summaryrefslogtreecommitdiffstats
path: root/system/core/Input.php
diff options
context:
space:
mode:
authorIban Eguia <admin@razican.com>2012-06-08 23:01:31 +0200
committerIban Eguia <admin@razican.com>2012-06-08 23:01:31 +0200
commit895e98c0f04f1087e8900ce8423ad3210a423770 (patch)
tree6adfe487293df38807084599f1f04157b5531e54 /system/core/Input.php
parent0ed4f63f4268b0c98f549ffd711702fd45a761d0 (diff)
parenta593c69de4ea125c096f611c78dd0839489e7ebd (diff)
Merge remote-tracking branch 'upstream/develop' into new_date
Diffstat (limited to 'system/core/Input.php')
-rwxr-xr-xsystem/core/Input.php264
1 files changed, 144 insertions, 120 deletions
diff --git a/system/core/Input.php b/system/core/Input.php
index 6e6885992..b986c4973 100755
--- a/system/core/Input.php
+++ b/system/core/Input.php
@@ -43,51 +43,59 @@ class CI_Input {
*
* @var string
*/
- public $ip_address = FALSE;
+ public $ip_address = FALSE;
+
/**
* user agent (web browser) being used by the current user
*
* @var string
*/
- public $user_agent = FALSE;
+ public $user_agent = FALSE;
+
/**
* If FALSE, then $_GET will be set to an empty array
*
* @var bool
*/
- protected $_allow_get_array = TRUE;
+ protected $_allow_get_array = TRUE;
+
/**
* If TRUE, then newlines are standardized
*
* @var bool
*/
- protected $_standardize_newlines = TRUE;
+ protected $_standardize_newlines = TRUE;
+
/**
* Determines whether the XSS filter is always active when GET, POST or COOKIE data is encountered
* Set automatically based on config setting
*
* @var bool
*/
- protected $_enable_xss = FALSE;
+ protected $_enable_xss = FALSE;
+
/**
* Enables a CSRF cookie token to be set.
* Set automatically based on config setting
*
* @var bool
*/
- protected $_enable_csrf = FALSE;
+ protected $_enable_csrf = FALSE;
+
/**
* List of all HTTP request headers
*
* @var array
*/
- protected $headers = array();
+ protected $headers = array();
/**
* Constructor
*
* Sets whether to globally enable the XSS processing
* and whether to allow the $_GET array
+ *
+ * @return void
*/
public function __construct()
{
@@ -127,7 +135,7 @@ class CI_Input {
{
if ( ! isset($array[$index]))
{
- return FALSE;
+ return NULL;
}
if ($xss_clean === TRUE)
@@ -141,12 +149,12 @@ class CI_Input {
// --------------------------------------------------------------------
/**
- * Fetch an item from the GET array
- *
- * @param string
- * @param bool
- * @return string
- */
+ * Fetch an item from the GET array
+ *
+ * @param string
+ * @param bool
+ * @return string
+ */
public function get($index = NULL, $xss_clean = FALSE)
{
// Check if a field has been provided
@@ -168,12 +176,12 @@ class CI_Input {
// --------------------------------------------------------------------
/**
- * Fetch an item from the POST array
- *
- * @param string
- * @param bool
- * @return string
- */
+ * Fetch an item from the POST array
+ *
+ * @param string
+ * @param bool
+ * @return string
+ */
public function post($index = NULL, $xss_clean = FALSE)
{
// Check if a field has been provided
@@ -196,12 +204,12 @@ class CI_Input {
// --------------------------------------------------------------------
/**
- * Fetch an item from either the GET array or the POST
- *
- * @param string The index key
- * @param bool XSS cleaning
- * @return string
- */
+ * Fetch an item from either the GET array or the POST
+ *
+ * @param string The index key
+ * @param bool XSS cleaning
+ * @return string
+ */
public function get_post($index = '', $xss_clean = FALSE)
{
return isset($_POST[$index])
@@ -212,12 +220,12 @@ class CI_Input {
// --------------------------------------------------------------------
/**
- * Fetch an item from the COOKIE array
- *
- * @param string
- * @param bool
- * @return string
- */
+ * Fetch an item from the COOKIE array
+ *
+ * @param string
+ * @param bool
+ * @return string
+ */
public function cookie($index = '', $xss_clean = FALSE)
{
return $this->_fetch_from_array($_COOKIE, $index, $xss_clean);
@@ -226,21 +234,21 @@ class CI_Input {
// ------------------------------------------------------------------------
/**
- * Set cookie
- *
- * Accepts seven parameters, or you can submit an associative
- * array in the first parameter containing all the values.
- *
- * @param mixed
- * @param string the value of the cookie
- * @param string the number of seconds until expiration
- * @param string the cookie domain. Usually: .yourdomain.com
- * @param string the cookie path
- * @param string the cookie prefix
- * @param bool true makes the cookie secure
- * @param bool true makes the cookie accessible via http(s) only (no javascript)
- * @return void
- */
+ * Set cookie
+ *
+ * Accepts seven parameters, or you can submit an associative
+ * array in the first parameter containing all the values.
