diff --git a/scripts/util/add_macro.php b/scripts/util/add_macro.php
index e2b9ea560..cbfe8480f 100755
--- a/scripts/util/add_macro.php
+++ b/scripts/util/add_macro.php
@@ -1,64 +1,65 @@
 #!/usr/bin/env php
 <?php
 
 $root = dirname(dirname(dirname(__FILE__)));
 require_once $root.'/scripts/__init_script__.php';
 
 $args = new PhutilArgumentParser($argv);
 $args->setTagline('load files as image macros');
 $args->setSynopsis(<<<EOHELP
 **add_macro.php** __image__ [--as __name__]
     Add an image macro. This can be useful for importing a large number
     of macros.
 EOHELP
 );
 $args->parseStandardArguments();
 
 $args->parse(
   array(
     array(
       'name'  => 'as',
       'param' => 'name',
       'help'  => 'Use a specific name instead of the first part of the image '.
                  'name.',
     ),
     array(
       'name'      => 'more',
       'wildcard'  => true,
     ),
   ));
 
 $more = $args->getArg('more');
 if (count($more) !== 1) {
   $args->printHelpAndExit();
 }
 
 $path = head($more);
 $data = Filesystem::readFile($path);
 
 $name = $args->getArg('as');
 if ($name === null) {
   $name = head(explode('.', basename($path)));
 }
 
 $existing = id(new PhabricatorFileImageMacro())->loadOneWhere(
   'name = %s',
   $name);
 if ($existing) {
   throw new Exception("A macro already exists with the name '{$name}'!");
 }
 
 $file = PhabricatorFile::newFromFileData(
   $data,
   array(
     'name' => basename($path),
+    'canCDN' => true,
   ));
 
 $macro = id(new PhabricatorFileImageMacro())
   ->setFilePHID($file->getPHID())
   ->setName($name)
   ->save();
 
 $id = $file->getID();
 
 echo "Added macro '{$name}' (F{$id}).\n";
diff --git a/src/applications/auth/provider/PhabricatorAuthProvider.php b/src/applications/auth/provider/PhabricatorAuthProvider.php
index 0c7948ed1..9daae24df 100644
--- a/src/applications/auth/provider/PhabricatorAuthProvider.php
+++ b/src/applications/auth/provider/PhabricatorAuthProvider.php
@@ -1,485 +1,486 @@
 <?php
 
 abstract class PhabricatorAuthProvider {
 
   private $providerConfig;
 
   public function attachProviderConfig(PhabricatorAuthProviderConfig $config) {
     $this->providerConfig = $config;
     return $this;
   }
 
   public function hasProviderConfig() {
     return (bool)$this->providerConfig;
   }
 
   public function getProviderConfig() {
     if ($this->providerConfig === null) {
       throw new Exception(
         'Call attachProviderConfig() before getProviderConfig()!');
     }
     return $this->providerConfig;
   }
 
   public function getConfigurationHelp() {
     return null;
   }
 
   public function getDefaultProviderConfig() {
     return id(new PhabricatorAuthProviderConfig())
       ->setProviderClass(get_class($this))
       ->setIsEnabled(1)
       ->setShouldAllowLogin(1)
       ->setShouldAllowRegistration(1)
       ->setShouldAllowLink(1)
       ->setShouldAllowUnlink(1);
   }
 
   public function getNameForCreate() {
     return $this->getProviderName();
   }
 
   public function getDescriptionForCreate() {
     return null;
   }
 
   public function getProviderKey() {
     return $this->getAdapter()->getAdapterKey();
   }
 
   public function getProviderType() {
     return $this->getAdapter()->getAdapterType();
   }
 
   public function getProviderDomain() {
     return $this->getAdapter()->getAdapterDomain();
   }
 
   public static function getAllBaseProviders() {
     static $providers;
 
     if ($providers === null) {
       $objects = id(new PhutilSymbolLoader())
         ->setAncestorClass(__CLASS__)
         ->loadObjects();
       $providers = $objects;
     }
 
     return $providers;
   }
 
   public static function getAllProviders() {
     static $providers;
 
     if ($providers === null) {
       $objects = self::getAllBaseProviders();
 
       $configs = id(new PhabricatorAuthProviderConfigQuery())
         ->setViewer(PhabricatorUser::getOmnipotentUser())
         ->execute();
 
       $providers = array();
       foreach ($configs as $config) {
         if (!isset($objects[$config->getProviderClass()])) {
           // This configuration is for a provider which is not installed.
           continue;
         }
 
         $object = clone $objects[$config->getProviderClass()];
         $object->attachProviderConfig($config);
 
         $key = $object->getProviderKey();
         if (isset($providers[$key])) {
           throw new Exception(
             pht(
               "Two authentication providers use the same provider key ".
               "('%s'). Each provider must be identified by a unique key.",
               $key));
         }
         $providers[$key] = $object;
       }
     }
 
     return $providers;
   }
 
   public static function getAllEnabledProviders() {
     $providers = self::getAllProviders();
     foreach ($providers as $key => $provider) {
       if (!$provider->isEnabled()) {
         unset($providers[$key]);
       }
     }
     return $providers;
   }
 
   public static function getEnabledProviderByKey($provider_key) {
     return idx(self::getAllEnabledProviders(), $provider_key);
   }
 
   abstract public function getProviderName();
   abstract public function getAdapter();
 
   public function isEnabled() {
     return $this->getProviderConfig()->getIsEnabled();
   }
 
   public function shouldAllowLogin() {
     return $this->getProviderConfig()->getShouldAllowLogin();
   }
 
   public function shouldAllowRegistration() {
     return $this->getProviderConfig()->getShouldAllowRegistration();
   }
 
   public function shouldAllowAccountLink() {
     return $this->getProviderConfig()->getShouldAllowLink();
   }
 
   public function shouldAllowAccountUnlink() {
     return $this->getProviderConfig()->getShouldAllowUnlink();
   }
 
   public function shouldTrustEmails() {
     return $this->shouldAllowEmailTrustConfiguration() &&
            $this->getProviderConfig()->getShouldTrustEmails();
   }
 
   /**
    * Should we allow the adapter to be marked as "trusted". This is true for
    * all adapters except those that allow the user to type in emails (see
    * @{class:PhabricatorPasswordAuthProvider}).
    */
   public function shouldAllowEmailTrustConfiguration() {
     return true;
   }
 
   public function buildLoginForm(PhabricatorAuthStartController $controller) {
     return $this->renderLoginForm($controller->getRequest(), $mode = 'start');
   }
 
   abstract public function processLoginRequest(
     PhabricatorAuthLoginController $controller);
 
   public function buildLinkForm(PhabricatorAuthLinkController $controller) {
     return $this->renderLoginForm($controller->getRequest(), $mode = 'link');
   }
 
   public function shouldAllowAccountRefresh() {
     return true;
   }
 
   public function buildRefreshForm(
     PhabricatorAuthLinkController $controller) {
     return $this->renderLoginForm($controller->getRequest(), $mode = 'refresh');
   }
 
   protected function renderLoginForm(AphrontRequest $request, $mode) {
     throw new PhutilMethodNotImplementedException();
   }
 
   public function createProviders() {
     return array($this);
   }
 
   protected function willSaveAccount(PhabricatorExternalAccount $account) {
     return;
   }
 
   public function willRegisterAccount(PhabricatorExternalAccount $account) {
     return;
   }
 
   protected function loadOrCreateAccount($account_id) {
     if (!strlen($account_id)) {
       throw new Exception('loadOrCreateAccount(...): empty account ID!');
     }
 
     $adapter = $this->getAdapter();
     $adapter_class = get_class($adapter);
 
     if (!strlen($adapter->getAdapterType())) {
       throw new Exception(
         "AuthAdapter (of class '{$adapter_class}') has an invalid ".
         "implementation: no adapter type.");
     }
 
     if (!strlen($adapter->getAdapterDomain())) {
       throw new Exception(
         "AuthAdapter (of class '{$adapter_class}') has an invalid ".
         "implementation: no adapter domain.");
     }
 
     $account = id(new PhabricatorExternalAccount())->loadOneWhere(
       'accountType = %s AND accountDomain = %s AND accountID = %s',
       $adapter->getAdapterType(),
       $adapter->getAdapterDomain(),
       $account_id);
     if (!$account) {
       $account = id(new PhabricatorExternalAccount())
         ->setAccountType($adapter->getAdapterType())
         ->setAccountDomain($adapter->getAdapterDomain())
         ->setAccountID($account_id);
     }
 
     $account->setUsername($adapter->getAccountName());
     $account->setRealName($adapter->getAccountRealName());
     $account->setEmail($adapter->getAccountEmail());
     $account->setAccountURI($adapter->getAccountURI());
 
     $account->setProfileImagePHID(null);
     $image_uri = $adapter->getAccountImageURI();
     if ($image_uri) {
       try {
         $name = PhabricatorSlug::normalize($this->getProviderName());
         $name = $name.'-profile.jpg';
 
         // TODO: If the image has not changed, we do not need to make a new
         // file entry for it, but there's no convenient way to do this with
         // PhabricatorFile right now. The storage will get shared, so the impact
         // here is negligible.
         $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
           $image_file = PhabricatorFile::newFromFileDownload(
             $image_uri,
             array(
               'name' => $name,
+              'canCDN' => true
             ));
         unset($unguarded);
 
         if ($image_file) {
           $account->setProfileImagePHID($image_file->getPHID());
         }
       } catch (Exception $ex) {
         // Log this but proceed, it's not especially important that we
         // be able to pull profile images.
         phlog($ex);
       }
     }
 
     $this->willSaveAccount($account);
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
     $account->save();
     unset($unguarded);
 
     return $account;
   }
 
   public function getLoginURI() {
     $app = PhabricatorApplication::getByClass('PhabricatorAuthApplication');
     return $app->getApplicationURI('/login/'.$this->getProviderKey().'/');
   }
 
   public function getSettingsURI() {
     return '/settings/panel/external/';
   }
 
   public function getStartURI() {
     $app = PhabricatorApplication::getByClass('PhabricatorAuthApplication');
     $uri = $app->getApplicationURI('/start/');
     return $uri;
   }
 
   public function isDefaultRegistrationProvider() {
     return false;
   }
 
   public function shouldRequireRegistrationPassword() {
     return false;
   }
 
   public function getDefaultExternalAccount() {
     throw new PhutilMethodNotImplementedException();
   }
 
   public function getLoginOrder() {
     return '500-'.$this->getProviderName();
   }
 
   protected function getLoginIcon() {
     return 'Generic';
   }
 
   public function isLoginFormAButton() {
     return false;
   }
 
   public function renderConfigPropertyTransactionTitle(
     PhabricatorAuthProviderConfigTransaction $xaction) {
 
     return null;
   }
 
   public function readFormValuesFromProvider() {
     return array();
   }
 
   public function readFormValuesFromRequest(AphrontRequest $request) {
     return array();
   }
 
   public function processEditForm(
     AphrontRequest $request,
     array $values) {
 
     $errors = array();
     $issues = array();
 
     return array($errors, $issues, $values);
   }
 
   public function extendEditForm(
     AphrontRequest $request,
     AphrontFormView $form,
     array $values,
     array $issues) {
 
     return;
   }
 
   public function willRenderLinkedAccount(
     PhabricatorUser $viewer,
     PHUIObjectItemView $item,
     PhabricatorExternalAccount $account) {
 
     $account_view = id(new PhabricatorAuthAccountView())
       ->setExternalAccount($account)
       ->setAuthProvider($this);
 
     $item->appendChild(
       phutil_tag(
         'div',
         array(
           'class' => 'mmr mml mst mmb',
         ),
         $account_view));
   }
 
   /**
    * Return true to use a two-step configuration (setup, configure) instead of
    * the default single-step configuration. In practice, this means that
    * creating a new provider instance will redirect back to the edit page
    * instead of the provider list.
    *
    * @return bool True if this provider uses two-step configuration.
    */
   public function hasSetupStep() {
     return false;
   }
 
