diff --git a/conf/default.conf.php b/conf/default.conf.php
index 75e4bb2d63..abbdb7bf2e 100644
--- a/conf/default.conf.php
+++ b/conf/default.conf.php
@@ -1,835 +1,848 @@
 <?php
 
 /*
  * Copyright 2012 Facebook, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *   http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
 
 return array(
 
   // The root URI which Phabricator is installed on.
   // Example: "http://phabricator.example.com/"
   'phabricator.base-uri'        => null,
 
   // If you have multiple environments, provide the production environment URI
   // here so that emails, etc., generated in development/sandbox environments
   // contain the right links.
   'phabricator.production-uri'  => null,
 
   // Setting this to 'true' will invoke a special setup mode which helps guide
   // you through setting up Phabricator.
   'phabricator.setup'           => false,
 
   // The default PHID for users who haven't uploaded a profile image. It should
   // be 50x50px.
   'user.default-profile-image-phid' => 'PHID-FILE-4d61229816cfe6f2b2a3',
 
 // -- IMPORTANT! Security! -------------------------------------------------- //
 
   // IMPORTANT: By default, Phabricator serves files from the same domain the
   // application lives on. This is convenient but not secure: it creates a large
   // class of vulnerabilities which can not be generally mitigated.
   //
   // To avoid this, you should configure a second domain in the same way you
   // have the primary domain configured (e.g., point it at the same machine and
   // set up the same vhost rules) and provide it here. For instance, if your
   // primary install is on "http://www.phabricator-example.com/", you could
   // configure "http://www.phabricator-files.com/" and specify the entire
   // domain (with protocol) here. This will enforce that files are
   // served only from the alternate domain. Ideally, you should use a
   // completely separate domain name rather than just a different subdomain.
   //
   // It is STRONGLY RECOMMENDED that you configure this. Your install is NOT
   // SECURE unless you do so.
   'security.alternate-file-domain'  => null,
 
   // Default key for HMAC digests where the key is not important (i.e., the
   // hash itself is secret). You can change this if you want (to any other
   // string), but doing so will break existing sessions and CSRF tokens.
   'security.hmac-key' => '[D\t~Y7eNmnQGJ;rnH6aF;m2!vJ8@v8C=Cs:aQS\.Qw',
 
 
 // -- DarkConsole ----------------------------------------------------------- //
 
   // DarkConsole is a administrative debugging/profiling tool built into
   // Phabricator. You can leave it disabled unless you're developing against
   // Phabricator.
 
   // Determines whether or not DarkConsole is available. DarkConsole exposes
   // some data like queries and stack traces, so you should be careful about
   // turning it on in production (although users can not normally see it, even
   // if the deployment configuration enables it).
   'darkconsole.enabled'         => false,
 
   // Always enable DarkConsole, even for logged out users. This potentially
   // exposes sensitive information to users, so make sure untrusted users can
   // not access an install running in this mode. You should definitely leave
   // this off in production. It is only really useful for using DarkConsole
   // utilities to debug or profile logged-out pages. You must set
   // 'darkconsole.enabled' to use this option.
   'darkconsole.always-on'       => false,
 
 
   // Allows you to mask certain configuration values from appearing in the
   // "Config" tab of DarkConsole.
   'darkconsole.config-mask'     => array(
     'mysql.pass',
     'amazon-ses.secret-key',
     'recaptcha.private-key',
     'phabricator.csrf-key',
     'facebook.application-secret',
     'github.application-secret',
     'phabricator.mail-key',
     'security.hmac-key',
   ),
 
 
 // --  MySQL  --------------------------------------------------------------- //
 
   // The username to use when connecting to MySQL.
   'mysql.user' => 'root',
 
   // The password to use when connecting to MySQL.
   'mysql.pass' => '',
 
   // The MySQL server to connect to. If you want to connect to a different
   // port than the default (which is 3306), specify it in the hostname
   // (e.g., db.example.com:1234).
   'mysql.host' => 'localhost',
 
   // The number of times to try reconnecting to the MySQL database
   'mysql.connection-retries' => 3,
 
 
 // -- Email ----------------------------------------------------------------- //
 
   // Some Phabricator tools send email notifications, e.g. when Differential
   // revisions are updated or Maniphest tasks are changed. These options allow
   // you to configure how email is delivered.
 
   // You can test your mail setup by going to "MetaMTA" in the web interface,
   // clicking "Send New Message", and then composing a message.
 
   // Default address to send mail "From".
   'metamta.default-address'     => 'noreply@example.com',
 
   // Domain used to generate Message-IDs.
   'metamta.domain'              => 'example.com',
 
   // When a user takes an action which generates an email notification (like
   // commenting on a Differential revision), Phabricator can either send that
   // mail "From" the user's email address (like "alincoln@logcabin.com") or
   // "From" the 'metamta.default-address' address. The user experience is
   // generally better if Phabricator uses the user's real address as the "From"
   // since the messages are easier to organize when they appear in mail clients,
   // but this will only work if the server is authorized to send email on behalf
   // of the "From" domain. Practically, this means:
   //    - If you are doing an install for Example Corp and all the users will
   //      have corporate @corp.example.com addresses and any hosts Phabricator
   //      is running on are authorized to send email from corp.example.com,
   //      you can enable this to make the user experience a little better.
   //    - If you are doing an install for an open source project and your
   //      users will be registering via Facebook and using personal email
   //      addresses, you MUST NOT enable this or virtually all of your outgoing
   //      email will vanish into SFP blackholes.
   //    - If your install is anything else, you're much safer leaving this
   //      off since the risk in turning it on is that your outgoing mail will
   //      mostly never arrive.
   'metamta.can-send-as-user'    => false,
 
   // Adapter class to use to transmit mail to the MTA. The default uses
   // PHPMailerLite, which will invoke "sendmail". This is appropriate
   // if sendmail actually works on your host, but if you haven't configured mail
   // it may not be so great. You can also use Amazon SES, by changing this to
   // 'PhabricatorMailImplementationAmazonSESAdapter', signing up for SES, and
   // filling in your 'amazon-ses.access-key' and 'amazon-ses.secret-key' below.
   'metamta.mail-adapter'        =>
     'PhabricatorMailImplementationPHPMailerLiteAdapter',
 
   // When email is sent, try to hand it off to the MTA immediately. This may
   // be worth disabling if your MTA infrastructure is slow or unreliable. If you
   // disable this option, you must run the 'metamta_mta.php' daemon or mail
   // won't be handed off to the MTA. If you're using Amazon SES it can be a
   // little slugish sometimes so it may be worth disabling this and moving to
   // the daemon after you've got your install up and running. If you have a
   // properly configured local MTA it should not be necessary to disable this.
   'metamta.send-immediately'    => true,
 
   // If you're using Amazon SES to send email, provide your AWS access key
   // and AWS secret key here. To set up Amazon SES with Phabricator, you need
   // to:
   //  - Make sure 'metamta.mail-adapter' is set to:
   //    "PhabricatorMailImplementationAmazonSESAdapter"
   //  - Make sure 'metamta.can-send-as-user' is false.
   //  - Make sure 'metamta.default-address' is configured to something sensible.
   //  - Make sure 'metamta.default-address' is a validated SES "From" address.
   'amazon-ses.access-key'       =>  null,
   'amazon-ses.secret-key'       =>  null,
 
   // If you're using Sendgrid to send email, provide your access credentials
   // here. This will use the REST API. You can also use Sendgrid as a normal
   // SMTP service.
   'sendgrid.api-user'           => null,
   'sendgrid.api-key'            => null,
 
   // You can configure a reply handler domain so that email sent from Maniphest
   // will have a special "Reply To" address like "T123+82+af19f@example.com"
   // that allows recipients to reply by email and interact with tasks. For
   // instructions on configurating reply handlers, see the article
   // "Configuring Inbound Email" in the Phabricator documentation. By default,
   // this is set to 'null' and Phabricator will use a generic 'noreply@' address
   // or the address of the acting user instead of a special reply handler
   // address (see 'metamta.default-address'). If you set a domain here,
   // Phabricator will begin generating private reply handler addresses. See
   // also 'metamta.maniphest.reply-handler' to further configure behavior.
   // This key should be set to the domain part after the @, like "example.com".
   'metamta.maniphest.reply-handler-domain' => null,
 
   // You can follow the instructions in "Configuring Inbound Email" in the
   // Phabricator documentation and set 'metamta.maniphest.reply-handler-domain'
   // to support updating Maniphest tasks by email. If you want more advanced
   // customization than this provides, you can override the reply handler
   // class with an implementation of your own. This will allow you to do things
   // like have a single public reply handler or change how private reply
   // handlers are generated and validated.
   // This key should be set to a loadable subclass of
   // PhabricatorMailReplyHandler (and possibly of ManiphestReplyHandler).
   'metamta.maniphest.reply-handler' => 'ManiphestReplyHandler',
 
   // If you don't want phabricator to take up an entire domain
   // (or subdomain for that matter), you can use this and set a common
   // prefix for mail sent by phabricator. It will make use of the fact that
   // a mail-address such as phabricator+D123+1hjk213h@example.com will be
   // delivered to the phabricator users mailbox.
   // Set this to the left part of the email address and it well get
   // prepended to all outgoing mail. If you want to use e.g.
   // 'phabricator@example.com' this should be set to 'phabricator'.
   'metamta.single-reply-handler-prefix' => null,
 
