able to control the
     // request domain used by the CDN (as with AWS CloudFront). Embedding the
     // instance identity in the path allows us to distinguish between requests
     // originating from different instances but served through the same CDN.
     $instance = PhabricatorEnv::getEnvConfig('cluster.instance');
     if (strlen($instance)) {
       $parts[] = '@'.$instance;
     }
 
     $parts[] = $this->getSecretKey();
     $parts[] = $this->getPHID();
     $parts[] = $name;
 
     $path = '/'.implode('/', $parts);
 
     // If this file is only partially uploaded, we're just going to return a
     // local URI to make sure that Ajax works, since the page is inevitably
     // going to give us an error back.
     if ($this->getIsPartial()) {
       return PhabricatorEnv::getURI($path);
     } else {
       return PhabricatorEnv::getCDNURI($path);
     }
   }
 
 
   public function getInfoURI() {
     return '/'.$this->getMonogram();
   }
 
   public function getBestURI() {
     if ($this->isViewableInBrowser()) {
       return $this->getViewURI();
     } else {
       return $this->getInfoURI();
     }
   }
 
   public function getDownloadURI() {
     $uri = id(new PhutilURI($this->getViewURI()))
       ->setQueryParam('download', true);
     return (string)$uri;
   }
 
   public function getURIForTransform(PhabricatorFileTransform $transform) {
     return $this->getTransformedURI($transform->getTransformKey());
   }
 
   private function getTransformedURI($transform) {
     $parts = array();
     $parts[] = 'file';
     $parts[] = 'xform';
 
     $instance = PhabricatorEnv::getEnvConfig('cluster.instance');
     if (strlen($instance)) {
       $parts[] = '@'.$instance;
     }
 
     $parts[] = $transform;
     $parts[] = $this->getPHID();
     $parts[] = $this->getSecretKey();
 
     $path = implode('/', $parts);
     $path = $path.'/';
 
     return PhabricatorEnv::getCDNURI($path);
   }
 
   public function isViewableInBrowser() {
     return ($this->getViewableMimeType() !== null);
   }
 
   public function isViewableImage() {
     if (!$this->isViewableInBrowser()) {
       return false;
     }
 
     $mime_map = PhabricatorEnv::getEnvConfig('files.image-mime-types');
     $mime_type = $this->getMimeType();
     return idx($mime_map, $mime_type);
   }
 
   public function isAudio() {
     if (!$this->isViewableInBrowser()) {
       return false;
     }
 
     $mime_map = PhabricatorEnv::getEnvConfig('files.audio-mime-types');
     $mime_type = $this->getMimeType();
     return idx($mime_map, $mime_type);
   }
 
   public function isVideo() {
     if (!$this->isViewableInBrowser()) {
       return false;
     }
 
     $mime_map = PhabricatorEnv::getEnvConfig('files.video-mime-types');
     $mime_type = $this->getMimeType();
     return idx($mime_map, $mime_type);
   }
 
   public function isTransformableImage() {
     // NOTE: The way the 'gd' extension works in PHP is that you can install it
     // with support for only some file types, so it might be able to handle
     // PNG but not JPEG. Try to generate thumbnails for whatever we can. Setup
     // warns you if you don't have complete support.
 
     $matches = null;
     $ok = preg_match(
       '@^image/(gif|png|jpe?g)@',
       $this->getViewableMimeType(),
       $matches);
     if (!$ok) {
       return false;
     }
 
     switch ($matches[1]) {
       case 'jpg';
       case 'jpeg':
         return function_exists('imagejpeg');
         break;
       case 'png':
         return function_exists('imagepng');
         break;
       case 'gif':
         return function_exists('imagegif');
         break;
       default:
         throw new Exception(pht('Unknown type matched as image MIME type.'));
     }
   }
 
   public static function getTransformableImageFormats() {
     $supported = array();
 
     if (function_exists('imagejpeg')) {
       $supported[] = 'jpg';
     }
 
     if (function_exists('imagepng')) {
       $supported[] = 'png';
     }
 
     if (function_exists('imagegif')) {
       $supported[] = 'gif';
     }
 
     return $supported;
   }
 
   public function getDragAndDropDictionary() {
     return array(
       'id'   => $this->getID(),
       'phid' => $this->getPHID(),
       'uri'  => $this->getBestURI(),
     );
   }
 
   public function instantiateStorageEngine() {
     return self::buildEngine($this->getStorageEngine());
   }
 
   public static function buildEngine($engine_identifier) {
     $engines = self::buildAllEngines();
     foreach ($engines as $engine) {
       if ($engine->getEngineIdentifier() == $engine_identifier) {
         return $engine;
       }
     }
 
     throw new Exception(
       pht(
         "Storage engine '%s' could not be located!",
         $engine_identifier));
   }
 
   public static function buildAllEngines() {
     return id(new PhutilClassMapQuery())
       ->setAncestorClass('PhabricatorFileStorageEngine')
       ->execute();
   }
 
   public function getViewableMimeType() {
     $mime_map = PhabricatorEnv::getEnvConfig('files.viewable-mime-types');
 
     $mime_type = $this->getMimeType();
     $mime_parts = explode(';', $mime_type);
     $mime_type = trim(reset($mime_parts));
 
     return idx($mime_map, $mime_type);
   }
 
   public function getDisplayIconForMimeType() {
     $mime_map = PhabricatorEnv::getEnvConfig('files.icon-mime-types');
     $mime_type = $this->getMimeType();
     return idx($mime_map, $mime_type, 'fa-file-o');
   }
 
   public function validateSecretKey($key) {
     return ($key == $this->getSecretKey());
   }
 
   public function generateSecretKey() {
     return Filesystem::readRandomCharacters(20);
   }
 
   public function setStorageProperties(array $properties) {
     $this->metadata[self::METADATA_STORAGE] = $properties;
     return $this;
   }
 
   public function getStorageProperties() {
     return idx($this->metadata, self::METADATA_STORAGE, array());
   }
 
   public function getStorageProperty($key, $default = null) {
     $properties = $this->getStorageProperties();
     return idx($properties, $key, $default);
   }
 
   public function loadDataFromIterator($iterator) {
     $result = '';
 
     foreach ($iterator as $chunk) {
       $result .= $chunk;
     }
 
     return $result;
   }
 
   public function updateDimensions($save = true) {
     if (!$this->isViewableImage()) {
       throw new Exception(pht('This file is not a viewable image.'));
     }
 
     if (!function_exists('imagecreatefromstring')) {
       throw new Exception(pht('Cannot retrieve image information.'));
     }
 