   /**
    * Render a standard login/register button element.
    *
    * The `$attributes` parameter takes these keys:
    *
    *   - `uri`: URI the button should take the user to when clicked.
    *   - `method`: Optional HTTP method the button should use, defaults to GET.
    *
    * @param   AphrontRequest  HTTP request.
    * @param   string          Request mode string.
    * @param   map             Additional parameters, see above.
    * @return  wild            Login button.
    */
   protected function renderStandardLoginButton(
     AphrontRequest $request,
     $mode,
     array $attributes = array()) {
 
     PhutilTypeSpec::checkMap(
       $attributes,
       array(
         'method' => 'optional string',
         'uri' => 'string',
         'sigil' => 'optional string',
       ));
 
     $viewer = $request->getUser();
     $adapter = $this->getAdapter();
 
     if ($mode == 'link') {
       $button_text = pht('Link External Account');
     } else if ($mode == 'refresh') {
       $button_text = pht('Refresh Account Link');
     } else if ($this->shouldAllowRegistration()) {
       $button_text = pht('Login or Register');
     } else {
       $button_text = pht('Login');
     }
 
     $icon = id(new PHUIIconView())
       ->setSpriteSheet(PHUIIconView::SPRITE_LOGIN)
       ->setSpriteIcon($this->getLoginIcon());
 
     $button = id(new PHUIButtonView())
       ->setSize(PHUIButtonView::BIG)
       ->setColor(PHUIButtonView::GREY)
       ->setIcon($icon)
       ->setText($button_text)
       ->setSubtext($this->getProviderName());
 
     $uri = $attributes['uri'];
     $uri = new PhutilURI($uri);
     $params = $uri->getQueryParams();
     $uri->setQueryParams(array());
 
     $content = array($button);
 
     foreach ($params as $key => $value) {
       $content[] = phutil_tag(
         'input',
         array(
           'type' => 'hidden',
           'name' => $key,
           'value' => $value,
         ));
     }
 
     return phabricator_form(
       $viewer,
       array(
         'method' => idx($attributes, 'method', 'GET'),
         'action' => (string)$uri,
         'sigil'  => idx($attributes, 'sigil'),
       ),
       $content);
   }
 
   public function renderConfigurationFooter() {
     return null;
   }
 
   protected function getAuthCSRFCode(AphrontRequest $request) {
     $phcid = $request->getCookie(PhabricatorCookies::COOKIE_CLIENTID);
     if (!strlen($phcid)) {
       throw new Exception(
         pht(
           'Your browser did not submit a "%s" cookie with client state '.
           'information in the request. Check that cookies are enabled. '.
           'If this problem persists, you may need to clear your cookies.',
           PhabricatorCookies::COOKIE_CLIENTID));
     }
 
     return PhabricatorHash::digest($phcid);
   }
 
   protected function verifyAuthCSRFCode(AphrontRequest $request, $actual) {
     $expect = $this->getAuthCSRFCode($request);
 
     if (!strlen($actual)) {
       throw new Exception(
         pht(
           'The authentication provider did not return a client state '.
           'parameter in its response, but one was expected. If this '.
           'problem persists, you may need to clear your cookies.'));
     }
 
     if ($actual !== $expect) {
       throw new Exception(
         pht(
           'The authentication provider did not return the correct client '.
           'state parameter in its response. If this problem persists, you may '.
           'need to clear your cookies.'));
     }
   }
 
 }
diff --git a/src/applications/files/PhabricatorImageTransformer.php b/src/applications/files/PhabricatorImageTransformer.php
index 586583c2b..e13494dd6 100644
--- a/src/applications/files/PhabricatorImageTransformer.php
+++ b/src/applications/files/PhabricatorImageTransformer.php
@@ -1,656 +1,661 @@
 <?php
 
 /**
  * @task enormous Detecting Enormous Images
  * @task save     Saving Image Data
  */
 final class PhabricatorImageTransformer {
 
   public function executeMemeTransform(
     PhabricatorFile $file,
     $upper_text,
     $lower_text) {
     $image = $this->applyMemeToFile($file, $upper_text, $lower_text);
     return PhabricatorFile::newFromFileData(
       $image,
       array(
         'name' => 'meme-'.$file->getName(),
         'ttl' => time() + 60 * 60 * 24,
+        'canCDN' => true,
       ));
   }
 
   public function executeThumbTransform(
     PhabricatorFile $file,
     $x,
     $y) {
 
     $image = $this->crudelyScaleTo($file, $x, $y);
 
     return PhabricatorFile::newFromFileData(
       $image,
       array(
         'name' => 'thumb-'.$file->getName(),
+        'canCDN' => true,
       ));
   }
 
   public function executeProfileTransform(
     PhabricatorFile $file,
     $x,
     $min_y,
     $max_y) {
 
     $image = $this->crudelyCropTo($file, $x, $min_y, $max_y);
 
     return PhabricatorFile::newFromFileData(
       $image,
       array(
         'name' => 'profile-'.$file->getName(),
+        'canCDN' => true,
       ));
   }
 
   public function executePreviewTransform(
     PhabricatorFile $file,
     $size) {
 
     $image = $this->generatePreview($file, $size);
 
     return PhabricatorFile::newFromFileData(
       $image,
       array(
         'name' => 'preview-'.$file->getName(),
+        'canCDN' => true,
       ));
   }
 
   public function executeConpherenceTransform(
     PhabricatorFile $file,
     $top,
     $left,
     $width,
     $height) {
 
     $image = $this->crasslyCropTo(
       $file,
       $top,
       $left,
       $width,
       $height);
 
     return PhabricatorFile::newFromFileData(
       $image,
       array(
         'name' => 'conpherence-'.$file->getName(),
+        'canCDN' => true,
       ));
   }
 
   private function crudelyCropTo(PhabricatorFile $file, $x, $min_y, $max_y) {
     $data = $file->loadFileData();
     $img = imagecreatefromstring($data);
     $sx = imagesx($img);
     $sy = imagesy($img);
 
     $scaled_y = ($x / $sx) * $sy;
     if ($scaled_y > $max_y) {
       // This image is very tall and thin.
       $scaled_y = $max_y;
     } else if ($scaled_y < $min_y) {
       // This image is very short and wide.
       $scaled_y = $min_y;
     }
 
     $cropped = $this->applyScaleWithImagemagick($file, $x, $scaled_y);
     if ($cropped != null) {
       return $cropped;
     }
 
     $img = $this->applyScaleTo(
       $file,
       $x,
       $scaled_y);
 
     return self::saveImageDataInAnyFormat($img, $file->getMimeType());
   }
 
   private function crasslyCropTo(PhabricatorFile $file, $top, $left, $w, $h) {
     $data = $file->loadFileData();
     $src = imagecreatefromstring($data);
     $dst = $this->getBlankDestinationFile($w, $h);
 
     $scale = self::getScaleForCrop($file, $w, $h);
     $orig_x = $left / $scale;
     $orig_y = $top / $scale;
     $orig_w = $w / $scale;
     $orig_h = $h / $scale;
 
     imagecopyresampled(
       $dst,
       $src,
       0, 0,
       $orig_x, $orig_y,
       $w, $h,
       $orig_w, $orig_h);
 
     return self::saveImageDataInAnyFormat($dst, $file->getMimeType());
   }
 
 
   /**
    * Very crudely scale an image up or down to an exact size.
    */
   private function crudelyScaleTo(PhabricatorFile $file, $dx, $dy) {
     $scaled = $this->applyScaleWithImagemagick($file, $dx, $dy);
 
     if ($scaled != null) {
       return $scaled;
     }
 
     $dst = $this->applyScaleTo($file, $dx, $dy);
     return self::saveImageDataInAnyFormat($dst, $file->getMimeType());
   }
 
   private function getBlankDestinationFile($dx, $dy) {
     $dst = imagecreatetruecolor($dx, $dy);
     imagesavealpha($dst, true);
     imagefill($dst, 0, 0, imagecolorallocatealpha($dst, 255, 255, 255, 127));
 
     return $dst;
   }
 
   private function applyScaleTo(PhabricatorFile $file, $dx, $dy) {
     $data = $file->loadFileData();
     $src = imagecreatefromstring($data);
 
     $x = imagesx($src);
     $y = imagesy($src);
 
     $scale = min(($dx / $x), ($dy / $y), 1);
 
     $sdx = $scale * $x;
     $sdy = $scale * $y;
 
     $dst = $this->getBlankDestinationFile($dx, $dy);
     imagesavealpha($dst, true);
     imagefill($dst, 0, 0, imagecolorallocatealpha($dst, 255, 255, 255, 127));
 
     imagecopyresampled(
       $dst,
       $src,
       ($dx - $sdx) / 2,  ($dy - $sdy) / 2,
       0, 0,
       $sdx, $sdy,
       $x, $y);
 
     return $dst;
 
   }
 
   public static function getPreviewDimensions(PhabricatorFile $file, $size) {
     $metadata = $file->getMetadata();
     $x = idx($metadata, PhabricatorFile::METADATA_IMAGE_WIDTH);
     $y = idx($metadata, PhabricatorFile::METADATA_IMAGE_HEIGHT);
 
     if (!$x || !$y) {
       $data = $file->loadFileData();
       $src = imagecreatefromstring($data);
 
       $x = imagesx($src);
       $y = imagesy($src);
     }
 
     $scale = min($size / $x, $size / $y, 1);
 
     $dx = max($size / 4, $scale * $x);
     $dy = max($size / 4, $scale * $y);
 
     $sdx = $scale * $x;
     $sdy = $scale * $y;
 
     return array(
       'x' => $x,
       'y' => $y,
       'dx' => $dx,
       'dy' => $dy,
       'sdx' => $sdx,
       'sdy' => $sdy
     );
   }
 
   public static function getScaleForCrop(
     PhabricatorFile $file,
     $des_width,
     $des_height) {
 
     $metadata = $file->getMetadata();
     $width = $metadata[PhabricatorFile::METADATA_IMAGE_WIDTH];
     $height = $metadata[PhabricatorFile::METADATA_IMAGE_HEIGHT];
 
     if ($height < $des_height) {
       $scale = $height / $des_height;
     } else if ($width < $des_width) {
       $scale = $width / $des_width;
     } else {
       $scale_x = $des_width / $width;
       $scale_y = $des_height / $height;
       $scale = max($scale_x, $scale_y);
     }
 
     return $scale;
   }
 
   private function generatePreview(PhabricatorFile $file, $size) {
     $data = $file->loadFileData();
     $src = imagecreatefromstring($data);
 
     $dimensions = self::getPreviewDimensions($file, $size);
     $x = $dimensions['x'];
     $y = $dimensions['y'];
     $dx = $dimensions['dx'];
     $dy = $dimensions['dy'];
     $sdx = $dimensions['sdx'];
     $sdy = $dimensions['sdy'];
 
     $dst = $this->getBlankDestinationFile($dx, $dy);
 
     imagecopyresampled(
       $dst,
       $src,
       ($dx - $sdx) / 2, ($dy - $sdy) / 2,
       0, 0,
       $sdx, $sdy,
       $x, $y);
 
     return self::saveImageDataInAnyFormat($dst, $file->getMimeType());
   }
 
   private function applyMemeToFile(
     PhabricatorFile $file,
     $upper_text,
     $lower_text) {
     $data = $file->loadFileData();
 
     $img_type = $file->getMimeType();
     $imagemagick = PhabricatorEnv::getEnvConfig('files.enable-imagemagick');
 
     if ($img_type != 'image/gif' || $imagemagick == false) {
       return $this->applyMemeTo(
         $data, $upper_text, $lower_text, $img_type);
     }
 
     $data = $file->loadFileData();
     $input = new TempFile();
     Filesystem::writeFile($input, $data);
 
     list($out) = execx('convert %s info:', $input);
     $split = phutil_split_lines($out);
     if (count($split) > 1) {
       return $this->applyMemeWithImagemagick(
         $input,
         $upper_text,
         $lower_text,
         count($split),
         $img_type);
     } else {
       return $this->applyMemeTo($data, $upper_text, $lower_text, $img_type);
     }
   }
 
   private function applyMemeTo(
     $data,
     $upper_text,
     $lower_text,
     $mime_type) {
     $img = imagecreatefromstring($data);
 
     // Some PNGs have color palettes, and allocating the dark border color
     // fails and gives us whatever's first in the color table. Copy the image
     // to a fresh truecolor canvas before working with it.
 