   // Prefix prepended to mail sent by Maniphest. You can change this to
   // distinguish between testing and development installs, for example.
   'metamta.maniphest.subject-prefix' => '[Maniphest]',
 
   // See 'metamta.maniphest.reply-handler-domain'. This does the same thing,
   // but allows email replies via Differential.
   'metamta.differential.reply-handler-domain' => null,
 
   // See 'metamta.maniphest.reply-handler'. This does the same thing, but
   // affects Differential.
   'metamta.differential.reply-handler' => 'DifferentialReplyHandler',
 
   // Prefix prepended to mail sent by Differential.
   'metamta.differential.subject-prefix' => '[Differential]',
 
   // Set this to true if you want patches to be attached to mail from
   // Differential. This won't work if you are using SendGrid as your mail
   // adapter.
   'metamta.differential.attach-patches' => false,
 
   // To include patches in email bodies, set this to a positive integer. Patches
   // will be inlined if they are at most that many lines. For instance, a value
   // of 100 means "inline patches if they are no longer than 100 lines". By
   // default, patches are not inlined.
   'metamta.differential.inline-patches' => 0,
 
   // If you enable either of the options above, you can choose what format
   // patches are sent in. Valid options are 'unified' (like diff -u) or 'git'.
   'metamta.differential.patch-format'   => 'unified',
 
   // Prefix prepended to mail sent by Diffusion.
   'metamta.diffusion.subject-prefix' => '[Diffusion]',
 
   // See 'metamta.maniphest.reply-handler-domain'. This does the same thing,
   // but allows email replies via Diffusion.
   'metamta.diffusion.reply-handler-domain' => null,
 
   // See 'metamta.maniphest.reply-handler'. This does the same thing, but
   // affects Diffusion.
   'metamta.diffusion.reply-handler' => 'PhabricatorAuditReplyHandler',
 
   // By default, Phabricator generates unique reply-to addresses and sends a
   // separate email to each recipient when you enable reply handling. This is
   // more secure than using "From" to establish user identity, but can mean
   // users may receive multiple emails when they are on mailing lists. Instead,
   // you can use a single, non-unique reply to address and authenticate users
   // based on the "From" address by setting this to 'true'. This trades away
   // a little bit of security for convenience, but it's reasonable in many
   // installs. Object interactions are still protected using hashes in the
   // single public email address, so objects can not be replied to blindly.
   'metamta.public-replies' => false,
 
   // You can configure an email address like "bugs@phabricator.example.com"
   // which will automatically create Maniphest tasks when users send email
   // to it. This relies on the "From" address to authenticate users, so it is
   // is not completely secure. To set this up, enter a complete email
   // address like "bugs@phabricator.example.com" and then configure mail to
   // that address so it routed to Phabricator (if you've already configured
   // reply handlers, you're probably already done). See "Configuring Inbound
   // Email" in the documentation for more information.
   'metamta.maniphest.public-create-email' => null,
 
   // If you enable 'metamta.public-replies', Phabricator uses "From" to
   // authenticate users. You can additionally enable this setting to try to
   // authenticate with 'Reply-To'. Note that this is completely spoofable and
   // insecure (any user can set any 'Reply-To' address) but depending on the
   // nature of your install or other deliverability conditions this might be
   // okay. Generally, you can't do much more by spoofing Reply-To than be
   // annoying (you can write but not read content). But, you know, this is
   // still **COMPLETELY INSECURE**.
   'metamta.insecure-auth-with-reply-to' => false,
 
   // If you enable 'metamta.maniphest.public-create-email' and create an
   // email address like "bugs@phabricator.example.com", it will default to
   // rejecting mail which doesn't come from a known user. However, you might
   // want to let anyone send email to this address; to do so, set a default
   // author here (a Phabricator username). A typical use of this might be to
   // create a "System Agent" user called "bugs" and use that name here. If you
   // specify a valid username, mail will always be accepted and used to create
   // a task, even if the sender is not a system user. The original email
   // address will be stored in an 'From Email' field on the task.
   'metamta.maniphest.default-public-author' => null,
 
   // If this option is enabled, Phabricator will add a "Precedence: bulk"
   // header to transactional mail (e.g., Differential, Maniphest and Herald
   // notifications). This may improve the behavior of some auto-responder
   // software and prevent it from replying. However, it may also cause
   // deliverability issues -- notably, you currently can not send this header
   // via Amazon SES, and enabling this option with SES will prevent delivery
   // of any affected mail.
   'metamta.precedence-bulk' => false,
 
   // Mail.app on OS X Lion won't respect threading headers unless the subject
   // is prefixed with "Re:". If you enable this option, Phabricator will add
   // "Re:" to the subject line of all mail which is expected to thread.
   'metamta.re-prefix' => false,
 
 
 // -- Auth ------------------------------------------------------------------ //
 
   // Can users login with a username/password, or by following the link from
   // a password reset email? You can disable this and configure one or more
   // OAuth providers instead.
   'auth.password-auth-enabled'  => true,
 
   // Maximum number of simultaneous web sessions each user is permitted to have.
   // Setting this to "1" will prevent a user from logging in on more than one
   // browser at the same time.
   'auth.sessions.web'           => 5,
 
   // Maximum number of simultaneous Conduit sessions each user is permitted
   // to have.
   'auth.sessions.conduit'       => 5,
 
   // Set this true to enable the Settings -> SSH Public Keys panel, which will
   // allow users to associated SSH public keys with their accounts. This is only
   // really useful if you're setting up services over SSH and want to use
   // Phabricator for authentication; in most situations you can leave this
   // disabled.
   'auth.sshkeys.enabled'        => false,
 
 
 // -- Accounts -------------------------------------------------------------- //
 
   // Is basic account information (email, real name, profile picture) editable?
   // If you set up Phabricator to automatically synchronize account information
   // from some other authoritative system, you can disable this to ensure
   // information remains consistent across both systems.
   'account.editable'            => true,
 
   // When users set or reset a password, it must have at least this many
   // characters.
   'account.minimum-password-length'  => 8,
 
 
 // -- Facebook OAuth -------------------------------------------------------- //
 
   // Can users use Facebook credentials to login to Phabricator?
   'facebook.auth-enabled'       => false,
 
   // Can users use Facebook credentials to create new Phabricator accounts?
   'facebook.registration-enabled' => true,
 
   // Are Facebook accounts permanently linked to Phabricator accounts, or can
   // the user unlink them?
   'facebook.auth-permanent'     => false,
 
   // The Facebook "Application ID" to use for Facebook API access.
   'facebook.application-id'     => null,
 
   // The Facebook "Application Secret" to use for Facebook API access.
   'facebook.application-secret' => null,
 
 
 // -- GitHub OAuth ---------------------------------------------------------- //
 
   // Can users use GitHub credentials to login to Phabricator?
   'github.auth-enabled'         => false,
 
   // Can users use GitHub credentials to create new Phabricator accounts?
   'github.registration-enabled' => true,
 
   // Are GitHub accounts permanently linked to Phabricator accounts, or can
   // the user unlink them?
   'github.auth-permanent'       => false,
 
   // The GitHub "Client ID" to use for GitHub API access.
   'github.application-id'       => null,
 
   // The GitHub "Secret" to use for GitHub API access.
   'github.application-secret'   => null,
 
 
 // -- Google OAuth ---------------------------------------------------------- //
 
   // Can users use Google credentials to login to Phabricator?
   'google.auth-enabled'         => false,
 
   // Can users use Google credentials to create new Phabricator accounts?
   'google.registration-enabled' => true,
 
   // Are Google accounts permanently linked to Phabricator accounts, or can
   // the user unlink them?
   'google.auth-permanent'       => false,
 
   // The Google "Client ID" to use for Google API access.
   'google.application-id'       => null,
 
   // The Google "Client Secret" to use for Google API access.
   'google.application-secret'   => null,
 
 // -- Phabricator OAuth ----------------------------------------------------- //
 
   // Meta-town -- Phabricator is itself an OAuth Provider
   // TODO -- T887 -- make this support multiple Phabricator instances!
 
   // The URI of the Phabricator instance to use as an OAuth server.
   'phabricator.oauth-uri'            => null,
 
   // Can users use Phabricator credentials to login to Phabricator?
   'phabricator.auth-enabled'         => false,
 
   // Can users use Phabricator credentials to create new Phabricator accounts?
   'phabricator.registration-enabled' => true,
 
   // Are Phabricator accounts permanently linked to Phabricator accounts, or can
   // the user unlink them?
   'phabricator.auth-permanent'       => false,
 
   // The Phabricator "Client ID" to use for Phabricator API access.
   'phabricator.application-id'       => null,
 
   // The Phabricator "Client Secret" to use for Phabricator API access.
   'phabricator.application-secret'   => null,
 
 // -- Recaptcha ------------------------------------------------------------- //
 
   // Is Recaptcha enabled? If disabled, captchas will not appear. You should
   // enable Recaptcha if your install is public-facing, as it hinders
   // brute-force attacks.
   'recaptcha.enabled'           => false,
 
   // Your Recaptcha public key, obtained from Recaptcha.
   'recaptcha.public-key'        => null,
 
   // Your Recaptcha private key, obtained from Recaptcha.
   'recaptcha.private-key'       => null,
 