     $data = $this->loadFileData();
 
     $img = imagecreatefromstring($data);
     if ($img === false) {
       throw new Exception(pht('Error when decoding image.'));
     }
 
     $this->metadata[self::METADATA_IMAGE_WIDTH] = imagesx($img);
     $this->metadata[self::METADATA_IMAGE_HEIGHT] = imagesy($img);
 
     if ($save) {
       $this->save();
     }
 
     return $this;
   }
 
   public function copyDimensions(PhabricatorFile $file) {
     $metadata = $file->getMetadata();
     $width = idx($metadata, self::METADATA_IMAGE_WIDTH);
     if ($width) {
       $this->metadata[self::METADATA_IMAGE_WIDTH] = $width;
     }
     $height = idx($metadata, self::METADATA_IMAGE_HEIGHT);
     if ($height) {
       $this->metadata[self::METADATA_IMAGE_HEIGHT] = $height;
     }
 
     return $this;
   }
 
 
   /**
    * Load (or build) the {@class:PhabricatorFile} objects for builtin file
    * resources. The builtin mechanism allows files shipped with Phabricator
    * to be treated like normal files so that APIs do not need to special case
    * things like default images or deleted files.
    *
    * Builtins are located in `resources/builtin/` and identified by their
    * name.
    *
    * @param  PhabricatorUser Viewing user.
    * @param  list<PhabricatorFilesBuiltinFile> List of builtin file specs.
    * @return dict<string, PhabricatorFile> Dictionary of named builtins.
    */
   public static function loadBuiltins(PhabricatorUser $user, array $builtins) {
     $builtins = mpull($builtins, null, 'getBuiltinFileKey');
 
     // NOTE: Anyone is allowed to access builtin files.
 
     $files = id(new PhabricatorFileQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withBuiltinKeys(array_keys($builtins))
       ->execute();
 
     $results = array();
     foreach ($files as $file) {
       $builtin_key = $file->getBuiltinName();
       if ($builtin_key !== null) {
         $results[$builtin_key] = $file;
       }
     }
 
     $build = array();
     foreach ($builtins as $key => $builtin) {
       if (isset($results[$key])) {
         continue;
       }
 
       $data = $builtin->loadBuiltinFileData();
 
       $params = array(
         'name' => $builtin->getBuiltinDisplayName(),
         'ttl.relative' => phutil_units('7 days in seconds'),
         'canCDN' => true,
         'builtin' => $key,
       );
 
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         try {
           $file = self::newFromFileData($data, $params);
         } catch (AphrontDuplicateKeyQueryException $ex) {
           $file = id(new PhabricatorFileQuery())
             ->setViewer(PhabricatorUser::getOmnipotentUser())
             ->withBuiltinKeys(array($key))
             ->executeOne();
           if (!$file) {
             throw new Exception(
               pht(
                 'Collided mid-air when generating builtin file "%s", but '.
                 'then failed to load the object we collided with.',
                 $key));
           }
         }
       unset($unguarded);
 
       $file->attachObjectPHIDs(array());
       $file->attachObjects(array());
 
       $results[$key] = $file;
     }
 
     return $results;
   }
 
 
   /**
    * Convenience wrapper for @{method:loadBuiltins}.
    *
    * @param PhabricatorUser   Viewing user.
    * @param string            Single builtin name to load.
    * @return PhabricatorFile  Corresponding builtin file.
    */
   public static function loadBuiltin(PhabricatorUser $user, $name) {
     $builtin = id(new PhabricatorFilesOnDiskBuiltinFile())
       ->setName($name);
 
     $key = $builtin->getBuiltinFileKey();
 
     return idx(self::loadBuiltins($user, array($builtin)), $key);
   }
 
   public function getObjects() {
     return $this->assertAttached($this->objects);
   }
 
   public function attachObjects(array $objects) {
     $this->objects = $objects;
     return $this;
   }
 
   public function getObjectPHIDs() {
     return $this->assertAttached($this->objectPHIDs);
   }
 
   public function attachObjectPHIDs(array $object_phids) {
     $this->objectPHIDs = $object_phids;
     return $this;
   }
 
   public function getOriginalFile() {
     return $this->assertAttached($this->originalFile);
   }
 
   public function attachOriginalFile(PhabricatorFile $file = null) {
     $this->originalFile = $file;
     return $this;
   }
 
   public function getImageHeight() {
     if (!$this->isViewableImage()) {
       return null;
     }
     return idx($this->metadata, self::METADATA_IMAGE_HEIGHT);
   }
 
   public function getImageWidth() {
     if (!$this->isViewableImage()) {
       return null;
     }
     return idx($this->metadata, self::METADATA_IMAGE_WIDTH);
   }
 
   public function getCanCDN() {
     if (!$this->isViewableImage()) {
       return false;
     }
 
     return idx($this->metadata, self::METADATA_CAN_CDN);
   }
 
   public function setCanCDN($can_cdn) {
     $this->metadata[self::METADATA_CAN_CDN] = $can_cdn ? 1 : 0;
     return $this;
   }
 
   public function isBuiltin() {
     return ($this->getBuiltinName() !== null);
   }
 
   public function getBuiltinName() {
     return idx($this->metadata, self::METADATA_BUILTIN);
   }
 
   public function setBuiltinName($name) {
     $this->metadata[self::METADATA_BUILTIN] = $name;
     return $this;
   }
 
   public function getIsProfileImage() {
     return idx($this->metadata, self::METADATA_PROFILE);
   }
 
   public function setIsProfileImage($value) {
     $this->metadata[self::METADATA_PROFILE] = $value;
     return $this;
   }
 
   public function setIntegrityHash($integrity_hash) {
     $this->metadata[self::METADATA_INTEGRITY] = $integrity_hash;
     return $this;
   }
 
   public function getIntegrityHash() {
     return idx($this->metadata, self::METADATA_INTEGRITY);
   }
 
   public function newIntegrityHash() {
     $engine = $this->instantiateStorageEngine();
 
     if ($engine->isChunkEngine()) {
       return null;
     }
 
     $format = $this->newStorageFormat();
 