     $truecolor = imagecreatetruecolor(imagesx($img), imagesy($img));
     imagecopy($truecolor, $img, 0, 0, 0, 0, imagesx($img), imagesy($img));
     $img = $truecolor;
 
     $phabricator_root = dirname(phutil_get_library_root('phabricator'));
     $font_root = $phabricator_root.'/resources/font/';
     $font_path = $font_root.'tuffy.ttf';
     if (Filesystem::pathExists($font_root.'impact.ttf')) {
       $font_path = $font_root.'impact.ttf';
     }
     $text_color = imagecolorallocate($img, 255, 255, 255);
     $border_color = imagecolorallocatealpha($img, 0, 0, 0, 110);
     $border_width = 4;
     $font_max = 200;
     $font_min = 5;
     for ($i = $font_max; $i > $font_min; $i--) {
       $fit = $this->doesTextBoundingBoxFitInImage(
         $img,
         $upper_text,
         $i,
         $font_path);
       if ($fit['doesfit']) {
         $x = ($fit['imgwidth'] - $fit['txtwidth']) / 2;
         $y = $fit['txtheight'] + 10;
         $this->makeImageWithTextBorder($img,
           $i,
           $x,
           $y,
           $text_color,
           $border_color,
           $border_width,
           $font_path,
           $upper_text);
         break;
       }
     }
     for ($i = $font_max; $i > $font_min; $i--) {
       $fit = $this->doesTextBoundingBoxFitInImage($img,
         $lower_text, $i, $font_path);
       if ($fit['doesfit']) {
         $x = ($fit['imgwidth'] - $fit['txtwidth']) / 2;
         $y = $fit['imgheight'] - 10;
         $this->makeImageWithTextBorder(
           $img,
           $i,
           $x,
           $y,
           $text_color,
           $border_color,
           $border_width,
           $font_path,
           $lower_text);
         break;
       }
     }
     return self::saveImageDataInAnyFormat($img, $mime_type);
   }
 
   private function makeImageWithTextBorder($img, $font_size, $x, $y,
     $color, $stroke_color, $bw, $font, $text) {
     $angle = 0;
     $bw = abs($bw);
     for ($c1 = $x - $bw; $c1 <= $x + $bw; $c1++) {
       for ($c2 = $y - $bw; $c2 <= $y + $bw; $c2++) {
         if (!(($c1 == $x - $bw || $x + $bw) &&
           $c2 == $y - $bw || $c2 == $y + $bw)) {
           $bg = imagettftext($img, $font_size,
             $angle, $c1, $c2, $stroke_color, $font, $text);
           }
         }
       }
     imagettftext($img, $font_size, $angle,
             $x , $y, $color , $font, $text);
   }
 
   private function doesTextBoundingBoxFitInImage($img,
     $text, $font_size, $font_path) {
     // Default Angle = 0
     $angle = 0;
 
     $bbox = imagettfbbox($font_size, $angle, $font_path, $text);
     $text_height = abs($bbox[3] - $bbox[5]);
     $text_width = abs($bbox[0] - $bbox[2]);
     return array(
       'doesfit' => ($text_height * 1.05 <= imagesy($img) / 2
         && $text_width * 1.05 <= imagesx($img)),
       'txtwidth' => $text_width,
       'txtheight' => $text_height,
       'imgwidth' => imagesx($img),
       'imgheight' => imagesy($img),
     );
   }
 
   private function applyScaleWithImagemagick(PhabricatorFile $file, $dx, $dy) {
     $img_type = $file->getMimeType();
     $imagemagick = PhabricatorEnv::getEnvConfig('files.enable-imagemagick');
 
     if ($img_type != 'image/gif' || $imagemagick == false) {
       return null;
     }
 
     $data = $file->loadFileData();
     $src = imagecreatefromstring($data);
 
     $x = imagesx($src);
     $y = imagesy($src);
 
     if (self::isEnormousGIF($x, $y)) {
       return null;
     }
 
     $scale = min(($dx / $x), ($dy / $y), 1);
 
     $sdx = $scale * $x;
     $sdy = $scale * $y;
 
     $input = new TempFile();
     Filesystem::writeFile($input, $data);
 
     $resized = new TempFile();
 
     $future = new ExecFuture(
       'convert %s -coalesce -resize %sX%s%s %s',
       $input,
       $sdx,
       $sdy,
       '!',
       $resized);
 
     // Don't spend more than 10 seconds resizing; just fail if it takes longer
     // than that.
     $future->setTimeout(10)->resolvex();
 
     return Filesystem::readFile($resized);
   }
 
   private function applyMemeWithImagemagick(
     $input,
     $above,
     $below,
     $count,
     $img_type) {
 
     $output = new TempFile();
     $future = new ExecFuture(
       'convert %s -coalesce +adjoin %s_%s',
       $input,
       $input,
       '%09d');
     $future->setTimeout(10)->resolvex();
 
     $output_files = array();
     for ($ii = 0; $ii < $count; $ii++) {
       $frame_name = sprintf('%s_%09d', $input, $ii);
       $output_name = sprintf('%s_%09d', $output, $ii);
 
       $output_files[] = $output_name;
 
       $frame_data = Filesystem::readFile($frame_name);
       $memed_frame_data = $this->applyMemeTo(
         $frame_data,
         $above,
         $below,
         $img_type);
       Filesystem::writeFile($output_name, $memed_frame_data);
     }
 
     $future = new ExecFuture('convert -loop 0 %Ls %s', $output_files, $output);
     $future->setTimeout(10)->resolvex();
 
     return Filesystem::readFile($output);
   }
 
 /* -(  Detecting Enormous Files  )------------------------------------------- */
 
 
   /**
    * Determine if an image is enormous (too large to transform).
    *
    * Attackers can perform a denial of service attack by uploading highly
    * compressible images with enormous dimensions but a very small filesize.
    * Transforming them (e.g., into thumbnails) may consume huge quantities of
    * memory and CPU relative to the resources required to transmit the file.
    *
    * In general, we respond to these images by declining to transform them, and
    * using a default thumbnail instead.
    *
    * @param int Width of the image, in pixels.
    * @param int Height of the image, in pixels.
    * @return bool True if this image is enormous (too large to transform).
    * @task enormous
    */
   public static function isEnormousImage($x, $y) {
     // This is just a sanity check, but if we don't have valid dimensions we
     // shouldn't be trying to transform the file.
     if (($x <= 0) || ($y <= 0)) {
       return true;
     }
 
     return ($x * $y) > (4096 * 4096);
   }
 
 
   /**
    * Determine if a GIF is enormous (too large to transform).
    *
    * For discussion, see @{method:isEnormousImage}. We need to be more
    * careful about GIFs, because they can also have a large number of frames
    * despite having a very small filesize. We're more conservative about
    * calling GIFs enormous than about calling images in general enormous.
    *
    * @param int Width of the GIF, in pixels.
    * @param int Height of the GIF, in pixels.
    * @return bool True if this image is enormous (too large to transform).
    * @task enormous
    */
   public static function isEnormousGIF($x, $y) {
     if (self::isEnormousImage($x, $y)) {
       return true;
     }
 
     return ($x * $y) > (800 * 800);
   }
 
 
 /* -(  Saving Image Data  )-------------------------------------------------- */
 
 
   /**
    * Save an image resource to a string representation suitable for storage or
    * transmission as an image file.
    *
    * Optionally, you can specify a preferred MIME type like `"image/png"`.
    * Generally, you should specify the MIME type of the original file if you're
    * applying file transformations. The MIME type may not be honored if
    * Phabricator can not encode images in the given format (based on available
    * extensions), but can save images in another format.
    *
    * @param   resource  GD image resource.
    * @param   string?   Optionally, preferred mime type.
    * @return  string    Bytes of an image file.
    * @task save
    */
   public static function saveImageDataInAnyFormat($data, $preferred_mime = '') {
     $preferred = null;
     switch ($preferred_mime) {
       case 'image/gif':
         $preferred = self::saveImageDataAsGIF($data);
         break;
       case 'image/png':
         $preferred = self::saveImageDataAsPNG($data);
         break;
     }
 
     if ($preferred !== null) {
       return $preferred;
     }
 
     $data = self::saveImageDataAsJPG($data);
     if ($data !== null) {
       return $data;
     }
 
     $data = self::saveImageDataAsPNG($data);
     if ($data !== null) {
       return $data;
     }
 
     $data = self::saveImageDataAsGIF($data);
     if ($data !== null) {
       return $data;
     }
 
     throw new Exception(pht('Failed to save image data into any format.'));
   }
 
 
   /**
    * Save an image in PNG format, returning the file data as a string.
    *
    * @param resource      GD image resource.
    * @return string|null  PNG file as a string, or null on failure.
    * @task save
    */
   private static function saveImageDataAsPNG($image) {
     if (!function_exists('imagepng')) {
       return null;
     }
 
     ob_start();
     $result = imagepng($image, null, 9);
     $output = ob_get_clean();
 
     if (!$result) {
       return null;
     }
 
     return $output;
   }
 
 
   /**
    * Save an image in GIF format, returning the file data as a string.
    *
    * @param resource      GD image resource.
    * @return string|null  GIF file as a string, or null on failure.
    * @task save
    */
   private static function saveImageDataAsGIF($image) {
     if (!function_exists('imagegif')) {
       return null;
     }
 
     ob_start();
     $result = imagegif($image);
     $output = ob_get_clean();
 
     if (!$result) {
       return null;
     }
 
     return $output;
   }
 
 
   /**
    * Save an image in JPG format, returning the file data as a string.
    *
    * @param resource      GD image resource.
    * @return string|null  JPG file as a string, or null on failure.
    * @task save
    */
   private static function saveImageDataAsJPG($image) {
     if (!function_exists('imagejpeg')) {
       return null;
     }
 
     ob_start();
     $result = imagejpeg($image);
     $output = ob_get_clean();
 
     if (!$result) {
       return null;
     }
 
     return $output;
   }
 
 
 }
diff --git a/src/applications/files/controller/PhabricatorFileComposeController.php b/src/applications/files/controller/PhabricatorFileComposeController.php
index ec27ea836..d698509e9 100644
--- a/src/applications/files/controller/PhabricatorFileComposeController.php
+++ b/src/applications/files/controller/PhabricatorFileComposeController.php
@@ -1,249 +1,250 @@
 <?php
 
 final class PhabricatorFileComposeController
   extends PhabricatorFileController {
 
   public function processRequest() {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
     $colors = array(
       'red' => pht('Verbillion'),
       'orange' => pht('Navel Orange'),
       'yellow' => pht('Prim Goldenrod'),
       'green' => pht('Lustrous Verdant'),
       'blue' => pht('Tropical Deep'),
       'sky' => pht('Wide Open Sky'),
       'indigo' => pht('Pleated Khaki'),
       'violet' => pht('Aged Merlot'),
       'charcoal' => pht('Gemstone'),
       'backdrop' => pht('Driven Snow'),
     );
 
     $manifest = PHUIIconView::getSheetManifest(PHUIIconView::SPRITE_PROJECTS);
 
     if ($request->isFormPost()) {
       $icon = $request->getStr('icon');
       $color = $request->getStr('color');
 
       if (isset($colors[$color]) && isset($manifest['projects-'.$icon])) {
         $root = dirname(phutil_get_library_root('phabricator'));
         $icon_file = $root.'/resources/sprite/projects_1x/'.$icon.'.png';
         $icon_data = Filesystem::readFile($icon_file);
 
 
         $data = $this->composeImage($color, $icon_data);
 
         $file = PhabricatorFile::buildFromFileDataOrHash(
           $data,
           array(
             'name' => 'project.png',
+            'canCDN' => true,
           ));
 