 
 // -- Misc ------------------------------------------------------------------ //
 
   // This is hashed with other inputs to generate CSRF tokens. If you want, you
   // can change it to some other string which is unique to your install. This
   // will make your install more secure in a vague, mostly theoretical way. But
   // it will take you like 3 seconds of mashing on your keyboard to set it up so
   // you might as well.
   'phabricator.csrf-key'        => '0b7ec0592e0a2829d8b71df2fa269b2c6172eca3',
 
   // This is hashed with other inputs to generate mail tokens. If you want, you
   // can change it to some other string which is unique to your install. In
   // particular, you will want to do this if you accidentally send a bunch of
   // mail somewhere you shouldn't have, to invalidate all old reply-to
   // addresses.
   'phabricator.mail-key'        => '5ce3e7e8787f6e40dfae861da315a5cdf1018f12',
 
   // Version string displayed in the footer. You probably should leave this
   // alone.
   'phabricator.version'         => 'UNSTABLE',
 
   // PHP requires that you set a timezone in your php.ini before using date
   // functions, or it will emit a warning. If this isn't possible (for instance,
   // because you are using HPHP) you can set some valid constant for
   // date_default_timezone_set() here and Phabricator will set it on your
   // behalf, silencing the warning.
   'phabricator.timezone'        => null,
 
   // When unhandled exceptions occur, stack traces are hidden by default.
   // You can enable traces for development to make it easier to debug problems.
   'phabricator.show-stack-traces' => false,
 
   // Shows an error callout if a page generated PHP errors, warnings or notices.
   // This makes it harder to miss problems while developing Phabricator.
   'phabricator.show-error-callout' => false,
 
   // When users write comments which have URIs, they'll be automatically linked
   // if the protocol appears in this set. This whitelist is primarily to prevent
   // security issues like javascript:// URIs.
   'uri.allowed-protocols' => array(
     'http'  => true,
     'https' => true,
   ),
 
   // Tokenizers are UI controls which let the user select other users, email
   // addresses, project names, etc., by typing the first few letters and having
   // the control autocomplete from a list. They can load their data in two ways:
   // either in a big chunk up front, or as the user types. By default, the data
   // is loaded in a big chunk. This is simpler and performs better for small
   // datasets. However, if you have a very large number of users or projects,
   // (in the ballpark of more than a thousand), loading all that data may become
   // slow enough that it's worthwhile to query on demand instead. This makes
   // the typeahead slightly less responsive but overall performance will be much
   // better if you have a ton of stuff. You can figure out which setting is
   // best for your install by changing this setting and then playing with a
   // user tokenizer (like the user selectors in Maniphest or Differential) and
   // seeing which setting loads faster and feels better.
   'tokenizer.ondemand'          => false,
 
   // By default, Phabricator includes some silly nonsense in the UI, such as
   // a submit button called "Clowncopterize" in Differential and a call to
   // "Leap Into Action". If you'd prefer more traditional UI strings like
   // "Submit", you can set this flag to disable most of the jokes and easter
   // eggs.
   'phabricator.serious-business' => false,
 
 
 // -- Files ----------------------------------------------------------------- //
 
   // Lists which uploaded file types may be viewed in the browser. If a file
   // has a mime type which does not appear in this list, it will always be
   // downloaded instead of displayed. This is mainly a usability
   // consideration, since browsers tend to freak out when viewing enormous
   // binary files.
   //
   // The keys in this array are viewable mime types; the values are the mime
   // types they will be delivered as when they are viewed in the browser.
   //
   // IMPORTANT: Configure 'security.alternate-file-domain' above! Your install
   // is NOT safe if it is left unconfigured.
   'files.viewable-mime-types' => array(
     'image/jpeg'  => 'image/jpeg',
     'image/jpg'   => 'image/jpg',
     'image/png'   => 'image/png',
     'image/gif'   => 'image/gif',
     'text/plain'  => 'text/plain; charset=utf-8',
 
     // ".ico" favicon files, which have mime type diversity. See:
     // http://en.wikipedia.org/wiki/ICO_(file_format)#MIME_type
     'image/x-ico'               => 'image/x-icon',
     'image/x-icon'              => 'image/x-icon',
     'image/vnd.microsoft.icon'  => 'image/x-icon',
   ),
 
+  // List of mime types which can be used as the source for an <img /> tag.
+  // This should be a subset of 'files.viewable-mime-types' and exclude files
+  // like text.
+  'files.image-mime-types' => array(
+    'image/jpeg'                => true,
+    'image/jpg'                 => true,
+    'image/png'                 => true,
+    'image/gif'                 => true,
+    'image/x-ico'               => true,
+    'image/x-icon'              => true,
+    'image/vnd.microsoft.icon'  => true,
+  ),
+
   // Phabricator can proxy images from other servers so you can paste the URI
   // to a funny picture of a cat into the comment box and have it show up as an
   // image. However, this means the webserver Phabricator is running on will
   // make HTTP requests to arbitrary URIs. If the server has access to internal
   // resources, this could be a security risk. You should only enable it if you
   // are installed entirely a VPN and VPN access is required to access
   // Phabricator, or if the webserver has no special access to anything. If
   // unsure, it is safer to leave this disabled.
   'files.enable-proxy' => false,
 
 
 // -- Storage --------------------------------------------------------------- //
 
   // Phabricator allows users to upload files, and can keep them in various
   // storage engines. This section allows you to configure which engines
   // Phabricator will use, and how it will use them.
 
   // The largest filesize Phabricator will store in the MySQL BLOB storage
   // engine, which just uses a database table to store files. While this isn't a
   // best practice, it's really easy to set up. This is hard-limited by the
   // value of 'max_allowed_packet' in MySQL (since this often defaults to 1MB,
   // the default here is slightly smaller than 1MB). Set this to 0 to disable
   // use of the MySQL blob engine.
   'storage.mysql-engine.max-size' => 1000000,
 
   // Phabricator provides a local disk storage engine, which just writes files
   // to some directory on local disk. The webserver must have read/write
   // permissions on this directory. This is straightforward and suitable for
   // most installs, but will not scale past one web frontend unless the path
   // is actually an NFS mount, since you'll end up with some of the files
   // written to each web frontend and no way for them to share. To use the
   // local disk storage engine, specify the path to a directory here. To
   // disable it, specify null.
   'storage.local-disk.path'       => null,
 
   // If you want to store files in Amazon S3, specify an AWS access and secret
   // key here and a bucket name below.
   'amazon-s3.access-key'          =>  null,
   'amazon-s3.secret-key'          =>  null,
 
   // Set this to a valid Amazon S3 bucket to store files there. You must also
   // configure S3 access keys above.
   'storage.s3.bucket'             => null,
 
   // Phabricator uses a storage engine selector to choose which storage engine
   // to use when writing file data. If you add new storage engines or want to
   // provide very custom rules (e.g., write images to one storage engine and
   // other files to a different one), you can provide an alternate
   // implementation here. The default engine will use choose MySQL, Local Disk,
   // and S3, in that order, if they have valid configurations above and a file
   // fits within configured limits.
   'storage.engine-selector' => 'PhabricatorDefaultFileStorageEngineSelector',
 
 
 // -- Search ---------------------------------------------------------------- //
 
   // Phabricator uses a search engine selector to choose which search engine
   // to use when indexing and reconstructing documents, and when executing
   // queries. You can override the engine selector to provide a new selector
   // class which can select some custom engine you implement, if you want to
   // store your documents in some search engine which does not have default
   // support.
   'search.engine-selector'  => 'PhabricatorDefaultSearchEngineSelector',
 
 
 // -- Differential ---------------------------------------------------------- //
 
   'differential.revision-custom-detail-renderer'  => null,
 
   // Array for custom remarkup rules. The array should have a list of
   // class names of classes that extend PhutilRemarkupRule
   'differential.custom-remarkup-rules' => null,
 
   // Array for custom remarkup block rules. The array should have a list of
   // class names of classes that extend PhutilRemarkupEngineBlockRule
   'differential.custom-remarkup-block-rules' => null,
 
   // Set display word-wrap widths for Differential. Specify a dictionary of
   // regular expressions mapping to column widths. The filename will be matched
   // against each regexp in order until one matches. The default configuration
   // uses a width of 100 for Java and 80 for other languages. Note that 80 is
   // the greatest column width of all time. Changes here will not be immediately
   // reflected in old revisions unless you purge the changeset render cache
   // (with `./scripts/util/purge_cache.php --changesets`).
   'differential.wordwrap' => array(
     '/\.java$/' => 100,
     '/.*/'      => 80,
   ),
 
   // List of file regexps were whitespace is meaningful and should not
   // use 'ignore-all' by default
   'differential.whitespace-matters' => array(
     '/\.py$/',
     '/\.l?hs$/',
   ),
 
   'differential.field-selector' => 'DifferentialDefaultFieldSelector',
 
   // Differential can show "Host" and "Path" fields on revisions, with
   // information about the machine and working directory where the
   // change came from. These fields are disabled by default because they may
   // occasionally have sensitive information; you can set this to true to
   // enable them.
   'differential.show-host-field'  => false,
 
   // If you set this to true, users can "!accept" revisions via email (normally,
   // they can take other actions but can not "!accept"). This action is disabled
   // by default because email authentication can be configured to be very weak,
   // and, socially, email "!accept" is kind of sketchy and implies revisions may
   // not actually be receiving thorough review.
   'differential.enable-email-accept' => false,
 
   // If you set this to true, users won't need to login to view differential
   // revisions.  Anonymous users will have read-only access and won't be able to
   // interact with the revisions.
   'differential.anonymous-access' => false,
 
   // List of file regexps that should be treated as if they are generated by
   // an automatic process, and thus get hidden by default in differential
   'differential.generated-paths' => array(
     // '/config\.h$/',
     // '#/autobuilt/#',
   ),
 
 
 // -- Maniphest ------------------------------------------------------------- //
 
   'maniphest.enabled' => true,
 
   // Array of custom fields for Maniphest tasks. For details on adding custom
   // fields to Maniphest, see "Maniphest User Guide: Adding Custom Fields".
   'maniphest.custom-fields' => array(),
 
   // Class which drives custom field construction. See "Maniphest User Guide:
   // Adding Custom Fields" in the documentation for more information.
   'maniphest.custom-task-extensions-class' => 'ManiphestDefaultTaskExtensions',
 
 // -- Phriction ------------------------------------------------------------- //
 
   'phriction.enabled' => true,
 
 // -- Remarkup -------------------------------------------------------------- //
 
   // If you enable this, linked YouTube videos will be embeded inline. This has
   // mild security implications (you'll leak referrers to YouTube) and is pretty
   // silly (but sort of awesome).
   'remarkup.enable-embedded-youtube' => false,
 
 
 // -- Garbage Collection ---------------------------------------------------- //
 
   // Phabricator generates various logs and caches in the database which can
   // be garbage collected after a while to make the total data size more
   // manageable. To run garbage collection, launch a
   // PhabricatorGarbageCollector daemon.
 