     $storage_handle = $this->getStorageHandle();
     $data = $engine->readFile($storage_handle);
 
     return $engine->newIntegrityHash($data, $format);
   }
 
   /**
    * Write the policy edge between this file and some object.
    *
    * @param phid Object PHID to attach to.
    * @return this
    */
   public function attachToObject($phid) {
     $edge_type = PhabricatorObjectHasFileEdgeType::EDGECONST;
 
     id(new PhabricatorEdgeEditor())
       ->addEdge($phid, $edge_type, $this->getPHID())
       ->save();
 
     return $this;
   }
 
 
   /**
    * Remove the policy edge between this file and some object.
    *
    * @param phid Object PHID to detach from.
    * @return this
    */
   public function detachFromObject($phid) {
     $edge_type = PhabricatorObjectHasFileEdgeType::EDGECONST;
 
     id(new PhabricatorEdgeEditor())
       ->removeEdge($phid, $edge_type, $this->getPHID())
       ->save();
 
     return $this;
   }
 
 
   /**
    * Configure a newly created file object according to specified parameters.
    *
    * This method is called both when creating a file from fresh data, and
    * when creating a new file which reuses existing storage.
    *
    * @param map<string, wild>   Bag of parameters, see @{class:PhabricatorFile}
    *  for documentation.
    * @return this
    */
   private function readPropertiesFromParameters(array $params) {
     PhutilTypeSpec::checkMap(
       $params,
       array(
         'name' => 'optional string',
         'authorPHID' => 'optional string',
         'ttl.relative' => 'optional int',
         'ttl.absolute' => 'optional int',
         'viewPolicy' => 'optional string',
         'isExplicitUpload' => 'optional bool',
         'canCDN' => 'optional bool',
         'profile' => 'optional bool',
         'format' => 'optional string|PhabricatorFileStorageFormat',
         'mime-type' => 'optional string',
         'builtin' => 'optional string',
         'storageEngines' => 'optional list<PhabricatorFileStorageEngine>',
       ));
 
     $file_name = idx($params, 'name');
     $this->setName($file_name);
 
     $author_phid = idx($params, 'authorPHID');
     $this->setAuthorPHID($author_phid);
 
     $absolute_ttl = idx($params, 'ttl.absolute');
     $relative_ttl = idx($params, 'ttl.relative');
     if ($absolute_ttl !== null && $relative_ttl !== null) {
       throw new Exception(
         pht(
           'Specify an absolute TTL or a relative TTL, but not both.'));
     } else if ($absolute_ttl !== null) {
       if ($absolute_ttl < PhabricatorTime::getNow()) {
         throw new Exception(
           pht(
             'Absolute TTL must be in the present or future, but TTL "%s" '.
             'is in the past.',
             $absolute_ttl));
       }
 
       $this->setTtl($absolute_ttl);
     } else if ($relative_ttl !== null) {
       if ($relative_ttl < 0) {
         throw new Exception(
           pht(
             'Relative TTL must be zero or more seconds, but "%s" is '.
             'negative.',
             $relative_ttl));
       }
 
       $max_relative = phutil_units('365 days in seconds');
       if ($relative_ttl > $max_relative) {
         throw new Exception(
           pht(
             'Relative TTL must not be more than "%s" seconds, but TTL '.
             '"%s" was specified.',
             $max_relative,
             $relative_ttl));
       }
 
       $absolute_ttl = PhabricatorTime::getNow() + $relative_ttl;
 
       $this->setTtl($absolute_ttl);
     }
 
     $view_policy = idx($params, 'viewPolicy');
     if ($view_policy) {
       $this->setViewPolicy($params['viewPolicy']);
     }
 
     $is_explicit = (idx($params, 'isExplicitUpload') ? 1 : 0);
     $this->setIsExplicitUpload($is_explicit);
 
     $can_cdn = idx($params, 'canCDN');
     if ($can_cdn) {
       $this->setCanCDN(true);
     }
 
     $builtin = idx($params, 'builtin');
     if ($builtin) {
       $this->setBuiltinName($builtin);
       $this->setBuiltinKey($builtin);
     }
 
     $profile = idx($params, 'profile');
     if ($profile) {
       $this->setIsProfileImage(true);
     }
 
     $mime_type = idx($params, 'mime-type');
     if ($mime_type) {
       $this->setMimeType($mime_type);
     }
 
     return $this;
   }
 
   public function getRedirectResponse() {
     $uri = $this->getBestURI();
 
     // TODO: This is a bit iffy. Sometimes, getBestURI() returns a CDN URI
     // (if the file is a viewable image) and sometimes a local URI (if not).
     // For now, just detect which one we got and configure the response
     // appropriately. In the long run, if this endpoint is served from a CDN
     // domain, we can't issue a local redirect to an info URI (which is not
     // present on the CDN domain). We probably never actually issue local
     // redirects here anyway, since we only ever transform viewable images
     // right now.
 
     $is_external = strlen(id(new PhutilURI($uri))->getDomain());
 
     return id(new AphrontRedirectResponse())
       ->setIsExternal($is_external)
       ->setURI($uri);
   }
 
   public function attachTransforms(array $map) {
     $this->transforms = $map;
     return $this;
   }
 
   public function getTransform($key) {
     return $this->assertAttachedKey($this->transforms, $key);
   }
 
   public function newStorageFormat() {
     $key = $this->getStorageFormat();
     $template = PhabricatorFileStorageFormat::requireFormat($key);
 
     $format = id(clone $template)
       ->setFile($this);
 
     return $format;
   }
 
 
 /* -(  PhabricatorApplicationTransactionInterface  )------------------------- */
 
 
   public function getApplicationTransactionEditor() {
     return new PhabricatorFileEditor();
   }
 
   public function getApplicationTransactionObject() {
     return $this;
   }
 
   public function getApplicationTransactionTemplate() {
     return new PhabricatorFileTransaction();
   }
 
   public function willRenderTimeline(
     PhabricatorApplicationTransactionView $timeline,
     AphrontRequest $request) {
 
     return $timeline;
   }
 
 
 /* -(  PhabricatorPolicyInterface Implementation  )-------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
       PhabricatorPolicyCapability::CAN_EDIT,
     );
   }
 
   public function getPolicy($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         if ($this->isBuiltin()) {
           return PhabricatorPolicies::getMostOpenPolicy();
         }
         if ($this->getIsProfileImage()) {
           return PhabricatorPolicies::getMostOpenPolicy();
         }
         return $this->getViewPolicy();
       case PhabricatorPolicyCapability::CAN_EDIT:
         return PhabricatorPolicies::POLICY_NOONE;
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     $viewer_phid = $viewer->getPHID();
     if ($viewer_phid) {
       if ($this->getAuthorPHID() == $viewer_phid) {
         return true;
       }
     }
 