         $content = array(
           'phid' => $file->getPHID(),
         );
 
         return id(new AphrontAjaxResponse())->setContent($content);
       }
     }
 
     $value_color = head_key($colors);
     $value_icon = head_key($manifest);
     $value_icon = substr($value_icon, strlen('projects-'));
 
     require_celerity_resource('people-profile-css');
 
     $buttons = array();
     foreach ($colors as $color => $name) {
       $buttons[] = javelin_tag(
         'button',
         array(
           'class' => 'grey profile-image-button',
           'sigil' => 'has-tooltip compose-select-color',
           'style' => 'margin: 0 8px 8px 0',
           'meta' => array(
             'color' => $color,
             'tip' => $name,
           ),
         ),
         id(new PHUIIconView())
           ->addClass('compose-background-'.$color));
     }
 
     $icons = array();
 
     $icon_quips = array(
       '8ball' => pht('Take a Risk'),
       'alien' => pht('Foreign Interface'),
       'announce' => pht('Louder is Better'),
       'art' => pht('Unique Snowflake'),
       'award' => pht('Shooting Star'),
       'bacon' => pht('Healthy Vegetables'),
       'bandaid' => pht('Durable Infrastructure'),
       'beer' => pht('Healthy Vegetable Juice'),
       'bomb' => pht('Imminent Success'),
       'briefcase' => pht('Adventure Pack'),
       'bug' => pht('Costumed Egg'),
       'calendar' => pht('Everyone Loves Meetings'),
       'cloud' => pht('Water Cycle'),
       'coffee' => pht('Half-Whip Nonfat Soy Latte'),
       'creditcard' => pht('Expense It'),
       'death' => pht('Calcium Promotes Bone Health'),
       'desktop' => pht('Magical Portal'),
       'dropbox' => pht('Cardboard Box'),
       'education' => pht('Debt'),
       'experimental' => pht('CAUTION: Dangerous Chemicals'),
       'facebook' => pht('Popular Social Network'),
       'facility' => pht('Pollution Solves Problems'),
       'film' => pht('Actual Physical Film'),
       'forked' => pht('You Can\'t Eat Soup'),
       'games' => pht('Serious Business'),
       'ghost' => pht('Haunted'),
       'gift' => pht('Surprise!'),
       'globe' => pht('Scanner Sweep'),
       'golf' => pht('Business Meeting'),
       'heart' => pht('Undergoing a Major Surgery'),
       'intergalactic' => pht('Jupiter'),
       'lock' => pht('Extremely Secret'),
       'mail' => pht('Oragami'),
       'martini' => pht('Healthy Olive Drink'),
       'medical' => pht('Medic!'),
       'mobile' => pht('Cellular Telephone'),
       'music' => pht("\xE2\x99\xAB"),
       'news' => pht('Actual Physical Newspaper'),
       'orgchart' => pht('It\'s Good to be King'),
       'peoples' => pht('Angel and Devil'),
       'piechart' => pht('Actual Physical Pie'),
       'poison' => pht('Healthy Bone Juice'),
       'putabirdonit' => pht('Put a Bird On It'),
       'radiate' => pht('Radiant Beauty'),
       'savings' => pht('Oink Oink'),
       'search' => pht('Sleuthing'),
       'shield' => pht('Royal Crest'),
       'speed' => pht('Slow and Steady'),
       'sprint' => pht('Fire Exit'),
       'star' => pht('The More You Know'),
       'storage' => pht('Stack of Pancakes'),
       'tablet' => pht('Cellular Telephone For Giants'),
       'travel' => pht('Pretty Clearly an Airplane'),
       'twitter' => pht('Bird Stencil'),
       'warning' => pht('No Caution Required, Everything Looks Safe'),
       'whale' => pht('Friendly Walrus'),
     );
 
     foreach ($manifest as $icon => $spec) {
       $icon = substr($icon, strlen('projects-'));
 
       $icons[] = javelin_tag(
         'button',
         array(
           'class' => 'grey profile-image-button',
           'sigil' => 'has-tooltip compose-select-icon',
           'style' => 'margin: 0 8px 8px 0',
           'meta' => array(
             'icon' => $icon,
             'tip' => idx($icon_quips, $icon, $icon),
           ),
         ),
         id(new PHUIIconView())
           ->setSpriteIcon($icon)
           ->setSpriteSheet(PHUIIconView::SPRITE_PROJECTS));
     }
 
     $dialog_id = celerity_generate_unique_node_id();
     $color_input_id = celerity_generate_unique_node_id();;
     $icon_input_id = celerity_generate_unique_node_id();
     $preview_id = celerity_generate_unique_node_id();
 
     $preview = id(new PHUIIconView())
       ->setID($preview_id)
       ->addClass('compose-background-'.$value_color)
       ->setSpriteIcon($value_icon)
       ->setSpriteSheet(PHUIIconView::SPRITE_PROJECTS);
 
     $color_input = javelin_tag(
       'input',
       array(
         'type' => 'hidden',
         'name' => 'color',
         'value' => $value_color,
         'id' => $color_input_id,
       ));
 
     $icon_input = javelin_tag(
       'input',
       array(
         'type' => 'hidden',
         'name' => 'icon',
         'value' => $value_icon,
         'id' => $icon_input_id,
       ));
 
     Javelin::initBehavior('phabricator-tooltips');
     Javelin::initBehavior(
       'icon-composer',
       array(
         'dialogID' => $dialog_id,
         'colorInputID' => $color_input_id,
         'iconInputID' => $icon_input_id,
         'previewID' => $preview_id,
         'defaultColor' => $value_color,
         'defaultIcon' => $value_icon,
       ));
 
     $dialog = id(new AphrontDialogView())
       ->setUser($viewer)
       ->setFormID($dialog_id)
       ->setClass('compose-dialog')
       ->setTitle(pht('Compose Image'))
       ->appendChild(
         phutil_tag(
           'div',
           array(
             'class' => 'compose-header',
           ),
           pht('Choose Background Color')))
       ->appendChild($buttons)
       ->appendChild(
         phutil_tag(
           'div',
           array(
             'class' => 'compose-header',
           ),
           pht('Choose Icon')))
       ->appendChild($icons)
       ->appendChild(
         phutil_tag(
           'div',
           array(
             'class' => 'compose-header',
           ),
           pht('Preview')))
       ->appendChild($preview)
       ->appendChild($color_input)
       ->appendChild($icon_input)
       ->addCancelButton('/')
       ->addSubmitButton(pht('Save Image'));
 
     return id(new AphrontDialogResponse())->setDialog($dialog);
   }
 
   private function composeImage($color, $icon_data) {
     $icon_img = imagecreatefromstring($icon_data);
 
     $map = CelerityResourceTransformer::getCSSVariableMap();
     $color_string = idx($map, $color, '#ff00ff');
     $color_const = hexdec(trim($color_string, '#'));
 
     $canvas = imagecreatetruecolor(50, 50);
     imagefill($canvas, 0, 0, $color_const);
 
     imagecopy($canvas, $icon_img, 0, 0, 0, 0, 50, 50);
 
     return PhabricatorImageTransformer::saveImageDataInAnyFormat(
       $canvas,
       'image/png');
   }
 
 }
diff --git a/src/applications/files/storage/PhabricatorFile.php b/src/applications/files/storage/PhabricatorFile.php
index 5e45d8f62..5ba04f883 100644
--- a/src/applications/files/storage/PhabricatorFile.php
+++ b/src/applications/files/storage/PhabricatorFile.php
@@ -1,951 +1,1013 @@
 <?php
 
 final class PhabricatorFile extends PhabricatorFileDAO
   implements
     PhabricatorTokenReceiverInterface,
     PhabricatorSubscribableInterface,
     PhabricatorFlaggableInterface,
     PhabricatorPolicyInterface {
 
+  const ONETIME_TEMPORARY_TOKEN_TYPE = 'file:onetime';
   const STORAGE_FORMAT_RAW  = 'raw';
 
   const METADATA_IMAGE_WIDTH  = 'width';
   const METADATA_IMAGE_HEIGHT = 'height';
+  const METADATA_CAN_CDN = 'cancdn';
 
   protected $name;
   protected $mimeType;
   protected $byteSize;
   protected $authorPHID;
   protected $secretKey;
   protected $contentHash;
   protected $metadata = array();
   protected $mailKey;
 
   protected $storageEngine;
   protected $storageFormat;
   protected $storageHandle;
 
   protected $ttl;
   protected $isExplicitUpload = 1;
   protected $viewPolicy = PhabricatorPolicies::POLICY_USER;
 
   private $objects = self::ATTACHABLE;
   private $objectPHIDs = self::ATTACHABLE;
 
   public function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
       self::CONFIG_SERIALIZATION => array(
         'metadata' => self::SERIALIZATION_JSON,
       ),
     ) + parent::getConfiguration();
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID(
       PhabricatorFileFilePHIDType::TYPECONST);
   }
 
   public function save() {
     if (!$this->getSecretKey()) {
       $this->setSecretKey($this->generateSecretKey());
     }
     if (!$this->getMailKey()) {
       $this->setMailKey(Filesystem::readRandomCharacters(20));
     }
     return parent::save();
   }
 
   public function getMonogram() {
     return 'F'.$this->getID();
   }
 
   public static function readUploadedFileData($spec) {
     if (!$spec) {
       throw new Exception('No file was uploaded!');
     }
 
     $err = idx($spec, 'error');
     if ($err) {
       throw new PhabricatorFileUploadException($err);
     }
 
     $tmp_name = idx($spec, 'tmp_name');
     $is_valid = @is_uploaded_file($tmp_name);
     if (!$is_valid) {
       throw new Exception('File is not an uploaded file.');
     }
 
     $file_data = Filesystem::readFile($tmp_name);
     $file_size = idx($spec, 'size');
 
     if (strlen($file_data) != $file_size) {
       throw new Exception('File size disagrees with uploaded size.');
     }
 
     self::validateFileSize(strlen($file_data));
 
     return $file_data;
   }
 
   public static function newFromPHPUpload($spec, array $params = array()) {
     $file_data = self::readUploadedFileData($spec);
 
     $file_name = nonempty(
       idx($params, 'name'),
       idx($spec,   'name'));
     $params = array(
       'name' => $file_name,
     ) + $params;
 
     return self::newFromFileData($file_data, $params);
   }
 
   public static function newFromXHRUpload($data, array $params = array()) {
     self::validateFileSize(strlen($data));
     return self::newFromFileData($data, $params);
   }
 
   private static function validateFileSize($size) {
     $limit = PhabricatorEnv::getEnvConfig('storage.upload-size-limit');
     if (!$limit) {
       return;
     }
 
     $limit = phutil_parse_bytes($limit);
     if ($size > $limit) {
       throw new PhabricatorFileUploadException(-1000);
     }
   }
 
 
   /**
    * Given a block of data, try to load an existing file with the same content
    * if one exists. If it does not, build a new file.
    *
    * This method is generally used when we have some piece of semi-trusted data
    * like a diff or a file from a repository that we want to show to the user.
    * We can't just dump it out because it may be dangerous for any number of
    * reasons; instead, we need to serve it through the File abstraction so it
    * ends up on the CDN domain if one is configured and so on. However, if we
    * simply wrote a new file every time we'd potentially end up with a lot
    * of redundant data in file storage.
    *
    * To solve these problems, we use file storage as a cache and reuse the
    * same file again if we've previously written it.
    *
    * NOTE: This method unguards writes.
    *
    * @param string  Raw file data.
    * @param dict    Dictionary of file information.
    */
   public static function buildFromFileDataOrHash(
     $data,
     array $params = array()) {
 
     $file = id(new PhabricatorFile())->loadOneWhere(
       'name = %s AND contentHash = %s LIMIT 1',
       self::normalizeFileName(idx($params, 'name')),
       self::hashFileContent($data));
 
     if (!$file) {
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       $file = PhabricatorFile::newFromFileData($data, $params);
       unset($unguarded);
     }
 
     return $file;
   }
 
   public static function newFileFromContentHash($hash, $params) {
     // Check to see if a file with same contentHash exist
     $file = id(new PhabricatorFile())->loadOneWhere(
       'contentHash = %s LIMIT 1', $hash);
 
     if ($file) {
       // copy storageEngine, storageHandle, storageFormat
       $copy_of_storage_engine = $file->getStorageEngine();
       $copy_of_storage_handle = $file->getStorageHandle();
       $copy_of_storage_format = $file->getStorageFormat();
       $copy_of_byteSize = $file->getByteSize();
       $copy_of_mimeType = $file->getMimeType();
 