   // Since the GC daemon can issue large writes and table scans, you may want to
   // run it only during off hours or make sure it is scheduled so it doesn't
   // overlap with backups. This determines when the daemon can start running
   // each day.
   'gcdaemon.run-at'    => '12 AM',
 
   // How many seconds after 'gcdaemon.run-at' the daemon may collect garbage
   // for. By default it runs continuously, but you can set it to run for a
   // limited period of time. For instance, if you do backups at 3 AM, you might
   // run garbage collection for an hour beforehand. This is not a high-precision
   // limit so you may want to leave some room for the GC to actually stop, and
   // if you set it to something like 3 seconds you're on your own.
   'gcdaemon.run-for'   => 24 * 60 * 60,
 
   // These 'ttl' keys configure how much old data the GC daemon keeps around.
   // Objects older than the ttl will be collected. Set any value to 0 to store
   // data indefinitely.
 
   'gcdaemon.ttl.herald-transcripts'         => 30 * (24 * 60 * 60),
   'gcdaemon.ttl.daemon-logs'                =>  7 * (24 * 60 * 60),
   'gcdaemon.ttl.differential-parse-cache'   => 14 * (24 * 60 * 60),
 
 
 // -- Feed ------------------------------------------------------------------ //
 
   // If you set this to true, you can embed Phabricator activity feeds in other
   // pages using iframes. These feeds are completely public, and a login is not
   // required to view them! This is intended for things like open source
   // projects that want to expose an activity feed on the project homepage.
   'feed.public' => false,
 
 
 // -- Drydock --------------------------------------------------------------- //
 
   // If you want to use Drydock's builtin EC2 Blueprints, configure your AWS
   // EC2 credentials here.
   'amazon-ec2.access-key'   => null,
   'amazon-ec2.secret-key'   => null,
 
 // -- Customization --------------------------------------------------------- //
 
   // Paths to additional phutil libraries to load.
   'load-libraries' => array(),
 
   'aphront.default-application-configuration-class' =>
     'AphrontDefaultApplicationConfiguration',
 
   'controller.oauth-registration' =>
     'PhabricatorOAuthDefaultRegistrationController',
 
 
   // Directory that phd (the Phabricator daemon control script) should use to
   // track running daemons.
   'phd.pid-directory' => '/var/tmp/phd',
 
   // This value is an input to the hash function when building resource hashes.
   // It has no security value, but if you accidentally poison user caches (by
   // pushing a bad patch or having something go wrong with a CDN, e.g.) you can
   // change this to something else and rebuild the Celerity map to break user
   // caches. Unless you are doing Celerity development, it is exceptionally
   // unlikely that you need to modify this.
   'celerity.resource-hash' => 'd9455ea150622ee044f7931dabfa52aa',
 
   // In a development environment, it is desirable to force static resources
   // (CSS and JS) to be read from disk on every request, so that edits to them
   // appear when you reload the page even if you haven't updated the resource
   // maps. This setting ensures requests will be verified against the state on
   // disk. Generally, you should leave this off in production (caching behavior
   // and performance improve with it off) but turn it on in development. (These
   // settings are the defaults.)
   'celerity.force-disk-reads' => false,
 
   // You can respond to various application events by installing listeners,
   // which will receive callbacks when interesting things occur. Specify a list
   // of classes which extend PhabricatorEventListener here.
   'events.listeners'  => array(),
 
 // -- Pygments -------------------------------------------------------------- //
 
   // Phabricator can highlight PHP by default, but if you want syntax
   // highlighting for other languages you should install the python package
   // 'Pygments', make sure the 'pygmentize' script is available in the
   // $PATH of the webserver, and then enable this.
   'pygments.enabled'            => false,
 
   // In places that we display a dropdown to syntax-highlight code,
   // this is where that list is defined.
   // Syntax is 'lexer-name' => 'Display Name',
   'pygments.dropdown-choices' => array(
     'apacheconf' => 'Apache Configuration',
     'bash' => 'Bash Scripting',
     'brainfuck' => 'Brainf*ck',
     'c' => 'C',
     'cpp' => 'C++',
     'css' => 'CSS',
     'diff' => 'Diff',
     'django' => 'Django Templating',
     'erb' => 'Embedded Ruby/ERB',
     'erlang' => 'Erlang',
     'html' => 'HTML',
     'infer' => 'Infer from title (extension)',
     'java' => 'Java',
     'js' => 'Javascript',
     'mysql' => 'MySQL',
     'perl' => 'Perl',
     'php' => 'PHP',
     'text' => 'Plain Text',
     'python' => 'Python',
     'rainbow' => 'Rainbow',
     'remarkup' => 'Remarkup',
     'ruby' => 'Ruby',
     'xml' => 'XML',
   ),
 
   'pygments.dropdown-default' => 'infer',
 
   // This is an override list of regular expressions which allows you to choose
   // what language files are highlighted as. If your projects have certain rules
   // about filenames or use unusual or ambiguous language extensions, you can
   // create a mapping here. This is an ordered dictionary of regular expressions
   // which will be tested against the filename. They should map to either an
   // explicit language as a string value, or a numeric index into the captured
   // groups as an integer.
   'syntax.filemap' => array(
     // Example: Treat all '*.xyz' files as PHP.
     // '@\\.xyz$@' => 'php',
 
     // Example: Treat 'httpd.conf' as 'apacheconf'.
     // '@/httpd\\.conf$@' => 'apacheconf',
 
     // Example: Treat all '*.x.bak' file as '.x'. NOTE: we map to capturing
     // group 1 by specifying the mapping as "1".
     // '@\\.([^.]+)\\.bak$@' => 1,
 
     '@\.arcconfig$@' => 'js',
   ),
 
 );
diff --git a/resources/sql/patches/119.filehash.sql b/resources/sql/patches/119.filehash.sql
new file mode 100644
index 0000000000..549721165c
--- /dev/null
+++ b/resources/sql/patches/119.filehash.sql
@@ -0,0 +1,5 @@
+ALTER TABLE phabricator_file.file
+  ADD contentHash varchar(40) COLLATE utf8_bin;
+
+ALTER TABLE phabricator_file.file
+  ADD KEY (contentHash);
diff --git a/src/applications/diffusion/controller/file/DiffusionBrowseFileController.php b/src/applications/diffusion/controller/file/DiffusionBrowseFileController.php
index bf559965c4..c78c106dcd 100644
--- a/src/applications/diffusion/controller/file/DiffusionBrowseFileController.php
+++ b/src/applications/diffusion/controller/file/DiffusionBrowseFileController.php
@@ -1,490 +1,489 @@
 <?php
 
 /*
  * Copyright 2012 Facebook, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *   http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
 
 final class DiffusionBrowseFileController extends DiffusionController {
 
-  // Image types we want to display inline using <img> tags
-  protected $imageTypes = array(
-    'png' => 'image/png',
-    'gif' => 'image/gif',
-    'ico' => 'image/png',
-    'jpg' => 'image/jpeg',
-    'jpeg'=> 'image/jpeg'
-  );
-
-  // Document types that should trigger link to ?view=raw
-  protected $documentTypes = array(
-    'pdf'=> 'application/pdf',
-    'ps' => 'application/postscript',
-  );
+  private $corpusType = 'text';
 
   public function processRequest() {
 
-    // Build the view selection form.
-    $select_map = array(
-      'highlighted' => 'View as Highlighted Text',
-      'blame' => 'View as Highlighted Text with Blame',
-      'plain' => 'View as Plain Text',
-      'plainblame' => 'View as Plain Text with Blame',
-      'raw' => 'View as raw document',
-    );
-
     $request = $this->getRequest();
 