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         // If you can see the file this file is a transform of, you can see
         // this file.
         if ($this->getOriginalFile()) {
           return true;
         }
 
         // If you can see any object this file is attached to, you can see
         // the file.
         return (count($this->getObjects()) > 0);
     }
 
     return false;
   }
 
   public function describeAutomaticCapability($capability) {
     $out = array();
     $out[] = pht('The user who uploaded a file can always view and edit it.');
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         $out[] = pht(
           'Files attached to objects are visible to users who can view '.
           'those objects.');
         $out[] = pht(
           'Thumbnails are visible only to users who can view the original '.
           'file.');
         break;
     }
 
     return $out;
   }
 
 
 /* -(  PhabricatorSubscribableInterface Implementation  )-------------------- */
 
 
   public function isAutomaticallySubscribed($phid) {
     return ($this->authorPHID == $phid);
   }
 
 
 /* -(  PhabricatorTokenReceiverInterface  )---------------------------------- */
 
 
   public function getUsersToNotifyOfTokenGiven() {
     return array(
       $this->getAuthorPHID(),
     );
   }
 
 
 /* -(  PhabricatorDestructibleInterface  )----------------------------------- */
 
 
   public function destroyObjectPermanently(
     PhabricatorDestructionEngine $engine) {
 
     $this->openTransaction();
       $this->delete();
     $this->saveTransaction();
   }
 
 
 /* -(  PhabricatorConduitResultInterface  )---------------------------------- */
 
 
   public function getFieldSpecificationsForConduit() {
     return array(
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('name')
         ->setType('string')
         ->setDescription(pht('The name of the file.')),
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('dataURI')
         ->setType('string')
         ->setDescription(pht('Download URI for the file data.')),
       id(new PhabricatorConduitSearchFieldSpecification())
         ->setKey('size')
         ->setType('int')
         ->setDescription(pht('File size, in bytes.')),
     );
   }
 
   public function getFieldValuesForConduit() {
     return array(
       'name' => $this->getName(),
       'dataURI' => $this->getCDNURI(),
       'size' => (int)$this->getByteSize(),
     );
   }
 
   public function getConduitSearchAttachments() {
     return array();
   }
 
 /* -(  PhabricatorNgramInterface  )------------------------------------------ */
 
 
   public function newNgrams() {
     return array(
       id(new PhabricatorFileNameNgrams())
         ->setValue($this->getName()),
     );
   }
 
 }
diff --git a/support/PhabricatorStartup.php b/support/PhabricatorStartup.php
index fd286b2aa0..3d771a24f7 100644
--- a/support/PhabricatorStartup.php
+++ b/support/PhabricatorStartup.php
@@ -1,1011 +1,1027 @@
 <?php
 
 /**
  * Handle request startup, before loading the environment or libraries. This
  * class bootstraps the request state up to the point where we can enter
  * Phabricator code.
  *
  * NOTE: This class MUST NOT have any dependencies. It runs before libraries
  * load.
  *
  * Rate Limiting
  * =============
  *
  * Phabricator limits the rate at which clients can request pages, and issues
  * HTTP 429 "Too Many Requests" responses if clients request too many pages too
  * quickly. Although this is not a complete defense against high-volume attacks,
  * it can  protect an install against aggressive crawlers, security scanners,
  * and some types of malicious activity.
  *
  * To perform rate limiting, each page increments a score counter for the
  * requesting user's IP. The page can give the IP more points for an expensive
  * request, or fewer for an authetnicated request.
  *
  * Score counters are kept in buckets, and writes move to a new bucket every
  * minute. After a few minutes (defined by @{method:getRateLimitBucketCount}),
  * the oldest bucket is discarded. This provides a simple mechanism for keeping
  * track of scores without needing to store, access, or read very much data.
  *
  * Users are allowed to accumulate up to 1000 points per minute, averaged across
  * all of the tracked buckets.
  *
  * @task info         Accessing Request Information
  * @task hook         Startup Hooks
  * @task apocalypse   In Case Of Apocalypse
  * @task validation   Validation
  * @task ratelimit    Rate Limiting
  * @task phases       Startup Phase Timers
  */
 final class PhabricatorStartup {
 
   private static $startTime;
   private static $debugTimeLimit;
   private static $accessLog;
   private static $capturingOutput;
   private static $rawInput;
   private static $oldMemoryLimit;
   private static $phases;
 
   // TODO: For now, disable rate limiting entirely by default. We need to
   // iterate on it a bit for Conduit, some of the specific score levels, and
   // to deal with NAT'd offices.
   private static $maximumRate = 0;
   private static $rateLimitToken;
 
 
 /* -(  Accessing Request Information  )-------------------------------------- */
 
 
   /**
    * @task info
    */
   public static function getStartTime() {
     return self::$startTime;
   }
 
 
   /**
    * @task info
    */
   public static function getMicrosecondsSinceStart() {
     return (int)(1000000 * (microtime(true) - self::getStartTime()));
   }
 
 
   /**
    * @task info
    */
   public static function setAccessLog($access_log) {
     self::$accessLog = $access_log;
   }
 
 
   /**
    * @task info
    */
   public static function getRawInput() {
     if (self::$rawInput === null) {
       $stream = new AphrontRequestStream();
 
       if (isset($_SERVER['HTTP_CONTENT_ENCODING'])) {
         $encoding = trim($_SERVER['HTTP_CONTENT_ENCODING']);
         $stream->setEncoding($encoding);
       }
 
       $input = '';
       do {
         $bytes = $stream->readData();
         if ($bytes === null) {
           break;
         }
         $input .= $bytes;
       } while (true);
 
       self::$rawInput = $input;
     }
 
     return self::$rawInput;
   }
 
 
 /* -(  Startup Hooks  )------------------------------------------------------ */
 
 
   /**
    * @param float Request start time, from `microtime(true)`.
    * @task hook
    */
   public static function didStartup($start_time) {
     self::$startTime = $start_time;
 
     self::$phases = array();
 
     self::$accessLog = null;
 
     static $registered;
     if (!$registered) {
       // NOTE: This protects us against multiple calls to didStartup() in the
       // same request, but also against repeated requests to the same
       // interpreter state, which we may implement in the future.
       register_shutdown_function(array(__CLASS__, 'didShutdown'));
       $registered = true;
     }
 
     self::setupPHP();
     self::verifyPHP();
 
     // If we've made it this far, the environment isn't completely broken so
     // we can switch over to relying on our own exception recovery mechanisms.
     ini_set('display_errors', 0);
 
