Update database and helper functionality in CodeIgniter
Revised database drivers, query builder, and file/inflector helpers for improved consistency and functionality. Updated copyrights, links, and standardized function names including deprecating `is_countable` in favor of `word_is_countable`. Added support for new SQL features and optimized query handling.
This commit is contained in:
Executable → Regular
+50
-19
@@ -6,7 +6,7 @@
|
||||
*
|
||||
* This content is released under the MIT License (MIT)
|
||||
*
|
||||
* Copyright (c) 2014 - 2017, British Columbia Institute of Technology
|
||||
* Copyright (c) 2019 - 2022, CodeIgniter Foundation
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
* of this software and associated documentation files (the "Software"), to deal
|
||||
@@ -29,8 +29,9 @@
|
||||
* @package CodeIgniter
|
||||
* @author EllisLab Dev Team
|
||||
* @copyright Copyright (c) 2008 - 2014, EllisLab, Inc. (https://ellislab.com/)
|
||||
* @copyright Copyright (c) 2014 - 2017, British Columbia Institute of Technology (http://bcit.ca/)
|
||||
* @license http://opensource.org/licenses/MIT MIT License
|
||||
* @copyright Copyright (c) 2014 - 2019, British Columbia Institute of Technology (https://bcit.ca/)
|
||||
* @copyright Copyright (c) 2019 - 2022, CodeIgniter Foundation (https://codeigniter.com/)
|
||||
* @license https://opensource.org/licenses/MIT MIT License
|
||||
* @link https://codeigniter.com
|
||||
* @since Version 1.0.0
|
||||
* @filesource
|
||||
@@ -44,7 +45,7 @@ defined('BASEPATH') OR exit('No direct script access allowed');
|
||||
* @subpackage Libraries
|
||||
* @category Security
|
||||
* @author EllisLab Dev Team
|
||||
* @link https://codeigniter.com/user_guide/libraries/security.html
|
||||
* @link https://codeigniter.com/userguide3/libraries/security.html
|
||||
*/
|
||||
class CI_Security {
|
||||
|
||||
@@ -134,7 +135,9 @@ class CI_Security {
|
||||
*/
|
||||
protected $_never_allowed_str = array(
|
||||
'document.cookie' => '[removed]',
|
||||
'(document).cookie' => '[removed]',
|
||||
'document.write' => '[removed]',
|
||||
'(document).write' => '[removed]',
|
||||
'.parentNode' => '[removed]',
|
||||
'.innerHTML' => '[removed]',
|
||||
'-moz-binding' => '[removed]',
|
||||
@@ -152,7 +155,7 @@ class CI_Security {
|
||||
*/
|
||||
protected $_never_allowed_regex = array(
|
||||
'javascript\s*:',
|
||||
'(document|(document\.)?window)\.(location|on\w*)',
|
||||
'(\(?document\)?|\(?window\)?(\.document)?)\.(location|on\w*)',
|
||||
'expression\s*(\(|&\#40;)', // CSS and IE
|
||||
'vbscript\s*:', // IE, surprise!
|
||||
'wscript\s*:', // IE
|
||||
@@ -191,7 +194,7 @@ class CI_Security {
|
||||
$this->_csrf_set_hash();
|
||||
}
|
||||
|
||||
$this->charset = strtoupper(config_item('charset'));
|
||||
$this->charset = strtoupper((string) config_item('charset'));
|
||||
|
||||
log_message('info', 'Security Class Initialized');
|
||||
}
|
||||
@@ -226,6 +229,7 @@ class CI_Security {
|
||||
|
||||
// Check CSRF token validity, but don't error on mismatch just yet - we'll want to regenerate
|
||||
$valid = isset($_POST[$this->_csrf_token_name], $_COOKIE[$this->_csrf_cookie_name])
|
||||
&& is_string($_POST[$this->_csrf_token_name]) && is_string($_COOKIE[$this->_csrf_cookie_name])
|
||||
&& hash_equals($_POST[$this->_csrf_token_name], $_COOKIE[$this->_csrf_cookie_name]);
|
||||
|
||||
// We kill this since we're done and we don't want to pollute the _POST array
|
||||