     $drequest = $this->getDiffusionRequest();
     $path = $drequest->getPath();
     $selected = $request->getStr('view');
     $needs_blame = ($selected == 'blame' || $selected == 'plainblame');
     $file_query = DiffusionFileContentQuery::newFromDiffusionRequest(
       $this->diffusionRequest);
     $file_query->setNeedsBlame($needs_blame);
     $file_query->loadFileContent();
     $data = $file_query->getRawData();
-    if ($selected === 'raw') {
-      $response = new AphrontFileResponse();
-      $response->setContent($data);
-      $mime_type = $this->getDocumentType($path);
-      if ($mime_type) {
-        $response->setMimeType($mime_type);
-      } else {
-        $as_filename = idx(pathinfo($path), 'basename');
-        $response->setDownload($as_filename);
-      }
-      return $response;
-    }
-
-    $select = '<select name="view">';
-    foreach ($select_map as $k => $v) {
-      $option = phutil_render_tag(
-        'option',
-        array(
-          'value' => $k,
-          'selected' => ($k == $selected) ? 'selected' : null,
-        ),
-        phutil_escape_html($v));
-
-      $select .= $option;
-    }
-    $select .= '</select>';
 
-    require_celerity_resource('diffusion-source-css');
-
-    $edit_button = '';
-    $user = $request->getUser();
-    if ($user) {
-      $line = 1;
-      $repository = $this->getDiffusionRequest()->getRepository();
-      $editor_link = $user->loadEditorLink($path, $line, $repository);
-      if ($editor_link) {
-        $edit_button = phutil_render_tag(
-          'a',
-          array(
-            'href' => $editor_link,
-            'class' => 'button',
-          ),
-          'Edit');
-      }
+    if ($selected === 'raw') {
+      return $this->buildRawResponse($path, $data);
     }
 
-    $view_select_panel = new AphrontPanelView();
-    $view_select_form = phutil_render_tag(
-      'form',
-      array(
-        'action' => $request->getRequestURI(),
-        'method' => 'get',
-        'class'  => 'diffusion-browse-type-form',
-      ),
-      $select.
-      ' <button>View</button> '.
-      $edit_button);
-    $view_select_panel->appendChild($view_select_form);
-
-    $view_select_panel->appendChild('<div style="clear: both;"></div>');
-
     // Build the content of the file.
     $corpus = $this->buildCorpus(
       $selected,
       $file_query,
       $needs_blame,
       $drequest,
       $path,
-      $data
-    );
+      $data);
+
+    require_celerity_resource('diffusion-source-css');
+
+    if ($this->corpusType == 'text') {
+      $view_select_panel = $this->renderViewSelectPanel();
+    } else {
+      $view_select_panel = null;
+    }
 
     // Render the page.
     $content = array();
     $content[] = $this->buildCrumbs(
       array(
         'branch' => true,
         'path'   => true,
         'view'   => 'browse',
       ));
     $content[] = $view_select_panel;
     $content[] = $corpus;
     $content[] = $this->buildOpenRevisions();
 
     $nav = $this->buildSideNav('browse', true);
     $nav->appendChild($content);
 
-
     $basename = basename($this->getDiffusionRequest()->getPath());
 
     return $this->buildStandardPageResponse(
       $nav,
       array(
         'title' => $basename,
       ));
   }
 
-
-  /**
-   * Returns a content-type corrsponding to an image file extension
-   *
-   * @param string $path File path
-   * @return mixed A content-type string or NULL if path doesn't end with a
-   *               recognized image extension
-   */
-  public function getImageType($path) {
-    $ext = pathinfo($path);
-    $ext = idx($ext, 'extension');
-    return idx($this->imageTypes, $ext);
-  }
-
-  /**
-   * Returns a content-type corresponding to an document file extension
-   *
-   * @param string $path File path
-   * @return mixed A content-type string or NULL if path doesn't end with a
-   *               recognized document extension
-   */
-  public function getDocumentType($path) {
-    $ext = pathinfo($path);
-    $ext = idx($ext, 'extension');
-    return idx($this->documentTypes, $ext);
-  }
-
-
   private function buildCorpus($selected,
                                $file_query,
                                $needs_blame,
                                $drequest,
                                $path,
                                $data) {
-    $image_type = $this->getImageType($path);
-    if ($image_type && !$selected) {
-      $corpus = phutil_render_tag(
-        'img',
-        array(
-          'style' => 'padding-bottom: 10px',
-          'src' => 'data:'.$image_type.';base64,'.base64_encode($data),
-        )
-      );
-      return $corpus;
-    }
 
-    $document_type = $this->getDocumentType($path);
-    if (($document_type && !$selected) || !phutil_is_utf8($data)) {
-      $data = $file_query->getRawData();
-      $document_type_description = $document_type ? $document_type : 'binary';
-      $corpus = phutil_render_tag(
-        'p',
-        array(
-          'style' => 'text-align: center;'
-        ),
-        phutil_render_tag(
-          'a',
-          array(
-            'href' => '?view=raw',
-            'class' => 'button'
-          ),
-          "View $document_type_description"
-        )
-      );
-      return $corpus;
+    if (ArcanistDiffUtils::isHeuristicBinaryFile($data)) {
+      $file = $this->loadFileForData($path, $data);
+      $file_uri = $file->getBestURI();
+
+      if ($file->isViewableImage()) {
+        $this->corpusType = 'image';
+        return $this->buildImageCorpus($file_uri);
+      } else {
+        $this->corpusType = 'binary';
+        return $this->buildBinaryCorpus($file_uri, $data);
+      }
     }
 
 
     // TODO: blame of blame.
     switch ($selected) {
       case 'plain':
         $style =
           "margin: 1em 2em; width: 90%; height: 80em; font-family: monospace";
         $corpus = phutil_render_tag(
           'textarea',
           array(
             'style' => $style,
           ),
           phutil_escape_html($file_query->getRawData()));
 
           break;
 
       case 'plainblame':
         $style =
           "margin: 1em 2em; width: 90%; height: 80em; font-family: monospace";
         list($text_list, $rev_list, $blame_dict) =
           $file_query->getBlameData();
 
         $rows = array();
         foreach ($text_list as $k => $line) {
           $rev = $rev_list[$k];
           if (isset($blame_dict[$rev]['handle'])) {
             $author = $blame_dict[$rev]['handle']->getName();
           } else {
             $author = $blame_dict[$rev]['author'];
           }
           $rows[] =
             sprintf("%-10s %-20s %s", substr($rev, 0, 7), $author, $line);
         }
 
         $corpus = phutil_render_tag(
           'textarea',
           array(
             'style' => $style,
           ),
           phutil_escape_html(implode("\n", $rows)));
 
         break;
 
       case 'highlighted':
       case 'blame':
       default:
         require_celerity_resource('syntax-highlighting-css');
 
         list($text_list, $rev_list, $blame_dict) = $file_query->getBlameData();
 
         $text_list = implode("\n", $text_list);
         $text_list = PhabricatorSyntaxHighlighter::highlightWithFilename(
           $path,
           $text_list);
         $text_list = explode("\n", $text_list);
 
         $rows = $this->buildDisplayRows($text_list, $rev_list, $blame_dict,
           $needs_blame, $drequest, $file_query, $selected);
 
         $corpus_table = phutil_render_tag(
           'table',
           array(
             'class' => "diffusion-source remarkup-code PhabricatorMonospaced",
           ),
           implode("\n", $rows));
         $corpus = phutil_render_tag(
           'div',
           array(
             'style' => 'padding: 0pt 2em;',
           ),
           $corpus_table);
 
         break;
     }
 
     return $corpus;
   }
 
+  private function renderViewSelectPanel() {
+
+    $request = $this->getRequest();
+
+    $select = AphrontFormSelectControl::renderSelectTag(
+      $request->getStr('view'),
+      array(
+        'highlighted'   => 'View as Highlighted Text',
+        'blame'         => 'View as Highlighted Text with Blame',
+        'plain'         => 'View as Plain Text',
+        'plainblame'    => 'View as Plain Text with Blame',
+        'raw'           => 'View as raw document',
+      ),
+      array(
+        'name' => 'view',
+      ));
+
+    $view_select_panel = new AphrontPanelView();
+    $view_select_form = phutil_render_tag(
+      'form',
+      array(
+        'action' => $request->getRequestURI(),
+        'method' => 'get',
+        'class'  => 'diffusion-browse-type-form',
+      ),
+      $select.
+      ' <button>View</button> '.
+      $this->renderEditButton());
+
+    $view_select_panel->appendChild($view_select_form);
+    $view_select_panel->appendChild('<div style="clear: both;"></div>');
+
+    return $view_select_panel;
+  }
+
+  private function renderEditButton() {
+    $request = $this->getRequest();
+    $user = $request->getUser();
+
+    $drequest = $this->getDiffusionRequest();
+
+    $repository = $drequest->getRepository();
+    $path = $drequest->getPath();
+    $line = 1;
+
+    $editor_link = $user->loadEditorLink($path, $line, $repository);
+    if (!$editor_link) {
+      return null;
+    }
+
+    return phutil_render_tag(
+      'a',
+      array(
+        'href' => $editor_link,
+        'class' => 'button',
+      ),
+      'Edit');
+  }
 
   private function buildDisplayRows($text_list, $rev_list, $blame_dict,
     $needs_blame, DiffusionRequest $drequest, $file_query, $selected) {
     $last_rev = null;
     $color = '#eeeeee';
     $rows = array();
     $n = 1;
     $view = $this->getRequest()->getStr('view');
 
     if ($blame_dict) {
       $epoch_list = ipull($blame_dict, 'epoch');
       $epoch_max = max($epoch_list);
       $epoch_min = min($epoch_list);
       $epoch_range = $epoch_max - $epoch_min + 1;
     }
 