       $file_name = idx($params, 'name');
       $file_name = self::normalizeFileName($file_name);
       $file_ttl = idx($params, 'ttl');
       $authorPHID = idx($params, 'authorPHID');
 
       $new_file = new PhabricatorFile();
 
       $new_file->setName($file_name);
       $new_file->setByteSize($copy_of_byteSize);
       $new_file->setAuthorPHID($authorPHID);
       $new_file->setTtl($file_ttl);
 
       if (idx($params, 'viewPolicy')) {
         $new_file->setViewPolicy($params['viewPolicy']);
       }
 
       $new_file->setContentHash($hash);
       $new_file->setStorageEngine($copy_of_storage_engine);
       $new_file->setStorageHandle($copy_of_storage_handle);
       $new_file->setStorageFormat($copy_of_storage_format);
       $new_file->setMimeType($copy_of_mimeType);
       $new_file->copyDimensions($file);
 
       $new_file->save();
 
       return $new_file;
     }
 
     return $file;
   }
 
   private static function buildFromFileData($data, array $params = array()) {
-    $selector = PhabricatorEnv::newObjectFromConfig('storage.engine-selector');
 
     if (isset($params['storageEngines'])) {
       $engines = $params['storageEngines'];
     } else {
       $selector = PhabricatorEnv::newObjectFromConfig(
         'storage.engine-selector');
       $engines = $selector->selectStorageEngines($data, $params);
     }
 
     assert_instances_of($engines, 'PhabricatorFileStorageEngine');
     if (!$engines) {
       throw new Exception('No valid storage engines are available!');
     }
 
     $file = new PhabricatorFile();
 
     $data_handle = null;
     $engine_identifier = null;
     $exceptions = array();
     foreach ($engines as $engine) {
       $engine_class = get_class($engine);
       try {
         list($engine_identifier, $data_handle) = $file->writeToEngine(
           $engine,
           $data,
           $params);
 
         // We stored the file somewhere so stop trying to write it to other
         // places.
         break;
       } catch (PhabricatorFileStorageConfigurationException $ex) {
         // If an engine is outright misconfigured (or misimplemented), raise
         // that immediately since it probably needs attention.
         throw $ex;
       } catch (Exception $ex) {
         phlog($ex);
 
         // If an engine doesn't work, keep trying all the other valid engines
         // in case something else works.
         $exceptions[$engine_class] = $ex;
       }
     }
 
     if (!$data_handle) {
       throw new PhutilAggregateException(
         'All storage engines failed to write file:',
         $exceptions);
     }
 
     $file_name = idx($params, 'name');
     $file_name = self::normalizeFileName($file_name);
     $file_ttl = idx($params, 'ttl');
 
     // If for whatever reason, authorPHID isn't passed as a param
     // (always the case with newFromFileDownload()), store a ''
     $authorPHID = idx($params, 'authorPHID');
 
     $file->setName($file_name);
     $file->setByteSize(strlen($data));
     $file->setAuthorPHID($authorPHID);
     $file->setTtl($file_ttl);
     $file->setContentHash(self::hashFileContent($data));
 
     if (idx($params, 'viewPolicy')) {
       $file->setViewPolicy($params['viewPolicy']);
     }
 
+    if (idx($params, 'canCDN')) {
+      $file->setCanCDN(true);
+    }
+
     $file->setStorageEngine($engine_identifier);
     $file->setStorageHandle($data_handle);
 
     // TODO: This is probably YAGNI, but allows for us to do encryption or
     // compression later if we want.
     $file->setStorageFormat(self::STORAGE_FORMAT_RAW);
     $file->setIsExplicitUpload(idx($params, 'isExplicitUpload') ? 1 : 0);
 
     if (isset($params['mime-type'])) {
       $file->setMimeType($params['mime-type']);
     } else {
       $tmp = new TempFile();
       Filesystem::writeFile($tmp, $data);
       $file->setMimeType(Filesystem::getMimeType($tmp));
     }
 
     try {
       $file->updateDimensions(false);
     } catch (Exception $ex) {
       // Do nothing
     }
 
     $file->save();
 
     return $file;
   }
 
   public static function newFromFileData($data, array $params = array()) {
     $hash = self::hashFileContent($data);
     $file = self::newFileFromContentHash($hash, $params);
 
     if ($file) {
       return $file;
     }
 
     return self::buildFromFileData($data, $params);
   }
 
   public function migrateToEngine(PhabricatorFileStorageEngine $engine) {
     if (!$this->getID() || !$this->getStorageHandle()) {
       throw new Exception(
         "You can not migrate a file which hasn't yet been saved.");
     }
 
     $data = $this->loadFileData();
     $params = array(
       'name' => $this->getName(),
     );
 
     list($new_identifier, $new_handle) = $this->writeToEngine(
       $engine,
       $data,
       $params);
 
     $old_engine = $this->instantiateStorageEngine();
     $old_handle = $this->getStorageHandle();
 
     $this->setStorageEngine($new_identifier);
     $this->setStorageHandle($new_handle);
     $this->save();
 
     $old_engine->deleteFile($old_handle);
 
     return $this;
   }
 
   private function writeToEngine(
     PhabricatorFileStorageEngine $engine,
     $data,
     array $params) {
 
     $engine_class = get_class($engine);
 
     $data_handle = $engine->writeFile($data, $params);
 
     if (!$data_handle || strlen($data_handle) > 255) {
       // This indicates an improperly implemented storage engine.
       throw new PhabricatorFileStorageConfigurationException(
         "Storage engine '{$engine_class}' executed writeFile() but did ".
         "not return a valid handle ('{$data_handle}') to the data: it ".
         "must be nonempty and no longer than 255 characters.");
     }
 
     $engine_identifier = $engine->getEngineIdentifier();
     if (!$engine_identifier || strlen($engine_identifier) > 32) {
       throw new PhabricatorFileStorageConfigurationException(
         "Storage engine '{$engine_class}' returned an improper engine ".
         "identifier '{$engine_identifier}': it must be nonempty ".
         "and no longer than 32 characters.");
     }
 
     return array($engine_identifier, $data_handle);
   }
 
 
   public static function newFromFileDownload($uri, array $params = array()) {
     // Make sure we're allowed to make a request first
     if (!PhabricatorEnv::getEnvConfig('security.allow-outbound-http')) {
       throw new Exception('Outbound HTTP requests are disabled!');
     }
 
     $uri = new PhutilURI($uri);
 
     $protocol = $uri->getProtocol();
     switch ($protocol) {
       case 'http':
       case 'https':
         break;
       default:
         // Make sure we are not accessing any file:// URIs or similar.
         return null;
     }
 
     $timeout = 5;
 
     list($file_data) = id(new HTTPSFuture($uri))
         ->setTimeout($timeout)
         ->resolvex();
 
     $params = $params + array(
       'name' => basename($uri),
     );
 
     return self::newFromFileData($file_data, $params);
   }
 
   public static function normalizeFileName($file_name) {
     $pattern = "@[\\x00-\\x19#%&+!~'\$\"\/=\\\\?<> ]+@";
     $file_name = preg_replace($pattern, '_', $file_name);
     $file_name = preg_replace('@_+@', '_', $file_name);
     $file_name = trim($file_name, '_');
 
     $disallowed_filenames = array(
       '.'  => 'dot',
       '..' => 'dotdot',
       ''   => 'file',
     );
     $file_name = idx($disallowed_filenames, $file_name, $file_name);
 
     return $file_name;
   }
 
   public function delete() {
     // We want to delete all the rows which mark this file as the transformation
     // of some other file (since we're getting rid of it). We also delete all
     // the transformations of this file, so that a user who deletes an image
     // doesn't need to separately hunt down and delete a bunch of thumbnails and
     // resizes of it.
 
     $outbound_xforms = id(new PhabricatorFileQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withTransforms(
         array(
           array(
             'originalPHID' => $this->getPHID(),
             'transform'    => true,
           ),
         ))
       ->execute();
 
     foreach ($outbound_xforms as $outbound_xform) {
       $outbound_xform->delete();
     }
 
     $inbound_xforms = id(new PhabricatorTransformedFile())->loadAllWhere(
       'transformedPHID = %s',
       $this->getPHID());
 
     $this->openTransaction();
       foreach ($inbound_xforms as $inbound_xform) {
         $inbound_xform->delete();
       }
       $ret = parent::delete();
     $this->saveTransaction();
 
     // Check to see if other files are using storage
     $other_file = id(new PhabricatorFile())->loadAllWhere(
       'storageEngine = %s AND storageHandle = %s AND
       storageFormat = %s AND id != %d LIMIT 1',
       $this->getStorageEngine(),
       $this->getStorageHandle(),
       $this->getStorageFormat(),
       $this->getID());
 
     // If this is the only file using the storage, delete storage
     if (!$other_file) {
       $engine = $this->instantiateStorageEngine();
       try {
         $engine->deleteFile($this->getStorageHandle());
       } catch (Exception $ex) {
         // In the worst case, we're leaving some data stranded in a storage
         // engine, which is fine.
         phlog($ex);
       }
     }
 
     return $ret;
   }
 
   public static function hashFileContent($data) {
     return sha1($data);
   }
 
   public function loadFileData() {
 
     $engine = $this->instantiateStorageEngine();
     $data = $engine->readFile($this->getStorageHandle());
 
     switch ($this->getStorageFormat()) {
       case self::STORAGE_FORMAT_RAW:
         $data = $data;
         break;
       default:
         throw new Exception('Unknown storage format.');
     }
 
     return $data;
   }
 
   public function getViewURI() {
     if (!$this->getPHID()) {
       throw new Exception(
         'You must save a file before you can generate a view URI.');
     }
 
     $name = phutil_escape_uri($this->getName());
 
     $path = '/file/data/'.$this->getSecretKey().'/'.$this->getPHID().'/'.$name;
     return PhabricatorEnv::getCDNURI($path);
   }
 
   public function getInfoURI() {
     return '/file/info/'.$this->getPHID().'/';
   }
 
   public function getBestURI() {
     if ($this->isViewableInBrowser()) {
       return $this->getViewURI();
     } else {
       return $this->getInfoURI();
     }
   }
 
   public function getDownloadURI() {
     $uri = id(new PhutilURI($this->getViewURI()))
       ->setQueryParam('download', true);
     return (string) $uri;
   }
 
   public function getProfileThumbURI() {
     $path = '/file/xform/thumb-profile/'.$this->getPHID().'/'
       .$this->getSecretKey().'/';
     return PhabricatorEnv::getCDNURI($path);
   }
 
   public function getThumb60x45URI() {
     $path = '/file/xform/thumb-60x45/'.$this->getPHID().'/'
       .$this->getSecretKey().'/';
     return PhabricatorEnv::getCDNURI($path);
   }
 
   public function getThumb160x120URI() {
     $path = '/file/xform/thumb-160x120/'.$this->getPHID().'/'
       .$this->getSecretKey().'/';
     return PhabricatorEnv::getCDNURI($path);
   }
 
   public function getPreview100URI() {
     $path = '/file/xform/preview-100/'.$this->getPHID().'/'
       .$this->getSecretKey().'/';
     return PhabricatorEnv::getCDNURI($path);
   }
 
   public function getPreview220URI() {
     $path = '/file/xform/preview-220/'.$this->getPHID().'/'
       .$this->getSecretKey().'/';
     return PhabricatorEnv::getCDNURI($path);
   }
 
   public function getThumb220x165URI() {
     $path = '/file/xform/thumb-220x165/'.$this->getPHID().'/'
       .$this->getSecretKey().'/';
     return PhabricatorEnv::getCDNURI($path);
   }
 
   public function getThumb280x210URI() {
     $path = '/file/xform/thumb-280x210/'.$this->getPHID().'/'
       .$this->getSecretKey().'/';
     return PhabricatorEnv::getCDNURI($path);
   }
 
   public function isViewableInBrowser() {
     return ($this->getViewableMimeType() !== null);
   }
 
   public function isViewableImage() {
     if (!$this->isViewableInBrowser()) {
       return false;
     }
 
     $mime_map = PhabricatorEnv::getEnvConfig('files.image-mime-types');
     $mime_type = $this->getMimeType();
     return idx($mime_map, $mime_type);
   }
 
   public function isAudio() {
     if (!$this->isViewableInBrowser()) {
       return false;
     }
 
     $mime_map = PhabricatorEnv::getEnvConfig('files.audio-mime-types');
     $mime_type = $this->getMimeType();
     return idx($mime_map, $mime_type);
   }
 
   public function isTransformableImage() {
     // NOTE: The way the 'gd' extension works in PHP is that you can install it
     // with support for only some file types, so it might be able to handle
     // PNG but not JPEG. Try to generate thumbnails for whatever we can. Setup
     // warns you if you don't have complete support.
 