     $rate_token = self::getRateLimitToken();
     if ($rate_token !== null) {
       self::rateLimitRequest($rate_token);
     }
 
     self::normalizeInput();
 
     self::verifyRewriteRules();
 
     self::detectPostMaxSizeTriggered();
 
     self::beginOutputCapture();
   }
 
 
   /**
    * @task hook
    */
   public static function didShutdown() {
     $event = error_get_last();
 
     if (!$event) {
       return;
     }
 
     switch ($event['type']) {
       case E_ERROR:
       case E_PARSE:
       case E_COMPILE_ERROR:
         break;
       default:
         return;
     }
 
     $msg = ">>> UNRECOVERABLE FATAL ERROR <<<\n\n";
     if ($event) {
       // Even though we should be emitting this as text-plain, escape things
       // just to be sure since we can't really be sure what the program state
       // is when we get here.
       $msg .= htmlspecialchars(
         $event['message']."\n\n".$event['file'].':'.$event['line'],
         ENT_QUOTES,
         'UTF-8');
     }
 
     // flip dem tables
     $msg .= "\n\n\n";
     $msg .= "\xe2\x94\xbb\xe2\x94\x81\xe2\x94\xbb\x20\xef\xb8\xb5\x20\xc2\xaf".
             "\x5c\x5f\x28\xe3\x83\x84\x29\x5f\x2f\xc2\xaf\x20\xef\xb8\xb5\x20".
             "\xe2\x94\xbb\xe2\x94\x81\xe2\x94\xbb";
 
     self::didFatal($msg);
   }
 
   public static function loadCoreLibraries() {
     $phabricator_root = dirname(dirname(__FILE__));
     $libraries_root = dirname($phabricator_root);
 
     $root = null;
     if (!empty($_SERVER['PHUTIL_LIBRARY_ROOT'])) {
       $root = $_SERVER['PHUTIL_LIBRARY_ROOT'];
     }
 
     ini_set(
       'include_path',
       $libraries_root.PATH_SEPARATOR.ini_get('include_path'));
 
     @include_once $root.'libphutil/src/__phutil_library_init__.php';
     if (!@constant('__LIBPHUTIL__')) {
       self::didFatal(
         "Unable to load libphutil. Put libphutil/ next to phabricator/, or ".
         "update your PHP 'include_path' to include the parent directory of ".
         "libphutil/.");
     }
 
     phutil_load_library('arcanist/src');
 
     // Load Phabricator itself using the absolute path, so we never end up doing
     // anything surprising (loading index.php and libraries from different
     // directories).
     phutil_load_library($phabricator_root.'/src');
   }
 
 /* -(  Output Capture  )----------------------------------------------------- */
 
 
   public static function beginOutputCapture() {
     if (self::$capturingOutput) {
       self::didFatal('Already capturing output!');
     }
     self::$capturingOutput = true;
     ob_start();
   }
 
 
   public static function endOutputCapture() {
     if (!self::$capturingOutput) {
       return null;
     }
     self::$capturingOutput = false;
     return ob_get_clean();
   }
 
 
 /* -(  Debug Time Limit  )--------------------------------------------------- */
 
 
   /**
    * Set a time limit (in seconds) for the current script. After time expires,
    * the script fatals.
    *
    * This works like `max_execution_time`, but prints out a useful stack trace
    * when the time limit expires. This is primarily intended to make it easier
    * to debug pages which hang by allowing extraction of a stack trace: set a
    * short debug limit, then use the trace to figure out what's happening.
    *
    * The limit is implemented with a tick function, so enabling it implies
    * some accounting overhead.
    *
    * @param int Time limit in seconds.
    * @return void
    */
   public static function setDebugTimeLimit($limit) {
     self::$debugTimeLimit = $limit;
 
     static $initialized;
     if (!$initialized) {
       declare(ticks=1);
       register_tick_function(array(__CLASS__, 'onDebugTick'));
     }
   }
 
 
   /**
    * Callback tick function used by @{method:setDebugTimeLimit}.
    *
    * Fatals with a useful stack trace after the time limit expires.
    *
    * @return void
    */
   public static function onDebugTick() {
     $limit = self::$debugTimeLimit;
     if (!$limit) {
       return;
     }
 
     $elapsed = (microtime(true) - self::getStartTime());
     if ($elapsed > $limit) {
       $frames = array();
       foreach (debug_backtrace() as $frame) {
         $file = isset($frame['file']) ? $frame['file'] : '-';
         $file = basename($file);
 
         $line = isset($frame['line']) ? $frame['line'] : '-';
         $class = isset($frame['class']) ? $frame['class'].'->' : null;
         $func = isset($frame['function']) ? $frame['function'].'()' : '?';
 
         $frames[] = "{$file}:{$line} {$class}{$func}";
       }
 
       self::didFatal(
         "Request aborted by debug time limit after {$limit} seconds.\n\n".
         "STACK TRACE\n".
         implode("\n", $frames));
     }
   }
 
 
 /* -(  In Case of Apocalypse  )---------------------------------------------- */
 
 
   /**
    * Fatal the request completely in response to an exception, sending a plain
    * text message to the client. Calls @{method:didFatal} internally.
    *
    * @param   string    Brief description of the exception context, like
    *                    `"Rendering Exception"`.
    * @param   Exception The exception itself.
    * @param   bool      True if it's okay to show the exception's stack trace
    *                    to the user. The trace will always be logged.
    * @return  exit      This method **does not return**.
    *
    * @task apocalypse
    */
   public static function didEncounterFatalException(
     $note,
     Exception $ex,
     $show_trace) {
 
     $message = '['.$note.'/'.get_class($ex).'] '.$ex->getMessage();
 
     $full_message = $message;
     $full_message .= "\n\n";
     $full_message .= $ex->getTraceAsString();
 
     if ($show_trace) {
       $message = $full_message;
     }
 
     self::didFatal($message, $full_message);
   }
 
 
   /**
    * Fatal the request completely, sending a plain text message to the client.
    *
    * @param   string  Plain text message to send to the client.
    * @param   string  Plain text message to send to the error log. If not
    *                  provided, the client message is used. You can pass a more
    *                  detailed message here (e.g., with stack traces) to avoid
    *                  showing it to users.
    * @return  exit    This method **does not return**.
    *
    * @task apocalypse
    */
   public static function didFatal($message, $log_message = null) {
     if ($log_message === null) {
       $log_message = $message;
     }
 
     self::endOutputCapture();
     $access_log = self::$accessLog;
     if ($access_log) {
       // We may end up here before the access log is initialized, e.g. from
       // verifyPHP().
       $access_log->setData(
         array(
           'c' => 500,
         ));
       $access_log->write();
     }
 
     header(
       'Content-Type: text/plain; charset=utf-8',
       $replace = true,
       $http_error = 500);
 
     error_log($log_message);
     echo $message."\n";
 
     exit(1);
   }
 
 
 /* -(  Validation  )--------------------------------------------------------- */
 
 
   /**
    * @task validation
    */
   private static function setupPHP() {
     error_reporting(E_ALL | E_STRICT);
     self::$oldMemoryLimit = ini_get('memory_limit');
     ini_set('memory_limit', -1);
 