     $targ = '';
     $min_line = 0;
     $line = $drequest->getLine();
     if (strpos($line, '-') !== false) {
       list($min, $max) = explode('-', $line, 2);
       $min_line = min($min, $max);
       $max_line = max($min, $max);
     } else if (strlen($line)) {
       $min_line = $line;
       $max_line = $line;
     }
 
     foreach ($text_list as $k => $line) {
       if ($needs_blame) {
         // If the line's rev is same as the line above, show empty content
         // with same color; otherwise generate blame info. The newer a change
         // is, the darker the color.
         $rev = $rev_list[$k];
         if ($last_rev == $rev) {
           $blame_info =
             ($file_query->getSupportsBlameOnBlame() ?
               '<th style="background: '.$color.'; width: 2em;"></th>' : '').
             '<th style="background: '.$color.'; width: 9em;"></th>'.
             '<th style="background: '.$color.'"></th>';
         } else {
 
           $revision_time = null;
           if ($blame_dict) {
             $color_number = (int)(0xEE -
               0xEE * ($blame_dict[$rev]['epoch'] - $epoch_min) / $epoch_range);
             $color = sprintf('#%02xee%02x', $color_number, $color_number);
             $revision_time = phabricator_datetime(
               $blame_dict[$rev]['epoch'],
               $this->getRequest()->getUser());
           }
 
           $revision_link = self::renderRevision(
             $drequest,
             substr($rev, 0, 7));
 
           if (!$file_query->getSupportsBlameOnBlame()) {
             $prev_link = '';
           } else {
             $prev_rev = $file_query->getPrevRev($rev);
             $path = $drequest->getPath();
             $prev_link = self::renderBrowse(
               $drequest,
               $path,
               "\xC2\xAB",
               $prev_rev,
               $n,
               $selected,
               'Blame previous revision');
             $prev_link = phutil_render_tag(
               'th',
               array(
                 'class' => 'diffusion-wide-link',
                 'style' => 'background: '.$color.'; width: 2em;',
               ),
               $prev_link);
           }
 
           if (isset($blame_dict[$rev]['handle'])) {
             $author_link = $blame_dict[$rev]['handle']->renderLink();
           } else {
             $author_link = phutil_escape_html($blame_dict[$rev]['author']);
           }
           $blame_info =
             $prev_link .
             '<th style="background: '.$color.'; width: 12em;" title="'.
             phutil_escape_html($revision_time).'">'.$revision_link.'</th>'.
             '<th style="background: '.$color.'; width: 12em'.
               '; font-weight: normal; color: #333;">'.$author_link.'</th>';
           $last_rev = $rev;
         }
       } else {
         $blame_info = null;
       }
 
       // Highlight the line of interest if needed.
       if ($min_line > 0 && ($n >= $min_line && $n <= $max_line)) {
         $tr = '<tr style="background: #ffff00;">';
         if ($targ == '') {
           $targ = '<a id="scroll_target"></a>';
           Javelin::initBehavior('diffusion-jump-to',
             array('target' => 'scroll_target'));
         }
       } else {
         $tr = '<tr>';
         $targ = null;
       }
 
       $href = $drequest->generateURI(
         array(
           'action' => 'browse',
           'stable' => true,
         ));
       $href = (string)$href;
 
       $query_params = null;
       if ($view) {
         $query_params = '?view='.$view;
       }
 
       $link = phutil_render_tag(
         'a',
         array(
           'href' => $href.'$'.$n.$query_params,
         ),
         $n);
 
       $rows[] = $tr.$blame_info.
         '<th class="diffusion-wide-link">'.$link.'</th>'.
         '<td>'.$targ.$line.'</td></tr>';
       ++$n;
     }
 
     return $rows;
   }
 
 
   private static function renderRevision(DiffusionRequest $drequest,
     $revision) {
 
     $callsign = $drequest->getCallsign();
 
     $name = 'r'.$callsign.$revision;
     return phutil_render_tag(
       'a',
       array(
            'href' => '/'.$name,
       ),
       $name
     );
   }
 
 
   private static function renderBrowse(
     DiffusionRequest $drequest,
     $path,
     $name = null,
     $rev = null,
     $line = null,
     $view = null,
     $title = null) {
 
     $callsign = $drequest->getCallsign();
 
     if ($name === null) {
       $name = $path;
     }
 
     $at = null;
     if ($rev) {
       $at = ';'.$rev;
     }
 
     if ($view) {
       $view = '?view='.$view;
     }
 
     if ($line) {
       $line = '$'.$line;
     }
 
     return phutil_render_tag(
       'a',
       array(
         'href' => "/diffusion/{$callsign}/browse/{$path}{$at}{$line}{$view}",
         'title' => $title,
       ),
       $name
     );
   }
 
+  private function loadFileForData($path, $data) {
+    $hash = PhabricatorHash::digest($data);
+
+    $file = id(new PhabricatorFile())->loadOneWhere(
+      'contentHash = %s LIMIT 1',
+      $hash);
+    if (!$file) {
+      // We're just caching the data; this is always safe.
+      $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
+
+      $file = PhabricatorFile::newFromFileData(
+        $data,
+        array(
+          'name' => basename($path),
+        ));
+
+      unset($unguarded);
+    }
+
+    return $file;
+  }
+
+  private function buildRawResponse($path, $data) {
+    $file = $this->loadFileForData($path, $data);
+    return id(new AphrontRedirectResponse())->setURI($file->getBestURI());
+  }
+
+  private function buildImageCorpus($file_uri) {
+    $panel = new AphrontPanelView();
+    $panel->setHeader('Image');
+    $panel->addButton($this->renderEditButton());
+    $panel->appendChild(
+      phutil_render_tag(
+        'img',
+        array(
+          'src' => $file_uri,
+        )));
+    return $panel;
+  }
+
+  private function buildBinaryCorpus($file_uri, $data) {
+    $panel = new AphrontPanelView();
+    $panel->setHeader('Binary File');
+    $panel->addButton($this->renderEditButton());
+    $panel->appendChild(
+      '<p>'.
+        'This is a binary file. '.
+        'It is '.number_format(strlen($data)).' bytes in length.'.
+      '</p>');
+    $panel->addButton(
+      phutil_render_tag(
+        'a',
+        array(
+          'href' => $file_uri,
+          'class' => 'button green',
+        ),
+        'Download Binary File...'));
+    return $panel;
+  }
+
 
 }
diff --git a/src/applications/diffusion/controller/file/__init__.php b/src/applications/diffusion/controller/file/__init__.php
index bc661ff283..6ed4027961 100644
--- a/src/applications/diffusion/controller/file/__init__.php
+++ b/src/applications/diffusion/controller/file/__init__.php
@@ -1,22 +1,28 @@
 <?php
 /**
  * This file is automatically generated. Lint this module to rebuild it.
  * @generated
  */
 
 
 
-phutil_require_module('phabricator', 'aphront/response/file');
+phutil_require_module('arcanist', 'difference');
+
+phutil_require_module('phabricator', 'aphront/response/redirect');
+phutil_require_module('phabricator', 'aphront/writeguard');
 phutil_require_module('phabricator', 'applications/diffusion/controller/base');
 phutil_require_module('phabricator', 'applications/diffusion/query/filecontent/base');
+phutil_require_module('phabricator', 'applications/files/storage/file');
 phutil_require_module('phabricator', 'applications/markup/syntax');
 phutil_require_module('phabricator', 'infrastructure/celerity/api');
 phutil_require_module('phabricator', 'infrastructure/javelin/api');
+phutil_require_module('phabricator', 'infrastructure/util/hash');
+phutil_require_module('phabricator', 'view/form/control/select');
 phutil_require_module('phabricator', 'view/layout/panel');
 phutil_require_module('phabricator', 'view/utils');
 
 phutil_require_module('phutil', 'markup');
 phutil_require_module('phutil', 'utils');
 
 
 phutil_require_source('DiffusionBrowseFileController.php');
diff --git a/src/applications/files/storage/file/PhabricatorFile.php b/src/applications/files/storage/file/PhabricatorFile.php
index 20fb09c7e0..adc35c4edd 100644
--- a/src/applications/files/storage/file/PhabricatorFile.php
+++ b/src/applications/files/storage/file/PhabricatorFile.php
@@ -1,347 +1,359 @@
 <?php
 
 /*
  * Copyright 2012 Facebook, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *   http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
 
 final class PhabricatorFile extends PhabricatorFileDAO {
 
   const STORAGE_FORMAT_RAW  = 'raw';
 
   protected $phid;
   protected $name;
   protected $mimeType;
   protected $byteSize;
   protected $authorPHID;
   protected $secretKey;
+  protected $contentHash;
 
   protected $storageEngine;
   protected $storageFormat;
   protected $storageHandle;
 
   public function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
     ) + parent::getConfiguration();
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID(
       PhabricatorPHIDConstants::PHID_TYPE_FILE);
   }
 
   public static function readUploadedFileData($spec) {
     if (!$spec) {
       throw new Exception("No file was uploaded!");
     }
 
     $err = idx($spec, 'error');
     if ($err) {
       throw new PhabricatorFileUploadException($err);
     }
 
     $tmp_name = idx($spec, 'tmp_name');
     $is_valid = @is_uploaded_file($tmp_name);
     if (!$is_valid) {
       throw new Exception("File is not an uploaded file.");
     }
 