     $matches = null;
     $ok = preg_match(
       '@^image/(gif|png|jpe?g)@',
       $this->getViewableMimeType(),
       $matches);
     if (!$ok) {
       return false;
     }
 
     switch ($matches[1]) {
       case 'jpg';
       case 'jpeg':
         return function_exists('imagejpeg');
         break;
       case 'png':
         return function_exists('imagepng');
         break;
       case 'gif':
         return function_exists('imagegif');
         break;
       default:
         throw new Exception('Unknown type matched as image MIME type.');
     }
   }
 
   public static function getTransformableImageFormats() {
     $supported = array();
 
     if (function_exists('imagejpeg')) {
       $supported[] = 'jpg';
     }
 
     if (function_exists('imagepng')) {
       $supported[] = 'png';
     }
 
     if (function_exists('imagegif')) {
       $supported[] = 'gif';
     }
 
     return $supported;
   }
 
   protected function instantiateStorageEngine() {
     return self::buildEngine($this->getStorageEngine());
   }
 
   public static function buildEngine($engine_identifier) {
     $engines = self::buildAllEngines();
     foreach ($engines as $engine) {
       if ($engine->getEngineIdentifier() == $engine_identifier) {
         return $engine;
       }
     }
 
     throw new Exception(
       "Storage engine '{$engine_identifier}' could not be located!");
   }
 
   public static function buildAllEngines() {
     $engines = id(new PhutilSymbolLoader())
       ->setType('class')
       ->setConcreteOnly(true)
       ->setAncestorClass('PhabricatorFileStorageEngine')
       ->selectAndLoadSymbols();
 
     $results = array();
     foreach ($engines as $engine_class) {
       $results[] = newv($engine_class['name'], array());
     }
 
     return $results;
   }
 
   public function getViewableMimeType() {
     $mime_map = PhabricatorEnv::getEnvConfig('files.viewable-mime-types');
 
     $mime_type = $this->getMimeType();
     $mime_parts = explode(';', $mime_type);
     $mime_type = trim(reset($mime_parts));
 
     return idx($mime_map, $mime_type);
   }
 
   public function getDisplayIconForMimeType() {
     $mime_map = PhabricatorEnv::getEnvConfig('files.icon-mime-types');
     $mime_type = $this->getMimeType();
     return idx($mime_map, $mime_type, 'docs_file');
   }
 
   public function validateSecretKey($key) {
     return ($key == $this->getSecretKey());
   }
 
   public function generateSecretKey() {
     return Filesystem::readRandomCharacters(20);
   }
 
   public function updateDimensions($save = true) {
     if (!$this->isViewableImage()) {
       throw new Exception(
         'This file is not a viewable image.');
     }
 
     if (!function_exists('imagecreatefromstring')) {
       throw new Exception(
         'Cannot retrieve image information.');
     }
 
     $data = $this->loadFileData();
 
     $img = imagecreatefromstring($data);
     if ($img === false) {
       throw new Exception(
         'Error when decoding image.');
     }
 
     $this->metadata[self::METADATA_IMAGE_WIDTH] = imagesx($img);
     $this->metadata[self::METADATA_IMAGE_HEIGHT] = imagesy($img);
 
     if ($save) {
       $this->save();
     }
 
     return $this;
   }
 
   public function copyDimensions(PhabricatorFile $file) {
     $metadata = $file->getMetadata();
     $width = idx($metadata, self::METADATA_IMAGE_WIDTH);
     if ($width) {
       $this->metadata[self::METADATA_IMAGE_WIDTH] = $width;
     }
     $height = idx($metadata, self::METADATA_IMAGE_HEIGHT);
     if ($height) {
       $this->metadata[self::METADATA_IMAGE_HEIGHT] = $height;
     }
 
     return $this;
   }
 
 
   /**
    * Load (or build) the {@class:PhabricatorFile} objects for builtin file
    * resources. The builtin mechanism allows files shipped with Phabricator
    * to be treated like normal files so that APIs do not need to special case
    * things like default images or deleted files.
    *
    * Builtins are located in `resources/builtin/` and identified by their
    * name.
    *
    * @param  PhabricatorUser                Viewing user.
    * @param  list<string>                   List of builtin file names.
    * @return dict<string, PhabricatorFile>  Dictionary of named builtins.
    */
   public static function loadBuiltins(PhabricatorUser $user, array $names) {
     $specs = array();
     foreach ($names as $name) {
       $specs[] = array(
         'originalPHID' => PhabricatorPHIDConstants::PHID_VOID,
         'transform'    => 'builtin:'.$name,
       );
     }
 
     // NOTE: Anyone is allowed to access builtin files.
 
     $files = id(new PhabricatorFileQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withTransforms($specs)
       ->execute();
 
     $files = mpull($files, null, 'getName');
 
     $root = dirname(phutil_get_library_root('phabricator'));
     $root = $root.'/resources/builtin/';
 
     $build = array();
     foreach ($names as $name) {
       if (isset($files[$name])) {
         continue;
       }
 
       // This is just a sanity check to prevent loading arbitrary files.
       if (basename($name) != $name) {
         throw new Exception("Invalid builtin name '{$name}'!");
       }
 
       $path = $root.$name;
 
       if (!Filesystem::pathExists($path)) {
         throw new Exception("Builtin '{$path}' does not exist!");
       }
 
       $data = Filesystem::readFile($path);
       $params = array(
         'name' => $name,
         'ttl'  => time() + (60 * 60 * 24 * 7),
       );
 
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
         $file = PhabricatorFile::newFromFileData($data, $params);
         $xform = id(new PhabricatorTransformedFile())
           ->setOriginalPHID(PhabricatorPHIDConstants::PHID_VOID)
           ->setTransform('builtin:'.$name)
           ->setTransformedPHID($file->getPHID())
           ->save();
       unset($unguarded);
 
       $file->attachObjectPHIDs(array());
       $file->attachObjects(array());
 
       $files[$name] = $file;
     }
 
     return $files;
   }
 
 
   /**
    * Convenience wrapper for @{method:loadBuiltins}.
    *
    * @param PhabricatorUser   Viewing user.
    * @param string            Single builtin name to load.
    * @return PhabricatorFile  Corresponding builtin file.
    */
   public static function loadBuiltin(PhabricatorUser $user, $name) {
     return idx(self::loadBuiltins($user, array($name)), $name);
   }
 
   public function getObjects() {
     return $this->assertAttached($this->objects);
   }
 
   public function attachObjects(array $objects) {
     $this->objects = $objects;
     return $this;
   }
 
   public function getObjectPHIDs() {
     return $this->assertAttached($this->objectPHIDs);
   }
 
   public function attachObjectPHIDs(array $object_phids) {
     $this->objectPHIDs = $object_phids;
     return $this;
   }
 
   public function getImageHeight() {
     if (!$this->isViewableImage()) {
       return null;
     }
     return idx($this->metadata, self::METADATA_IMAGE_HEIGHT);
   }
 
   public function getImageWidth() {
     if (!$this->isViewableImage()) {
       return null;
     }
     return idx($this->metadata, self::METADATA_IMAGE_WIDTH);
   }
 
+  public function getCanCDN() {
+    if (!$this->isViewableImage()) {
+      return false;
+    }
+    return idx($this->metadata, self::METADATA_CAN_CDN);
+  }
+
+  public function setCanCDN($can_cdn) {
+    $this->metadata[self::METADATA_CAN_CDN] = $can_cdn ? 1 : 0;
+    return $this;
+  }
+
+  protected function generateOneTimeToken() {
+    $key = Filesystem::readRandomCharacters(16);
+
+    // Save the new secret.
+    return id(new PhabricatorAuthTemporaryToken())
+      ->setObjectPHID($this->getPHID())
+      ->setTokenType(self::ONETIME_TEMPORARY_TOKEN_TYPE)
+      ->setTokenExpires(time() + phutil_units('1 hour in seconds'))
+      ->setTokenCode(PhabricatorHash::digest($key))
+      ->save();
+  }
+
+  public function validateOneTimeToken($token_code) {
+    $token = id(new PhabricatorAuthTemporaryTokenQuery())
+      ->setViewer(PhabricatorUser::getOmnipotentUser())
+      ->withObjectPHIDs(array($this->getPHID()))
+      ->withTokenTypes(array(self::ONETIME_TEMPORARY_TOKEN_TYPE))
+      ->withExpired(false)
+      ->withTokenCodes(array($token_code))
+      ->executeOne();
+
+    return $token;
+  }
+
+  /** Get the CDN uri for this file
+   * This will generate a one-time-use token if
+   * security.alternate_file_domain is set in the config.
+   */
+  public function getCDNURIWithToken() {
+    if (!$this->getPHID()) {
+      throw new Exception(
+        'You must save a file before you can generate a CDN URI.');
+    }
+    $name = phutil_escape_uri($this->getName());
+
+    $path = '/file/data'
+          .'/'.$this->getSecretKey()
+          .'/'.$this->getPHID()
+          .'/'.$this->generateOneTimeToken()
+          .'/'.$name;
+    return PhabricatorEnv::getCDNURI($path);
+  }
+
+
+
   /**
    * Write the policy edge between this file and some object.
    *
    * @param PhabricatorUser Acting user.
    * @param phid Object PHID to attach to.
    * @return this
    */
   public function attachToObject(PhabricatorUser $actor, $phid) {
     $edge_type = PhabricatorEdgeConfig::TYPE_OBJECT_HAS_FILE;
 
     id(new PhabricatorEdgeEditor())
       ->addEdge($phid, $edge_type, $this->getPHID())
       ->save();
 
     return $this;
   }
 
 
 /* -(  PhabricatorPolicyInterface Implementation  )-------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
       PhabricatorPolicyCapability::CAN_EDIT,
     );
   }
 
   public function getPolicy($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return $this->getViewPolicy();
       case PhabricatorPolicyCapability::CAN_EDIT:
         return PhabricatorPolicies::POLICY_NOONE;
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     $viewer_phid = $viewer->getPHID();
     if ($viewer_phid) {
       if ($this->getAuthorPHID() == $viewer_phid) {
         return true;
       }
     }
 
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         // If you can see any object this file is attached to, you can see
         // the file.
         return (count($this->getObjects()) > 0);
     }
 
     return false;
   }
 
   public function describeAutomaticCapability($capability) {
     $out = array();
     $out[] = pht('The user who uploaded a file can always view and edit it.');
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         $out[] = pht(
           'Files attached to objects are visible to users who can view '.
           'those objects.');
         break;
     }
 
     return $out;
   }
 
 
 /* -(  PhabricatorSubscribableInterface Implementation  )-------------------- */
 
 
   public function isAutomaticallySubscribed($phid) {
     return ($this->authorPHID == $phid);
   }
 
   public function shouldShowSubscribersProperty() {
     return true;
   }
 
   public function shouldAllowSubscription($phid) {
     return true;
   }
 
 
 /* -(  PhabricatorTokenReceiverInterface  )---------------------------------- */
 
 
   public function getUsersToNotifyOfTokenGiven() {
     return array(
       $this->getAuthorPHID(),
     );
   }
 