     // If we have libxml, disable the incredibly dangerous entity loader.
     if (function_exists('libxml_disable_entity_loader')) {
       libxml_disable_entity_loader(true);
     }
   }
 
 
   /**
    * @task validation
    */
   public static function getOldMemoryLimit() {
     return self::$oldMemoryLimit;
   }
 
   /**
    * @task validation
    */
   private static function normalizeInput() {
     // Replace superglobals with unfiltered versions, disrespect php.ini (we
     // filter ourselves).
 
     // NOTE: We don't filter INPUT_SERVER because we don't want to overwrite
     // changes made in "preamble.php".
+
+    // NOTE: WE don't filter INPUT_POST because we may be constructing it
+    // lazily if "enable_post_data_reading" is disabled.
+
     $filter = array(
       INPUT_GET,
-      INPUT_POST,
       INPUT_ENV,
       INPUT_COOKIE,
     );
     foreach ($filter as $type) {
       $filtered = filter_input_array($type, FILTER_UNSAFE_RAW);
       if (!is_array($filtered)) {
         continue;
       }
       switch ($type) {
         case INPUT_GET:
           $_GET = array_merge($_GET, $filtered);
           break;
         case INPUT_COOKIE:
           $_COOKIE = array_merge($_COOKIE, $filtered);
           break;
-        case INPUT_POST:
-          $_POST = array_merge($_POST, $filtered);
-          break;
         case INPUT_ENV;
           $env = array_merge($_ENV, $filtered);
           $_ENV = self::filterEnvSuperglobal($env);
           break;
       }
     }
 
-    // rebuild $_REQUEST, respecting order declared in ini files
+    self::rebuildRequest();
+  }
+
+  /**
+   * @task validation
+   */
+  public static function rebuildRequest() {
+    // Rebuild $_REQUEST, respecting order declared in ".ini" files.
     $order = ini_get('request_order');
+
     if (!$order) {
       $order = ini_get('variables_order');
     }
+
     if (!$order) {
-      // $_REQUEST will be empty, leave it alone
+      // $_REQUEST will be empty, so leave it alone.
       return;
     }
+
     $_REQUEST = array();
-    for ($i = 0; $i < strlen($order); $i++) {
-      switch ($order[$i]) {
+    for ($ii = 0; $ii < strlen($order); $ii++) {
+      switch ($order[$ii]) {
         case 'G':
           $_REQUEST = array_merge($_REQUEST, $_GET);
           break;
         case 'P':
           $_REQUEST = array_merge($_REQUEST, $_POST);
           break;
         case 'C':
           $_REQUEST = array_merge($_REQUEST, $_COOKIE);
           break;
         default:
-          // $_ENV and $_SERVER never go into $_REQUEST
+          // $_ENV and $_SERVER never go into $_REQUEST.
           break;
       }
     }
   }
 
 
   /**
    * Adjust `$_ENV` before execution.
    *
    * Adjustments here primarily impact the environment as seen by subprocesses.
    * The environment is forwarded explicitly by @{class:ExecFuture}.
    *
    * @param map<string, wild> Input `$_ENV`.
    * @return map<string, string> Suitable `$_ENV`.
    * @task validation
    */
   private static function filterEnvSuperglobal(array $env) {
 
     // In some configurations, we may get "argc" and "argv" set in $_ENV.
     // These are not real environmental variables, and "argv" may have an array
     // value which can not be forwarded to subprocesses. Remove these from the
     // environment if they are present.
     unset($env['argc']);
     unset($env['argv']);
 
     return $env;
   }
 
 
   /**
    * @task validation
    */
   private static function verifyPHP() {
     $required_version = '5.2.3';
     if (version_compare(PHP_VERSION, $required_version) < 0) {
       self::didFatal(
         "You are running PHP version '".PHP_VERSION."', which is older than ".
         "the minimum version, '{$required_version}'. Update to at least ".
         "'{$required_version}'.");
     }
 
     if (get_magic_quotes_gpc()) {
       self::didFatal(
         "Your server is configured with PHP 'magic_quotes_gpc' enabled. This ".
         "feature is 'highly discouraged' by PHP's developers and you must ".
         "disable it to run Phabricator. Consult the PHP manual for ".
         "instructions.");
     }
 
     if (extension_loaded('apc')) {
       $apc_version = phpversion('apc');
       $known_bad = array(
         '3.1.14' => true,
         '3.1.15' => true,
         '3.1.15-dev' => true,
       );
       if (isset($known_bad[$apc_version])) {
         self::didFatal(
           "You have APC {$apc_version} installed. This version of APC is ".
           "known to be bad, and does not work with Phabricator (it will ".
           "cause Phabricator to fatal unrecoverably with nonsense errors). ".
           "Downgrade to version 3.1.13.");
       }
     }
 
     if (isset($_SERVER['HTTP_PROXY'])) {
       self::didFatal(
         'This HTTP request included a "Proxy:" header, poisoning the '.
         'environment (CVE-2016-5385 / httpoxy). Declining to process this '.
         'request. For details, see: https://phurl.io/u/httpoxy');
     }
   }
 
 
   /**
    * @task validation
    */
   private static function verifyRewriteRules() {
     if (isset($_REQUEST['__path__']) && strlen($_REQUEST['__path__'])) {
       return;
     }
 
     if (php_sapi_name() == 'cli-server') {
       // Compatibility with PHP 5.4+ built-in web server.
       $url = parse_url($_SERVER['REQUEST_URI']);
       $_REQUEST['__path__'] = $url['path'];
       return;
     }
 
     if (!isset($_REQUEST['__path__'])) {
       self::didFatal(
         "Request parameter '__path__' is not set. Your rewrite rules ".
         "are not configured correctly.");
     }
 
     if (!strlen($_REQUEST['__path__'])) {
       self::didFatal(
         "Request parameter '__path__' is set, but empty. Your rewrite rules ".
         "are not configured correctly. The '__path__' should always ".
         "begin with a '/'.");
     }
   }
 