     $file_data = Filesystem::readFile($tmp_name);
     $file_size = idx($spec, 'size');
 
     if (strlen($file_data) != $file_size) {
       throw new Exception("File size disagrees with uploaded size.");
     }
 
     return $file_data;
   }
 
   public static function newFromPHPUpload($spec, array $params = array()) {
     $file_data = self::readUploadedFileData($spec);
 
     $file_name = nonempty(
       idx($params, 'name'),
       idx($spec,   'name'));
     $params = array(
       'name' => $file_name,
     ) + $params;
 
     return self::newFromFileData($file_data, $params);
   }
 
   public static function newFromFileData($data, array $params = array()) {
 
     $selector_class = PhabricatorEnv::getEnvConfig('storage.engine-selector');
     $selector = newv($selector_class, array());
 
     $engines = $selector->selectStorageEngines($data, $params);
     if (!$engines) {
       throw new Exception("No valid storage engines are available!");
     }
 
     $data_handle = null;
     $engine_identifier = null;
     foreach ($engines as $engine) {
       try {
         // Perform the actual write.
         $data_handle = $engine->writeFile($data, $params);
         if (!$data_handle || strlen($data_handle) > 255) {
           // This indicates an improperly implemented storage engine.
           throw new Exception(
             "Storage engine '{$engine}' executed writeFile() but did not ".
             "return a valid handle ('{$data_handle}') to the data: it must ".
             "be nonempty and no longer than 255 characters.");
         }
 
         $engine_identifier = $engine->getEngineIdentifier();
         if (!$engine_identifier || strlen($engine_identifier) > 32) {
           throw new Exception(
             "Storage engine '{$engine}' returned an improper engine ".
             "identifier '{$engine_identifier}': it must be nonempty ".
             "and no longer than 32 characters.");
         }
 
         // We stored the file somewhere so stop trying to write it to other
         // places.
         break;
       } catch (Exception $ex) {
         // If an engine doesn't work, keep trying all the other valid engines
         // in case something else works.
         phlog($ex);
       }
     }
 
     if (!$data_handle) {
       throw new Exception("All storage engines failed to write file!");
     }
 
     $file_name = idx($params, 'name');
     $file_name = self::normalizeFileName($file_name);
 
     // If for whatever reason, authorPHID isn't passed as a param
     // (always the case with newFromFileDownload()), store a ''
     $authorPHID = idx($params, 'authorPHID');
 
     $file = new PhabricatorFile();
     $file->setName($file_name);
     $file->setByteSize(strlen($data));
     $file->setAuthorPHID($authorPHID);
+    $file->setContentHash(PhabricatorHash::digest($data));
 
     $file->setStorageEngine($engine_identifier);
     $file->setStorageHandle($data_handle);
 
     // TODO: This is probably YAGNI, but allows for us to do encryption or
     // compression later if we want.
     $file->setStorageFormat(self::STORAGE_FORMAT_RAW);
 
     if (isset($params['mime-type'])) {
       $file->setMimeType($params['mime-type']);
     } else {
       $tmp = new TempFile();
       Filesystem::writeFile($tmp, $data);
       $file->setMimeType(Filesystem::getMimeType($tmp));
     }
 
     $file->save();
 
     return $file;
   }
 
   public static function newFromFileDownload($uri, $name) {
     $uri = new PhutilURI($uri);
 
     $protocol = $uri->getProtocol();
     switch ($protocol) {
       case 'http':
       case 'https':
         break;
       default:
         // Make sure we are not accessing any file:// URIs or similar.
         return null;
     }
 
     $timeout = stream_context_create(
       array(
         'http' => array(
           'timeout' => 5,
         ),
       ));
 
     $file_data = @file_get_contents($uri, false, $timeout);
     if ($file_data === false) {
       return null;
     }
 
     return self::newFromFileData($file_data, array('name' => $name));
   }
 
   public static function normalizeFileName($file_name) {
     return preg_replace('/[^a-zA-Z0-9.~_-]/', '_', $file_name);
   }
 
   public function delete() {
     $engine = $this->instantiateStorageEngine();
 
     $ret = parent::delete();
 
     $engine->deleteFile($this->getStorageHandle());
 
     return $ret;
   }
 
   public function loadFileData() {
 
     $engine = $this->instantiateStorageEngine();
     $data = $engine->readFile($this->getStorageHandle());
 
     switch ($this->getStorageFormat()) {
       case self::STORAGE_FORMAT_RAW:
         $data = $data;
         break;
       default:
         throw new Exception("Unknown storage format.");
     }
 
     return $data;
   }
 
   public function getViewURI() {
     if (!$this->getPHID()) {
       throw new Exception(
         "You must save a file before you can generate a view URI.");
     }
 
     $name = phutil_escape_uri($this->getName());
 
     $path = '/file/data/'.$this->getSecretKey().'/'.$this->getPHID().'/'.$name;
     return PhabricatorEnv::getCDNURI($path);
   }
 
   public function getInfoURI() {
     return '/file/info/'.$this->getPHID().'/';
   }
 
   public function getBestURI() {
     if ($this->isViewableInBrowser()) {
       return $this->getViewURI();
     } else {
       return $this->getInfoURI();
     }
   }
 
   public function getThumb60x45URI() {
     return '/file/xform/thumb-60x45/'.$this->getPHID().'/';
   }
 
   public function getThumb160x120URI() {
     return '/file/xform/thumb-160x120/'.$this->getPHID().'/';
   }
 
 
   public function isViewableInBrowser() {
     return ($this->getViewableMimeType() !== null);
   }
 
+  public function isViewableImage() {
+    if (!$this->isViewableInBrowser()) {
+      return false;
+    }
+
+    $mime_map = PhabricatorEnv::getEnvConfig('files.image-mime-types');
+    $mime_type = $this->getMimeType();
+    return idx($mime_map, $mime_type);
+  }
+
   public function isTransformableImage() {
 
     // NOTE: The way the 'gd' extension works in PHP is that you can install it
     // with support for only some file types, so it might be able to handle
     // PNG but not JPEG. Try to generate thumbnails for whatever we can. Setup
     // warns you if you don't have complete support.
 
     $matches = null;
     $ok = preg_match(
       '@^image/(gif|png|jpe?g)@',
       $this->getViewableMimeType(),
       $matches);
     if (!$ok) {
       return false;
     }
 
     switch ($matches[1]) {
       case 'jpg';
       case 'jpeg':
         return function_exists('imagejpeg');
         break;
       case 'png':
         return function_exists('imagepng');
         break;
       case 'gif':
         return function_exists('imagegif');
         break;
       default:
         throw new Exception('Unknown type matched as image MIME type.');
     }
   }
 
   public static function getTransformableImageFormats() {
     $supported = array();
 
     if (function_exists('imagejpeg')) {
       $supported[] = 'jpg';
     }
 
     if (function_exists('imagepng')) {
       $supported[] = 'png';
     }
 
     if (function_exists('imagegif')) {
       $supported[] = 'gif';
     }
 
     return $supported;
   }
 
   protected function instantiateStorageEngine() {
     $engines = id(new PhutilSymbolLoader())
       ->setType('class')
       ->setAncestorClass('PhabricatorFileStorageEngine')
       ->selectAndLoadSymbols();
 
     foreach ($engines as $engine_class) {
       $engine = newv($engine_class['name'], array());
       if ($engine->getEngineIdentifier() == $this->getStorageEngine()) {
         return $engine;
       }
     }
 
     throw new Exception("File's storage engine could be located!");
   }
 
   public function getViewableMimeType() {
     $mime_map = PhabricatorEnv::getEnvConfig('files.viewable-mime-types');
 
     $mime_type = $this->getMimeType();
     $mime_parts = explode(';', $mime_type);
     $mime_type = trim(reset($mime_parts));
 
     return idx($mime_map, $mime_type);
   }
 
   public function validateSecretKey($key) {
     return ($key == $this->getSecretKey());
   }
 
   public function save() {
     if (!$this->getSecretKey()) {
       $this->setSecretKey($this->generateSecretKey());
     }
     return parent::save();
   }
 
   public function generateSecretKey() {
     return Filesystem::readRandomCharacters(20);
   }
 }
diff --git a/src/applications/files/storage/file/__init__.php b/src/applications/files/storage/file/__init__.php
index 9517290ec1..4de0139077 100644
--- a/src/applications/files/storage/file/__init__.php
+++ b/src/applications/files/storage/file/__init__.php
@@ -1,24 +1,25 @@
 <?php
 /**
  * This file is automatically generated. Lint this module to rebuild it.
  * @generated
  */
 
 
 
 phutil_require_module('phabricator', 'applications/files/exception/upload');
 phutil_require_module('phabricator', 'applications/files/storage/base');
 phutil_require_module('phabricator', 'applications/phid/constants');
 phutil_require_module('phabricator', 'applications/phid/storage/phid');
 phutil_require_module('phabricator', 'infrastructure/env');
+phutil_require_module('phabricator', 'infrastructure/util/hash');
 
 phutil_require_module('phutil', 'error');
 phutil_require_module('phutil', 'filesystem');
 phutil_require_module('phutil', 'filesystem/tempfile');
 phutil_require_module('phutil', 'markup');
 phutil_require_module('phutil', 'parser/uri');
 phutil_require_module('phutil', 'symbols');
 phutil_require_module('phutil', 'utils');
 
 
 phutil_require_source('PhabricatorFile.php');
diff --git a/src/storage/connection/mysql/AphrontMySQLDatabaseConnection.php b/src/storage/connection/mysql/AphrontMySQLDatabaseConnection.php
index 9468281a0b..c6a2c007a1 100644
--- a/src/storage/connection/mysql/AphrontMySQLDatabaseConnection.php
+++ b/src/storage/connection/mysql/AphrontMySQLDatabaseConnection.php
@@ -1,335 +1,335 @@
 <?php
 