 
 }
diff --git a/src/applications/macro/controller/PhabricatorMacroEditController.php b/src/applications/macro/controller/PhabricatorMacroEditController.php
index 79393c753..5442754e4 100644
--- a/src/applications/macro/controller/PhabricatorMacroEditController.php
+++ b/src/applications/macro/controller/PhabricatorMacroEditController.php
@@ -1,264 +1,266 @@
 <?php
 
 final class PhabricatorMacroEditController extends PhabricatorMacroController {
 
   private $id;
 
   public function willProcessRequest(array $data) {
     $this->id = idx($data, 'id');
   }
 
   public function processRequest() {
     $this->requireApplicationCapability(
       PhabricatorMacroManageCapability::CAPABILITY);
 
     $request = $this->getRequest();
     $user = $request->getUser();
 
     if ($this->id) {
       $macro = id(new PhabricatorMacroQuery())
         ->setViewer($user)
         ->withIDs(array($this->id))
         ->executeOne();
       if (!$macro) {
         return new Aphront404Response();
       }
     } else {
       $macro = new PhabricatorFileImageMacro();
       $macro->setAuthorPHID($user->getPHID());
     }
 
     $errors = array();
     $e_name = true;
     $e_file = null;
     $file = null;
     $can_fetch = PhabricatorEnv::getEnvConfig('security.allow-outbound-http');
 
     if ($request->isFormPost()) {
       $original = clone $macro;
 
       $new_name = null;
       if ($request->getBool('name_form') || !$macro->getID()) {
         $new_name = $request->getStr('name');
 
         $macro->setName($new_name);
 
         if (!strlen($macro->getName())) {
           $errors[] = pht('Macro name is required.');
           $e_name = pht('Required');
         } else if (!preg_match('/^[a-z0-9:_-]{3,}\z/', $macro->getName())) {
           $errors[] = pht(
             'Macro must be at least three characters long and contain only '.
             'lowercase letters, digits, hyphens, colons and underscores.');
           $e_name = pht('Invalid');
         } else {
           $e_name = null;
         }
       }
 
       $file = null;
       if ($request->getFileExists('file')) {
         $file = PhabricatorFile::newFromPHPUpload(
           $_FILES['file'],
           array(
             'name' => $request->getStr('name'),
             'authorPHID' => $user->getPHID(),
             'isExplicitUpload' => true,
+            'canCDN' => true,
           ));
       } else if ($request->getStr('url')) {
         try {
           $file = PhabricatorFile::newFromFileDownload(
             $request->getStr('url'),
             array(
               'name' => $request->getStr('name'),
               'authorPHID' => $user->getPHID(),
               'isExplicitUpload' => true,
+              'canCDN' => true,
             ));
         } catch (Exception $ex) {
           $errors[] = pht('Could not fetch URL: %s', $ex->getMessage());
         }
       } else if ($request->getStr('phid')) {
         $file = id(new PhabricatorFileQuery())
           ->setViewer($user)
           ->withPHIDs(array($request->getStr('phid')))
           ->executeOne();
       }
 
       if ($file) {
         if (!$file->isViewableInBrowser()) {
           $errors[] = pht('You must upload an image.');
           $e_file = pht('Invalid');
         } else {
           $macro->setFilePHID($file->getPHID());
           $macro->attachFile($file);
           $e_file = null;
         }
       }
 
       if (!$macro->getID() && !$file) {
         $errors[] = pht('You must upload an image to create a macro.');
         $e_file = pht('Required');
       }
 
       if (!$errors) {
         try {
           $xactions = array();
 
           if ($new_name !== null) {
             $xactions[] = id(new PhabricatorMacroTransaction())
               ->setTransactionType(PhabricatorMacroTransactionType::TYPE_NAME)
               ->setNewValue($new_name);
           }
 
           if ($file) {
             $xactions[] = id(new PhabricatorMacroTransaction())
               ->setTransactionType(PhabricatorMacroTransactionType::TYPE_FILE)
               ->setNewValue($file->getPHID());
           }
 
           $editor = id(new PhabricatorMacroEditor())
             ->setActor($user)
             ->setContinueOnNoEffect(true)
             ->setContentSourceFromRequest($request);
 
           $xactions = $editor->applyTransactions($original, $xactions);
 
           $view_uri = $this->getApplicationURI('/view/'.$original->getID().'/');
           return id(new AphrontRedirectResponse())->setURI($view_uri);
         } catch (AphrontDuplicateKeyQueryException $ex) {
           throw $ex;
           $errors[] = pht('Macro name is not unique!');
           $e_name = pht('Duplicate');
         }
       }
     }
 
     $current_file = null;
     if ($macro->getFilePHID()) {
       $current_file = $macro->getFile();
     }
 
     $form = new AphrontFormView();
     $form->addHiddenInput('name_form', 1);
     $form->setUser($request->getUser());
 
     $form
       ->setEncType('multipart/form-data')
       ->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Name'))
           ->setName('name')
           ->setValue($macro->getName())
           ->setCaption(
             pht('This word or phrase will be replaced with the image.'))
           ->setError($e_name));
 
     if (!$macro->getID()) {
       if ($current_file) {
         $current_file_view = id(new PhabricatorFileLinkView())
           ->setFilePHID($current_file->getPHID())
           ->setFileName($current_file->getName())
           ->setFileViewable(true)
           ->setFileViewURI($current_file->getBestURI())
           ->render();
         $form->addHiddenInput('phid', $current_file->getPHID());
         $form->appendChild(
           id(new AphrontFormMarkupControl())
             ->setLabel(pht('Selected File'))
             ->setValue($current_file_view));
 
         $other_label = pht('Change File');
       } else {
         $other_label = pht('File');
       }
 
       if ($can_fetch) {
         $form->appendChild(
           id(new AphrontFormTextControl())
             ->setLabel(pht('URL'))
             ->setName('url')
             ->setValue($request->getStr('url'))
             ->setError($request->getFileExists('file') ? false : $e_file));
       }
 
       $form->appendChild(
         id(new AphrontFormFileControl())
           ->setLabel($other_label)
           ->setName('file')
           ->setError($request->getStr('url') ? false : $e_file));
     }
 
 
     $view_uri = $this->getApplicationURI('/view/'.$macro->getID().'/');
 
     if ($macro->getID()) {
       $cancel_uri = $view_uri;
     } else {
       $cancel_uri = $this->getApplicationURI();
     }
 
     $form
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->setValue(pht('Save Image Macro'))
           ->addCancelButton($cancel_uri));
 
     $crumbs = $this->buildApplicationCrumbs();
 
     if ($macro->getID()) {
       $title = pht('Edit Image Macro');
       $crumb = pht('Edit Macro');
 
       $crumbs->addTextCrumb(pht('Macro "%s"', $macro->getName()), $view_uri);
     } else {
       $title = pht('Create Image Macro');
       $crumb = pht('Create Macro');
     }
 
     $crumbs->addTextCrumb($crumb, $request->getRequestURI());
 
     $upload = null;
     if ($macro->getID()) {
       $upload_form = id(new AphrontFormView())
         ->setEncType('multipart/form-data')
         ->setUser($request->getUser());
 
       if ($can_fetch) {
         $upload_form->appendChild(
           id(new AphrontFormTextControl())
             ->setLabel(pht('URL'))
             ->setName('url')
             ->setValue($request->getStr('url')));
       }
 
       $upload_form
         ->appendChild(
           id(new AphrontFormFileControl())
             ->setLabel(pht('File'))
             ->setName('file'))
         ->appendChild(
           id(new AphrontFormSubmitControl())
             ->setValue(pht('Upload File')));
 
       $upload = id(new PHUIObjectBoxView())
         ->setHeaderText(pht('Upload New File'))
         ->setForm($upload_form);
     }
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText($title)
       ->setFormErrors($errors)
       ->setForm($form);
 
     return $this->buildApplicationPage(
       array(
         $crumbs,
         $form_box,
         $upload,
       ),
       array(
         'title' => $title,
       ));
   }
 
 }
diff --git a/src/applications/people/controller/PhabricatorPeopleProfilePictureController.php b/src/applications/people/controller/PhabricatorPeopleProfilePictureController.php
index afee9ea84..55cfb8731 100644
--- a/src/applications/people/controller/PhabricatorPeopleProfilePictureController.php
+++ b/src/applications/people/controller/PhabricatorPeopleProfilePictureController.php
@@ -1,298 +1,299 @@
 <?php
 
 final class PhabricatorPeopleProfilePictureController
   extends PhabricatorPeopleController {
 
   private $id;
 
   public function shouldRequireAdmin() {
     return false;
   }
 
   public function willProcessRequest(array $data) {
     $this->id = $data['id'];
   }
 
   public function processRequest() {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
     $user = id(new PhabricatorPeopleQuery())
       ->setViewer($viewer)
       ->withIDs(array($this->id))
       ->requireCapabilities(
         array(
           PhabricatorPolicyCapability::CAN_VIEW,
           PhabricatorPolicyCapability::CAN_EDIT,
         ))
       ->executeOne();
     if (!$user) {
       return new Aphront404Response();
     }
 
     $profile_uri = '/p/'.$user->getUsername().'/';
 
     $supported_formats = PhabricatorFile::getTransformableImageFormats();
     $e_file = true;
     $errors = array();
 
     if ($request->isFormPost()) {
       $phid = $request->getStr('phid');
       $is_default = false;
       if ($phid == PhabricatorPHIDConstants::PHID_VOID) {
         $phid = null;
         $is_default = true;
       } else if ($phid) {
         $file = id(new PhabricatorFileQuery())
           ->setViewer($viewer)
           ->withPHIDs(array($phid))
           ->executeOne();
       } else {
         if ($request->getFileExists('picture')) {
           $file = PhabricatorFile::newFromPHPUpload(
             $_FILES['picture'],
             array(
               'authorPHID' => $viewer->getPHID(),
+              'canCDN' => true,
             ));
         } else {
           $e_file = pht('Required');
           $errors[] = pht(
             'You must choose a file when uploading a new profile picture.');
         }
       }
 
       if (!$errors && !$is_default) {
         if (!$file->isTransformableImage()) {
           $e_file = pht('Not Supported');
           $errors[] = pht(
             'This server only supports these image formats: %s.',
             implode(', ', $supported_formats));
         } else {
           $xformer = new PhabricatorImageTransformer();
           $xformed = $xformer->executeProfileTransform(
             $file,
             $width = 50,
             $min_height = 50,
             $max_height = 50);
         }
       }
 
       if (!$errors) {
         if ($is_default) {
           $user->setProfileImagePHID(null);
         } else {
           $user->setProfileImagePHID($xformed->getPHID());
           $xformed->attachToObject($viewer, $user->getPHID());
         }
         $user->save();
         return id(new AphrontRedirectResponse())->setURI($profile_uri);
       }
     }
 
     $title = pht('Edit Profile Picture');
     $crumbs = $this->buildApplicationCrumbs();
     $crumbs->addTextCrumb($user->getUsername(), $profile_uri);
     $crumbs->addTextCrumb($title);
 
     $form = id(new PHUIFormLayoutView())
       ->setUser($viewer);
 
     $default_image = PhabricatorFile::loadBuiltin($viewer, 'profile.png');
 
     $images = array();
 
     $current = $user->getProfileImagePHID();
     $has_current = false;
     if ($current) {
       $files = id(new PhabricatorFileQuery())
         ->setViewer($viewer)
         ->withPHIDs(array($current))
         ->execute();
       if ($files) {
         $file = head($files);
         if ($file->isTransformableImage()) {
           $has_current = true;
           $images[$current] = array(
             'uri' => $file->getBestURI(),
             'tip' => pht('Current Picture'),
           );
         }
       }
     }
 