@@ -269,15 +273,35 @@ class CI_Security {
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
setcookie(
|
||||
$this->_csrf_cookie_name,
|
||||
$this->_csrf_hash,
|
||||
$expire,
|
||||
config_item('cookie_path'),
|
||||
config_item('cookie_domain'),
|
||||
$secure_cookie,
|
||||
config_item('cookie_httponly')
|
||||
);
|
||||
if (is_php('7.3'))
|
||||
{
|
||||
setcookie(
|
||||
$this->_csrf_cookie_name,
|
||||
$this->_csrf_hash,
|
||||
array(
|
||||
'expires' => $expire,
|
||||
'path' => config_item('cookie_path'),
|
||||
'domain' => config_item('cookie_domain'),
|
||||
'secure' => $secure_cookie,
|
||||
'httponly' => config_item('cookie_httponly'),
|
||||
'samesite' => 'Strict'
|
||||
)
|
||||
);
|
||||
}
|
||||
else
|
||||
{
|
||||
$domain = trim(config_item('cookie_domain'));
|
||||
header('Set-Cookie: '.$this->_csrf_cookie_name.'='.$this->_csrf_hash
|
||||
.'; Expires='.gmdate('D, d-M-Y H:i:s T', $expire)
|
||||
.'; Max-Age='.$this->_csrf_expire
|
||||
.'; Path='.rawurlencode(config_item('cookie_path'))
|
||||
.($domain === '' ? '' : '; Domain='.$domain)
|
||||
.($secure_cookie ? '; Secure' : '')
|
||||
.(config_item('cookie_httponly') ? '; HttpOnly' : '')
|
||||
.'; SameSite=Strict'
|
||||
);
|
||||
}
|
||||
|
||||
log_message('info', 'CSRF cookie sent');
|
||||
|
||||
return $this;
|
||||
@@ -542,6 +566,14 @@ class CI_Security {
|
||||
$str
|
||||
);
|
||||
|
||||
// Same thing, but for "tag functions" (e.g. eval`some code`)
|
||||
// See https://github.com/bcit-ci/CodeIgniter/issues/5420
|
||||
$str = preg_replace(
|
||||
'#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)`(.*?)`#si',
|
||||
'\\1\\2`\\3`',
|
||||
$str
|
||||
);
|
||||
|
||||
// Final clean up
|
||||
// This adds a bit of extra precaution in case
|
||||
// something got through the above filters
|
||||
@@ -624,7 +656,6 @@ class CI_Security {
|
||||
return $output;
|
||||
}
|
||||
|
||||
|
||||
if (is_readable('/dev/urandom') && ($fp = fopen('/dev/urandom', 'rb')) !== FALSE)
|
||||
{
|
||||
// Try not to waste entropy ...
|
||||
@@ -853,7 +884,7 @@ class CI_Security {
|
||||
// For other tags, see if their attributes are "evil" and strip those
|
||||
elseif (isset($matches['attributes']))
|
||||
{
|
||||
// We'll store the already fitlered attributes here
|
||||
// We'll store the already filtered attributes here
|
||||
$attributes = array();
|
||||
|
||||
// Attribute-catching pattern
|
||||
@@ -927,7 +958,7 @@ class CI_Security {
|
||||
return str_replace(
|
||||
$match[1],
|
||||
preg_replace(
|
||||
'#href=.*?(?:(?:alert|prompt|confirm)(?:\(|&\#40;)|javascript:|livescript:|mocha:|charset=|window\.|document\.|\.cookie|<script|<xss|d\s*a\s*t\s*a\s*:)#si',
|
||||
'#href=.*?(?:(?:alert|prompt|confirm)(?:\(|&\#40;|`|&\#96;)|javascript:|livescript:|mocha:|charset=|window\.|\(?document\)?\.|\.cookie|<script|<xss|d\s*a\s*t\s*a\s*:)#si',
|
||||
'',
|
||||
$this->_filter_attributes($match[1])
|
||||
),
|
||||
@@ -955,7 +986,7 @@ class CI_Security {
|
||||
return str_replace(
|
||||
$match[1],
|
||||
preg_replace(
|
||||
'#src=.*?(?:(?:alert|prompt|confirm|eval)(?:\(|&\#40;)|javascript:|livescript:|mocha:|charset=|window\.|document\.|\.cookie|<script|<xss|base64\s*,)#si',
|
||||
'#src=.*?(?:(?:alert|prompt|confirm|eval)(?:\(|&\#40;|`|&\#96;)|javascript:|livescript:|mocha:|charset=|window\.|\(?document\)?\.|\.cookie|<script|<xss|base64\s*,)#si',
|
||||
'',
|
||||
$this->_filter_attributes($match[1])
|
||||
),
|
||||
|
||||
Reference in New Issue
Block a user