 
   /**
    * Detect if this request has had its POST data stripped by exceeding the
    * 'post_max_size' PHP configuration limit.
    *
    * PHP has a setting called 'post_max_size'. If a POST request arrives with
    * a body larger than the limit, PHP doesn't generate $_POST but processes
    * the request anyway, and provides no formal way to detect that this
    * happened.
    *
    * We can still read the entire body out of `php://input`. However according
    * to the documentation the stream isn't available for "multipart/form-data"
    * (on nginx + php-fpm it appears that it is available, though, at least) so
    * any attempt to generate $_POST would be fragile.
    *
    * @task validation
    */
   private static function detectPostMaxSizeTriggered() {
     // If this wasn't a POST, we're fine.
     if ($_SERVER['REQUEST_METHOD'] != 'POST') {
       return;
     }
 
+    // If "enable_post_data_reading" is off, we won't have $_POST and this
+    // condition is effectively impossible.
+    if (!ini_get('enable_post_data_reading')) {
+      return;
+    }
+
     // If there's POST data, clearly we're in good shape.
     if ($_POST) {
       return;
     }
 
     // For HTML5 drag-and-drop file uploads, Safari submits the data as
     // "application/x-www-form-urlencoded". For most files this generates
     // something in POST because most files decode to some nonempty (albeit
     // meaningless) value. However, some files (particularly small images)
     // don't decode to anything. If we know this is a drag-and-drop upload,
     // we can skip this check.
     if (isset($_REQUEST['__upload__'])) {
       return;
     }
 
     // PHP generates $_POST only for two content types. This routing happens
     // in `main/php_content_types.c` in PHP. Normally, all forms use one of
     // these content types, but some requests may not -- for example, Firefox
     // submits files sent over HTML5 XMLHTTPRequest APIs with the Content-Type
     // of the file itself. If we don't have a recognized content type, we
     // don't need $_POST.
     //
     // NOTE: We use strncmp() because the actual content type may be something
     // like "multipart/form-data; boundary=...".
     //
     // NOTE: Chrome sometimes omits this header, see some discussion in T1762
     // and http://code.google.com/p/chromium/issues/detail?id=6800
     $content_type = isset($_SERVER['CONTENT_TYPE'])
       ? $_SERVER['CONTENT_TYPE']
       : '';
 
     $parsed_types = array(
       'application/x-www-form-urlencoded',
       'multipart/form-data',
     );
 
     $is_parsed_type = false;
     foreach ($parsed_types as $parsed_type) {
       if (strncmp($content_type, $parsed_type, strlen($parsed_type)) === 0) {
         $is_parsed_type = true;
         break;
       }
     }
 
     if (!$is_parsed_type) {
       return;
     }
 
     // Check for 'Content-Length'. If there's no data, we don't expect $_POST
     // to exist.
     $length = (int)$_SERVER['CONTENT_LENGTH'];
     if (!$length) {
       return;
     }
 
     // Time to fatal: we know this was a POST with data that should have been
     // populated into $_POST, but it wasn't.
 
     $config = ini_get('post_max_size');
     self::didFatal(
       "As received by the server, this request had a nonzero content length ".
       "but no POST data.\n\n".
       "Normally, this indicates that it exceeds the 'post_max_size' setting ".
       "in the PHP configuration on the server. Increase the 'post_max_size' ".
       "setting or reduce the size of the request.\n\n".
       "Request size according to 'Content-Length' was '{$length}', ".
       "'post_max_size' is set to '{$config}'.");
   }
 
 
 /* -(  Rate Limiting  )------------------------------------------------------ */
 
 
   /**
    * Adjust the permissible rate limit score.
    *
    * By default, the limit is `1000`. You can use this method to set it to
    * a larger or smaller value. If you set it to `2000`, users may make twice
    * as many requests before rate limiting.
    *
    * @param int Maximum score before rate limiting.
    * @return void
    * @task ratelimit
    */
   public static function setMaximumRate($rate) {
     self::$maximumRate = $rate;
   }
 
 
   /**
    * Set a token to identify the client for purposes of rate limiting.
    *
    * By default, the `REMOTE_ADDR` is used. If your install is behind a load
    * balancer, you may want to parse `X-Forwarded-For` and use that address
    * instead.
    *
    * @param string Client identity for rate limiting.
    */
   public static function setRateLimitToken($token) {
     self::$rateLimitToken = $token;
   }
 
 
   /**
    * Get the current client identity for rate limiting.
    */
   public static function getRateLimitToken() {
     if (self::$rateLimitToken !== null) {
       return self::$rateLimitToken;
     }
 
     if (isset($_SERVER['REMOTE_ADDR'])) {
       return $_SERVER['REMOTE_ADDR'];
     }
 
     return null;
   }
 
 
   /**
    * Check if the user (identified by `$user_identity`) has issued too many
    * requests recently. If they have, end the request with a 429 error code.
    *
    * The key just needs to identify the user. Phabricator uses both user PHIDs
    * and user IPs as keys, tracking logged-in and logged-out users separately
    * and enforcing different limits.
    *
    * @param   string  Some key which identifies the user making the request.
    * @return  void    If the user has exceeded the rate limit, this method
    *                  does not return.
    * @task ratelimit
    */
   public static function rateLimitRequest($user_identity) {
     if (!self::canRateLimit()) {
       return;
     }
 
     $score = self::getRateLimitScore($user_identity);
     $limit = self::$maximumRate * self::getRateLimitBucketCount();
     if ($score > $limit) {
       // Give the user some bonus points for getting rate limited. This keeps
       // bad actors who keep slamming the 429 page locked out completely,
       // instead of letting them get a burst of requests through every minute
       // after a bucket expires.
       $penalty = 50;
 
       self::addRateLimitScore($user_identity, $penalty);
       $score += $penalty;
 
       self::didRateLimit($user_identity, $score, $limit);
     }
   }
 
 
   /**
    * Add points to the rate limit score for some user.
    *
    * If users have earned more than 1000 points per minute across all the
    * buckets they'll be locked out of the application, so awarding 1 point per
    * request roughly corresponds to allowing 1000 requests per second, while
    * awarding 50 points roughly corresponds to allowing 20 requests per second.
    *
    * @param string  Some key which identifies the user making the request.
    * @param float   The cost for this request; more points pushes them toward
    *                the limit faster.
    * @return void
    * @task ratelimit
    */
   public static function addRateLimitScore($user_identity, $score) {
     if (!self::canRateLimit()) {
       return;
     }
 
     $is_apcu = (bool)function_exists('apcu_fetch');
     $current = self::getRateLimitBucket();
 
     // There's a bit of a race here, if a second process reads the bucket
     // before this one writes it, but it's fine if we occasionally fail to
     // record a user's score. If they're making requests fast enough to hit
     // rate limiting, we'll get them soon enough.
 
