diff options
| author | Andrey Andreev <narf@bofh.bg> | 2012-05-17 10:55:43 +0200 |
|---|---|---|
| committer | Andrey Andreev <narf@bofh.bg> | 2012-05-17 10:55:43 +0200 |
| commit | 9394f8040ee989e2dfeec42732bc06e52c5ee0c6 (patch) | |
| tree | 4abbf8b47cb1acd956c9755cc4ad04ef983609cc | |
| parent | e463c4d71c2fdcc224e70f7576582220ae64e3d7 (diff) | |
| parent | 8f04c69fe65ddc2604425eaee811b50a909d905f (diff) | |
Merge pull request #1366 from aphofstede/2.1-stable
Check cookie against md5 regex. 2.1 stable CSRF injection security fix
| -rwxr-xr-x | system/core/Security.php | 2 | ||||
| -rw-r--r-- | user_guide/changelog.html | 1 |
2 files changed, 2 insertions, 1 deletions
diff --git a/system/core/Security.php b/system/core/Security.php index a3e227437..6f5ac1ed8 100755 --- a/system/core/Security.php +++ b/system/core/Security.php @@ -848,7 +848,7 @@ class CI_Security { // each page load since a page could contain embedded // sub-pages causing this feature to fail if (isset($_COOKIE[$this->_csrf_cookie_name]) && - $_COOKIE[$this->_csrf_cookie_name] != '') + preg_match('#^[0-9a-f]{32}$#iS', $_COOKIE[$this->_csrf_cookie_name]) === 1) { return $this->_csrf_hash = $_COOKIE[$this->_csrf_cookie_name]; } diff --git a/user_guide/changelog.html b/user_guide/changelog.html index 613c4e65d..55fbceeaf 100644 --- a/user_guide/changelog.html +++ b/user_guide/changelog.html @@ -85,6 +85,7 @@ Change Log <li>Fixed a bug - CI_Upload::_file_mime_type() could've failed if mime_content_type() is used for the detection and returns FALSE.</li> <li>Fixed a bug (#538) - Windows paths were ignored when using the <a href="libraries/image_lib.html">Image Manipulation Class</a> to create a new file.</li> <li>Fixed a bug - When database caching was enabled, $this->db->query() checked the cache before binding variables which resulted in cached queries never being found.</li> + <li>Fixed a bug - CSRF cookie value was allowed to be any (non-empty) string before being written to the output, making code injection a risk.</li> </ul> |