     // Try to add external account images for any associated external accounts.
     $accounts = id(new PhabricatorExternalAccountQuery())
       ->setViewer($viewer)
       ->withUserPHIDs(array($user->getPHID()))
       ->needImages(true)
       ->requireCapabilities(
         array(
           PhabricatorPolicyCapability::CAN_VIEW,
           PhabricatorPolicyCapability::CAN_EDIT,
         ))
       ->execute();
 
     foreach ($accounts as $account) {
       $file = $account->getProfileImageFile();
       if ($account->getProfileImagePHID() != $file->getPHID()) {
         // This is a default image, just skip it.
         continue;
       }
 
       $provider = PhabricatorAuthProvider::getEnabledProviderByKey(
         $account->getProviderKey());
       if ($provider) {
         $tip = pht('Picture From %s', $provider->getProviderName());
       } else {
         $tip = pht('Picture From External Account');
       }
 
       if ($file->isTransformableImage()) {
         $images[$file->getPHID()] = array(
           'uri' => $file->getBestURI(),
           'tip' => $tip,
         );
       }
     }
 
     // Try to add Gravatar images for any email addresses associated with the
     // account.
     if (PhabricatorEnv::getEnvConfig('security.allow-outbound-http')) {
       $emails = id(new PhabricatorUserEmail())->loadAllWhere(
         'userPHID = %s ORDER BY address',
         $user->getPHID());
 
       $futures = array();
       foreach ($emails as $email_object) {
         $email = $email_object->getAddress();
 
         $hash = md5(strtolower(trim($email)));
         $uri = id(new PhutilURI("https://secure.gravatar.com/avatar/{$hash}"))
           ->setQueryParams(
             array(
               'size' => 200,
               'default' => '404',
               'rating' => 'x',
             ));
         $futures[$email] = new HTTPSFuture($uri);
       }
 
       $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       foreach (Futures($futures) as $email => $future) {
         try {
           list($body) = $future->resolvex();
           $file = PhabricatorFile::newFromFileData(
             $body,
             array(
               'name' => 'profile-gravatar',
               'ttl'  => (60 * 60 * 4),
             ));
           if ($file->isTransformableImage()) {
             $images[$file->getPHID()] = array(
               'uri' => $file->getBestURI(),
               'tip' => pht('Gravatar for %s', $email),
             );
           }
         } catch (Exception $ex) {
           // Just continue.
         }
       }
       unset($unguarded);
     }
 
     $images[PhabricatorPHIDConstants::PHID_VOID] = array(
       'uri' => $default_image->getBestURI(),
       'tip' => pht('Default Picture'),
     );
 
     require_celerity_resource('people-profile-css');
     Javelin::initBehavior('phabricator-tooltips', array());
 
     $buttons = array();
     foreach ($images as $phid => $spec) {
       $button = javelin_tag(
         'button',
         array(
           'class' => 'grey profile-image-button',
           'sigil' => 'has-tooltip',
           'meta' => array(
             'tip' => $spec['tip'],
             'size' => 300,
           ),
         ),
         phutil_tag(
           'img',
           array(
             'height' => 50,
             'width' => 50,
             'src' => $spec['uri'],
           )));
 
       $button = array(
         phutil_tag(
           'input',
           array(
             'type'  => 'hidden',
             'name'  => 'phid',
             'value' => $phid,
           )),
         $button);
 
       $button = phabricator_form(
         $viewer,
         array(
           'class' => 'profile-image-form',
           'method' => 'POST',
         ),
         $button);
 
       $buttons[] = $button;
     }
 
     if ($has_current) {
       $form->appendChild(
         id(new AphrontFormMarkupControl())
           ->setLabel(pht('Current Picture'))
           ->setValue(array_shift($buttons)));
     }
 
     $form->appendChild(
       id(new AphrontFormMarkupControl())
         ->setLabel(pht('Use Picture'))
         ->setValue($buttons));
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText($title)
       ->setFormErrors($errors)
       ->setForm($form);
 
     $upload_form = id(new AphrontFormView())
       ->setUser($viewer)
       ->setEncType('multipart/form-data')
       ->appendChild(
         id(new AphrontFormFileControl())
           ->setName('picture')
           ->setLabel(pht('Upload Picture'))
           ->setError($e_file)
           ->setCaption(
             pht('Supported formats: %s', implode(', ', $supported_formats))))
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->addCancelButton($profile_uri)
           ->setValue(pht('Upload Picture')));
 
     $upload_box = id(new PHUIObjectBoxView())
       ->setHeaderText(pht('Upload New Picture'))
       ->setForm($upload_form);
 
     return $this->buildApplicationPage(
       array(
         $crumbs,
         $form_box,
         $upload_box,
       ),
       array(
         'title' => $title,
       ));
   }
 }
diff --git a/src/applications/project/controller/PhabricatorProjectEditPictureController.php b/src/applications/project/controller/PhabricatorProjectEditPictureController.php
index 6170d6dfa..98282407b 100644
--- a/src/applications/project/controller/PhabricatorProjectEditPictureController.php
+++ b/src/applications/project/controller/PhabricatorProjectEditPictureController.php
@@ -1,271 +1,272 @@
 <?php
 
 final class PhabricatorProjectEditPictureController
   extends PhabricatorProjectController {
 
   private $id;
 
   public function willProcessRequest(array $data) {
     $this->id = $data['id'];
   }
 
   public function processRequest() {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
     $project = id(new PhabricatorProjectQuery())
       ->setViewer($viewer)
       ->withIDs(array($this->id))
       ->requireCapabilities(
         array(
           PhabricatorPolicyCapability::CAN_VIEW,
           PhabricatorPolicyCapability::CAN_EDIT,
         ))
       ->executeOne();
     if (!$project) {
       return new Aphront404Response();
     }
 
     $edit_uri = $this->getApplicationURI('edit/'.$project->getID().'/');
     $view_uri = $this->getApplicationURI('view/'.$project->getID().'/');
 
     $supported_formats = PhabricatorFile::getTransformableImageFormats();
     $e_file = true;
     $errors = array();
 
     if ($request->isFormPost()) {
       $phid = $request->getStr('phid');
       $is_default = false;
       if ($phid == PhabricatorPHIDConstants::PHID_VOID) {
         $phid = null;
         $is_default = true;
       } else if ($phid) {
         $file = id(new PhabricatorFileQuery())
           ->setViewer($viewer)
           ->withPHIDs(array($phid))
           ->executeOne();
       } else {
         if ($request->getFileExists('picture')) {
           $file = PhabricatorFile::newFromPHPUpload(
             $_FILES['picture'],
             array(
               'authorPHID' => $viewer->getPHID(),
+              'canCDN' => true,
             ));
         } else {
           $e_file = pht('Required');
           $errors[] = pht(
             'You must choose a file when uploading a new project picture.');
         }
       }
 
       if (!$errors && !$is_default) {
         if (!$file->isTransformableImage()) {
           $e_file = pht('Not Supported');
           $errors[] = pht(
             'This server only supports these image formats: %s.',
             implode(', ', $supported_formats));
         } else {
           $xformer = new PhabricatorImageTransformer();
           $xformed = $xformer->executeProfileTransform(
             $file,
             $width = 50,
             $min_height = 50,
             $max_height = 50);
         }
       }
 
       if (!$errors) {
         if ($is_default) {
           $new_value = null;
         } else {
           $new_value = $xformed->getPHID();
         }
 
         $xactions = array();
         $xactions[] = id(new PhabricatorProjectTransaction())
           ->setTransactionType(PhabricatorProjectTransaction::TYPE_IMAGE)
           ->setNewValue($new_value);
 
         $editor = id(new PhabricatorProjectTransactionEditor())
           ->setActor($viewer)
           ->setContentSourceFromRequest($request)
           ->setContinueOnMissingFields(true)
           ->setContinueOnNoEffect(true);
 
         $editor->applyTransactions($project, $xactions);
 
         return id(new AphrontRedirectResponse())->setURI($edit_uri);
       }
     }
 
     $title = pht('Edit Project Picture');
     $crumbs = $this->buildApplicationCrumbs();
     $crumbs->addTextCrumb($project->getName(), $view_uri);
     $crumbs->addTextCrumb(pht('Edit'), $edit_uri);
     $crumbs->addTextCrumb(pht('Picture'));
 
     $form = id(new PHUIFormLayoutView())
       ->setUser($viewer);
 
     $default_image = PhabricatorFile::loadBuiltin($viewer, 'project.png');
 
     $images = array();
 
     $current = $project->getProfileImagePHID();
     $has_current = false;
     if ($current) {
       $files = id(new PhabricatorFileQuery())
         ->setViewer($viewer)
         ->withPHIDs(array($current))
         ->execute();
       if ($files) {
         $file = head($files);
         if ($file->isTransformableImage()) {
           $has_current = true;
           $images[$current] = array(
             'uri' => $file->getBestURI(),
             'tip' => pht('Current Picture'),
           );
         }
       }
     }
 
     $images[PhabricatorPHIDConstants::PHID_VOID] = array(
       'uri' => $default_image->getBestURI(),
       'tip' => pht('Default Picture'),
     );
 
     require_celerity_resource('people-profile-css');
     Javelin::initBehavior('phabricator-tooltips', array());
 
     $buttons = array();
     foreach ($images as $phid => $spec) {
       $button = javelin_tag(
         'button',
         array(
           'class' => 'grey profile-image-button',
           'sigil' => 'has-tooltip',
           'meta' => array(
             'tip' => $spec['tip'],
             'size' => 300,
           ),
         ),
         phutil_tag(
           'img',
           array(
             'height' => 50,
             'width' => 50,
             'src' => $spec['uri'],
           )));
 
       $button = array(
         phutil_tag(
           'input',
           array(
             'type'  => 'hidden',
             'name'  => 'phid',
             'value' => $phid,
           )),
         $button);
 
       $button = phabricator_form(
         $viewer,
         array(
           'class' => 'profile-image-form',
           'method' => 'POST',
         ),
         $button);
 
       $buttons[] = $button;
     }
 
     if ($has_current) {
       $form->appendChild(
         id(new AphrontFormMarkupControl())
           ->setLabel(pht('Current Picture'))
           ->setValue(array_shift($buttons)));
     }
 
     $form->appendChild(
       id(new AphrontFormMarkupControl())
         ->setLabel(pht('Use Picture'))
         ->setValue($buttons));
 
     $launch_id = celerity_generate_unique_node_id();
     $input_id = celerity_generate_unique_node_id();
 
     Javelin::initBehavior(
       'launch-icon-composer',
       array(
         'launchID' => $launch_id,
         'inputID' => $input_id,
       ));
 
     $compose_button = javelin_tag(
       'button',
       array(
         'class' => 'grey',
         'id' => $launch_id,
         'sigil' => 'icon-composer',
       ),
       pht('Choose Icon and Color...'));
 
     $compose_input = javelin_tag(
       'input',
       array(
         'type' => 'hidden',
         'id' => $input_id,
         'name' => 'phid',
       ));
 
     $compose_form = phabricator_form(
       $viewer,
       array(
         'class' => 'profile-image-form',
         'method' => 'POST',
       ),
       array(
         $compose_input,
         $compose_button,
       ));
 
     $form->appendChild(
       id(new AphrontFormMarkupControl())
         ->setLabel(pht('Quick Create'))
         ->setValue($compose_form));
 
     $upload_form = id(new AphrontFormView())
       ->setUser($viewer)
       ->setEncType('multipart/form-data')
       ->appendChild(
         id(new AphrontFormFileControl())
           ->setName('picture')
           ->setLabel(pht('Upload Picture'))
           ->setError($e_file)
           ->setCaption(
             pht('Supported formats: %s', implode(', ', $supported_formats))))
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->addCancelButton($edit_uri)
           ->setValue(pht('Upload Picture')));
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText($title)
       ->setFormErrors($errors)
       ->setForm($form);
 
     $upload_box = id(new PHUIObjectBoxView())
       ->setHeaderText(pht('Upload New Picture'))
       ->setForm($upload_form);
 
     return $this->buildApplicationPage(
       array(
         $crumbs,
         $form_box,
         $upload_box,
       ),
       array(
         'title' => $title,
       ));
   }
 }