     $bucket_key = self::getRateLimitBucketKey($current);
     if ($is_apcu) {
       $bucket = apcu_fetch($bucket_key);
     } else {
       $bucket = apc_fetch($bucket_key);
     }
 
     if (!is_array($bucket)) {
       $bucket = array();
     }
 
     if (empty($bucket[$user_identity])) {
       $bucket[$user_identity] = 0;
     }
 
     $bucket[$user_identity] += $score;
 
     if ($is_apcu) {
       apcu_store($bucket_key, $bucket);
     } else {
       apc_store($bucket_key, $bucket);
     }
   }
 
 
   /**
    * Determine if rate limiting is available.
    *
    * Rate limiting depends on APC, and isn't available unless the APC user
    * cache is available.
    *
    * @return bool True if rate limiting is available.
    * @task ratelimit
    */
   private static function canRateLimit() {
 
     if (!self::$maximumRate) {
       return false;
     }
 
     if (!function_exists('apc_fetch') && !function_exists('apcu_fetch')) {
       return false;
     }
 
     return true;
   }
 
 
   /**
    * Get the current bucket for storing rate limit scores.
    *
    * @return int The current bucket.
    * @task ratelimit
    */
   private static function getRateLimitBucket() {
     return (int)(time() / 60);
   }
 
 
   /**
    * Get the total number of rate limit buckets to retain.
    *
    * @return int Total number of rate limit buckets to retain.
    * @task ratelimit
    */
   private static function getRateLimitBucketCount() {
     return 5;
   }
 
 
   /**
    * Get the APC key for a given bucket.
    *
    * @param int Bucket to get the key for.
    * @return string APC key for the bucket.
    * @task ratelimit
    */
   private static function getRateLimitBucketKey($bucket) {
     return 'rate:bucket:'.$bucket;
   }
 
 
   /**
    * Get the APC key for the smallest stored bucket.
    *
    * @return string APC key for the smallest stored bucket.
    * @task ratelimit
    */
   private static function getRateLimitMinKey() {
     return 'rate:min';
   }
 
 
   /**
    * Get the current rate limit score for a given user.
    *
    * @param string Unique key identifying the user.
    * @return float The user's current score.
    * @task ratelimit
    */
   private static function getRateLimitScore($user_identity) {
     $is_apcu = (bool)function_exists('apcu_fetch');
 
     $min_key = self::getRateLimitMinKey();
 
     // Identify the oldest bucket stored in APC.
     $cur = self::getRateLimitBucket();
     if ($is_apcu) {
       $min = apcu_fetch($min_key);
     } else {
       $min = apc_fetch($min_key);
     }
 
     // If we don't have any buckets stored yet, store the current bucket as
     // the oldest bucket.
     if (!$min) {
       if ($is_apcu) {
         apcu_store($min_key, $cur);
       } else {
         apc_store($min_key, $cur);
       }
       $min = $cur;
     }
 
     // Destroy any buckets that are older than the minimum bucket we're keeping
     // track of. Under load this normally shouldn't do anything, but will clean
     // up an old bucket once per minute.
     $count = self::getRateLimitBucketCount();
     for ($cursor = $min; $cursor < ($cur - $count); $cursor++) {
       $bucket_key = self::getRateLimitBucketKey($cursor);
       if ($is_apcu) {
         apcu_delete($bucket_key);
         apcu_store($min_key, $cursor + 1);
       } else {
         apc_delete($bucket_key);
         apc_store($min_key, $cursor + 1);
       }
     }
 
     // Now, sum up the user's scores in all of the active buckets.
     $score = 0;
     for (; $cursor <= $cur; $cursor++) {
       $bucket_key = self::getRateLimitBucketKey($cursor);
       if ($is_apcu) {
         $bucket = apcu_fetch($bucket_key);
       } else {
         $bucket = apc_fetch($bucket_key);
       }
       if (isset($bucket[$user_identity])) {
         $score += $bucket[$user_identity];
       }
     }
 
     return $score;
   }
 
 
   /**
    * Emit an HTTP 429 "Too Many Requests" response (indicating that the user
    * has exceeded application rate limits) and exit.
    *
    * @return exit This method **does not return**.
    * @task ratelimit
    */
   private static function didRateLimit($user_identity, $score, $limit) {
     $message =
       "TOO MANY REQUESTS\n".
       "You (\"{$user_identity}\") are issuing too many requests ".
       "too quickly.\n";
 
     header(
       'Content-Type: text/plain; charset=utf-8',
       $replace = true,
       $http_error = 429);
 
     echo $message;
 
     exit(1);
   }
 
 
 /* -(  Startup Timers  )----------------------------------------------------- */
 
 
   /**
    * Record the beginning of a new startup phase.
    *
    * For phases which occur before @{class:PhabricatorStartup} loads, save the
    * time and record it with @{method:recordStartupPhase} after the class is
    * available.
    *
    * @param string Phase name.
    * @task phases
    */
   public static function beginStartupPhase($phase) {
     self::recordStartupPhase($phase, microtime(true));
   }
 
 
   /**
    * Record the start time of a previously executed startup phase.
    *
    * For startup phases which occur after @{class:PhabricatorStartup} loads,
    * use @{method:beginStartupPhase} instead. This method can be used to
    * record a time before the class loads, then hand it over once the class
    * becomes available.
    *
    * @param string Phase name.
    * @param float Phase start time, from `microtime(true)`.
    * @task phases
    */
   public static function recordStartupPhase($phase, $time) {
     self::$phases[$phase] = $time;
   }
 
 
   /**
    * Get information about startup phase timings.
    *
    * Sometimes, performance problems can occur before we start the profiler.
    * Since the profiler can't examine these phases, it isn't useful in
    * understanding their performance costs.
    *
    * Instead, the startup process marks when it enters various phases using
    * @{method:beginStartupPhase}. A later call to this method can retrieve this
    * information, which can be examined to gain greater insight into where
    * time was spent. The output is still crude, but better than nothing.
    *
    * @task phases
    */
   public static function getPhases() {
     return self::$phases;
   }
 
 }