 /*
  * Copyright 2012 Facebook, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *   http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
 
 /**
  * @group storage
  */
 final class AphrontMySQLDatabaseConnection extends AphrontDatabaseConnection {
 
   private $config;
   private $connection;
 
   private $nextError;
 
   private static $connectionCache = array();
 
   public function __construct(array $configuration) {
     $this->configuration  = $configuration;
   }
 
   public function escapeString($string) {
     $this->requireConnection();
     return mysql_real_escape_string($string, $this->connection);
   }
 
   public function escapeColumnName($name) {
     return '`'.str_replace('`', '\\`', $name).'`';
   }
 
   public function escapeMultilineComment($comment) {
     // These can either terminate a comment, confuse the hell out of the parser,
     // make MySQL execute the comment as a query, or, in the case of semicolon,
     // are quasi-dangerous because the semicolon could turn a broken query into
     // a working query plus an ignored query.
 
     static $map = array(
       '--'  => '(DOUBLEDASH)',
       '*/'  => '(STARSLASH)',
       '//'  => '(SLASHSLASH)',
       '#'   => '(HASH)',
       '!'   => '(BANG)',
       ';'   => '(SEMICOLON)',
     );
 
     $comment = str_replace(
       array_keys($map),
       array_values($map),
       $comment);
 
     // For good measure, kill anything else that isn't a nice printable
     // character.
     $comment = preg_replace('/[^\x20-\x7F]+/', ' ', $comment);
 
     return '/* '.$comment.' */';
   }
 
   public function escapeStringForLikeClause($value) {
     $value = $this->escapeString($value);
     // Ideally the query shouldn't be modified after safely escaping it,
     // but we need to escape _ and % within LIKE terms.
     $value = str_replace(
       // Even though we've already escaped, we need to replace \ with \\
       // because MYSQL unescapes twice inside a LIKE clause. See note
       // at mysql.com. However, if the \ is being used to escape a single
       // quote ('), then the \ should not be escaped. Thus, after all \
       // are replaced with \\, we need to revert instances of \\' back to
       // \'.
       array('\\',   '\\\\\'', '_',  '%'),
       array('\\\\', '\\\'',   '\_', '\%'),
       $value);
     return $value;
   }
 
   private function getConfiguration($key, $default = null) {
     return idx($this->configuration, $key, $default);
   }
 
   private function closeConnection() {
     if ($this->connection) {
       $this->connection = null;
       $key = $this->getConnectionCacheKey();
       unset(self::$connectionCache[$key]);
     }
   }
 
   private function getConnectionCacheKey() {
     $user = $this->getConfiguration('user');
     $host = $this->getConfiguration('host');
     $database = $this->getConfiguration('database');
 
     return "{$user}:{$host}:{$database}";
   }
 
 
   private function establishConnection() {
     $this->closeConnection();
 
     $key = $this->getConnectionCacheKey();
     if (isset(self::$connectionCache[$key])) {
       $this->connection = self::$connectionCache[$key];
       return;
     }
 
     $start = microtime(true);
 
     if (!function_exists('mysql_connect')) {
       // We have to '@' the actual call since it can spew all sorts of silly
       // noise, but it will also silence fatals caused by not having MySQL
       // installed, which has bitten me on three separate occasions. Make sure
       // such failures are explicit and loud.
       throw new Exception(
         "About to call mysql_connect(), but the PHP MySQL extension is not ".
         "available!");
     }
 
     $user = $this->getConfiguration('user');
     $host = $this->getConfiguration('host');
     $database = $this->getConfiguration('database');
 
 
     $profiler = PhutilServiceProfiler::getInstance();
     $call_id = $profiler->beginServiceCall(
       array(
         'type'      => 'connect',
         'host'      => $host,
         'database'  => $database,
       ));
 
     $retries = max(1, PhabricatorEnv::getEnvConfig('mysql.connection-retries'));
     while ($retries--) {
       try {
         $conn = @mysql_connect(
           $host,
           $user,
           $this->getConfiguration('pass'),
           $new_link = true,
           $flags = 0);
 
         if (!$conn) {
           $errno = mysql_errno();
           $error = mysql_error();
           throw new AphrontQueryConnectionException(
             "Attempt to connect to {$user}@{$host} failed with error ".
             "#{$errno}: {$error}.", $errno);
         }
 
         if ($database !== null) {
           $ret = @mysql_select_db($database, $conn);
           if (!$ret) {
             $this->throwQueryException($conn);
           }
           mysql_set_charset('utf8');
         }
 
         $profiler->endServiceCall($call_id, array());
         break;
       } catch (Exception $ex) {
         if ($retries && $ex->getCode() == 2003) {
           $class = get_class($ex);
           $message = $ex->getMessage();
           phlog("Retrying ({$retries}) after {$class}: {$message}");
         } else {
           $profiler->endServiceCall($call_id, array());
           throw $ex;
         }
       }
     }
 
     self::$connectionCache[$key] = $conn;
     $this->connection = $conn;
   }
 
   public function getInsertID() {
     return mysql_insert_id($this->requireConnection());
   }
 
   public function getAffectedRows() {
     return mysql_affected_rows($this->requireConnection());
   }
 
   public function getTransactionKey() {
     return (int)$this->requireConnection();
   }
 
   private function requireConnection() {
     if (!$this->connection) {
       $this->establishConnection();
     }
     return $this->connection;
   }
 
   public function selectAllResults() {
     $result = array();
     $res = $this->lastResult;
     if ($res == null) {
       throw new Exception('No query result to fetch from!');
     }
     while (($row = mysql_fetch_assoc($res)) !== false) {
       $result[] = $row;
     }
     return $result;
   }
 
   public function executeRawQuery($raw_query) {
     $this->lastResult = null;
     $retries = max(1, PhabricatorEnv::getEnvConfig('mysql.connection-retries'));
     while ($retries--) {
       try {
         $this->requireConnection();
 
         // TODO: Do we need to include transactional statements here?
         $is_write = !preg_match('/^(SELECT|SHOW|EXPLAIN)\s/', $raw_query);
         if ($is_write) {
           AphrontWriteGuard::willWrite();
         }
 
         $start = microtime(true);
 
         $profiler = PhutilServiceProfiler::getInstance();
         $call_id = $profiler->beginServiceCall(
           array(
             'type'    => 'query',
             'config'  => $this->configuration,
             'query'   => $raw_query,
             'write'   => $is_write,
           ));
 
         $result = @mysql_query($raw_query, $this->connection);
 
         $profiler->endServiceCall($call_id, array());
 
         if ($this->nextError) {
           $result = null;
         }
 
         if ($result) {
           $this->lastResult = $result;
           break;
         }
 
         $this->throwQueryException($this->connection);
       } catch (AphrontQueryConnectionLostException $ex) {
         if ($this->isInsideTransaction()) {
           // Zero out the transaction state to prevent a second exception
           // ("program exited with open transaction") from being thrown, since
           // we're about to throw a more relevant/useful one instead.
           $state = $this->getTransactionState();
           while ($state->getDepth()) {
             $state->decreaseDepth();
           }
 
           // We can't close the connection before this because
           // isInsideTransaction() and getTransactionState() depend on the
           // connection.
           $this->closeConnection();
 
           throw $ex;
         }
 
         $this->closeConnection();
 
         if (!$retries) {
           throw $ex;
         }
 
         $class = get_class($ex);
         $message = $ex->getMessage();
         phlog("Retrying ({$retries}) after {$class}: {$message}");
       }
     }
   }
 
   private function throwQueryException($connection) {
     if ($this->nextError) {
       $errno = $this->nextError;
       $error = 'Simulated error.';
       $this->nextError = null;
     } else {
       $errno = mysql_errno($connection);
       $error = mysql_error($connection);
     }
 
     $exmsg = "#{$errno}: {$error}";
 
     switch ($errno) {
       case 2013: // Connection Dropped
       case 2006: // Gone Away
         throw new AphrontQueryConnectionLostException($exmsg);
       case 1213: // Deadlock
       case 1205: // Lock wait timeout exceeded
         throw new AphrontQueryRecoverableException($exmsg);
       case 1062: // Duplicate Key
         // NOTE: In some versions of MySQL we get a key name back here, but
         // older versions just give us a key index ("key 2") so it's not
         // portable to parse the key out of the error and attach it to the
         // exception.
         throw new AphrontQueryDuplicateKeyException($exmsg);
       case 1044: // Access denied to database
       case 1045: // Access denied (auth)
       case 1142: // Access denied to table
       case 1143: // Access denied to column
         throw new AphrontQueryAccessDeniedException($exmsg);
       case 1146: // No such table
-      case 1154: // Unknown column "..." in field list
+      case 1054: // Unknown column "..." in field list
         throw new AphrontQuerySchemaException($exmsg);
       default:
         // TODO: 1064 is syntax error, and quite terrible in production.
         throw new AphrontQueryException($exmsg);
     }
   }
 
   /**
    * Force the next query to fail with a simulated error. This should be used
    * ONLY for unit tests.
    */
   public function simulateErrorOnNextQuery($error) {
     $this->nextError = $error;
     return $this;
   }
 
 }