+ *
+ * @param mixed
+ * @param string the value of the cookie
+ * @param string the number of seconds until expiration
+ * @param string the cookie domain. Usually: .yourdomain.com
+ * @param string the cookie path
+ * @param string the cookie prefix
+ * @param bool true makes the cookie secure
+ * @param bool true makes the cookie accessible via http(s) only (no javascript)
+ * @return void
+ */
public function set_cookie($name = '', $value = '', $expire = '', $domain = '', $path = '/', $prefix = '', $secure = FALSE, $httponly = FALSE)
{
if (is_array($name))
@@ -255,23 +263,27 @@ class CI_Input {
}
}
- if ($prefix == '' && config_item('cookie_prefix') != '')
+ if ($prefix === '' && config_item('cookie_prefix') !== '')
{
$prefix = config_item('cookie_prefix');
}
+
if ($domain == '' && config_item('cookie_domain') != '')
{
$domain = config_item('cookie_domain');
}
- if ($path == '/' && config_item('cookie_path') !== '/')
+
+ if ($path === '/' && config_item('cookie_path') !== '/')
{
$path = config_item('cookie_path');
}
- if ($secure == FALSE && config_item('cookie_secure') != FALSE)
+
+ if ($secure === FALSE && config_item('cookie_secure') !== FALSE)
{
$secure = config_item('cookie_secure');
}
- if ($httponly == FALSE && config_item('cookie_httponly') != FALSE)
+
+ if ($httponly === FALSE && config_item('cookie_httponly') !== FALSE)
{
$httponly = config_item('cookie_httponly');
}
@@ -291,12 +303,12 @@ class CI_Input {
// --------------------------------------------------------------------
/**
- * Fetch an item from the SERVER array
- *
- * @param string
- * @param bool
- * @return string
- */
+ * Fetch an item from the SERVER array
+ *
+ * @param string
+ * @param bool
+ * @return string
+ */
public function server($index = '', $xss_clean = FALSE)
{
return $this->_fetch_from_array($_SERVER, $index, $xss_clean);
@@ -305,10 +317,10 @@ class CI_Input {
// --------------------------------------------------------------------
/**
- * Fetch the IP Address
- *
- * @return string
- */
+ * Fetch the IP Address
+ *
+ * @return string
+ */
public function ip_address()
{
if ($this->ip_address !== FALSE)
@@ -362,25 +374,25 @@ class CI_Input {
// --------------------------------------------------------------------
/**
- * Validate IP Address
- *
- * Updated version suggested by Geert De Deckere
- *
- * @param string
- * @return bool
- */
+ * Validate IP Address
+ *
+ * Updated version suggested by Geert De Deckere
+ *
+ * @param string
+ * @return bool
+ */
public function valid_ip($ip)
{
- return (bool) filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4);
+ return (bool) filter_var($ip, FILTER_VALIDATE_IP);
}
// --------------------------------------------------------------------
/**
- * User Agent
- *
- * @return string
- */
+ * User Agent
+ *
+ * @return string
+ */
public function user_agent()
{
if ($this->user_agent !== FALSE)
@@ -394,38 +406,45 @@ class CI_Input {
// --------------------------------------------------------------------
/**
- * Sanitize Globals
- *
- * This function does the following:
- *
- * - Unsets $_GET data (if query strings are not enabled)
- * - Unsets all globals if register_globals is enabled
- * - Standardizes newline characters to \n
- *
- * @return void
- */
+ * Sanitize Globals
+ *
+ * This function does the following:
+ *
+ * - Unsets $_GET data (if query strings are not enabled)
+ * - Unsets all globals if register_globals is enabled
+ * - Standardizes newline characters to \n
+ *
+ * @return void
+ */
protected function _sanitize_globals()
{
// It would be "wrong" to unset any of these GLOBALS.
- $protected = array('_SERVER', '_GET', '_POST', '_FILES', '_REQUEST',
- '_SESSION', '_ENV', 'GLOBALS', 'HTTP_RAW_POST_DATA',
- 'system_folder', 'application_folder', 'BM', 'EXT',
- 'CFG', 'URI', 'RTR', 'OUT', 'IN'
- );
+ $protected = array(
+ '_SERVER',
+ '_GET',
+ '_POST',
+ '_FILES',
+ '_REQUEST',
+ '_SESSION',
+ '_ENV',
+ 'GLOBALS',
+ 'HTTP_RAW_POST_DATA',
+ 'system_folder',
+ 'application_folder',
+ 'BM',
+ 'EXT',
+ 'CFG',
+ 'URI',
+ 'RTR',
+ 'OUT',
+ 'IN'
+ );
// Unset globals for securiy.
// This is effectively the same as register_globals = off
foreach (array($_GET, $_POST, $_COOKIE) as $global)
{
- if ( ! is_array($global))
- {
- if ( ! in_array($global, $protected))
- {
- global $$global;
- $$global = NULL;
- }
- }
- else
+ if (is_array($global))
{
foreach ($global as $key => $val)
{
@@ -436,10 +455,15 @@ class CI_Input {
}
}
}
+ elseif ( ! in_array($global, $protected))
+ {
+ global $$global;
+ $$global = NULL;
+ }
}
// Is $_GET data allowed? If not we'll set the $_GET to an empty array
- if ($this->_allow_get_array == FALSE)
+ if ($this->_allow_get_array === FALSE)
{
$_GET = array();
}
@@ -482,7 +506,7 @@ class CI_Input {
$_SERVER['PHP_SELF'] = strip_tags($_SERVER['PHP_SELF']);
// CSRF Protection check
- if ($this->_enable_csrf == TRUE)
+ if ($this->_enable_csrf === TRUE)
{
$this->security->csrf_verify();
}
@@ -493,14 +517,14 @@ class CI_Input {
// --------------------------------------------------------------------
/**
- * Clean Input Data
- *
- * This is a helper function. It escapes data and
- * standardizes newline characters to \n
- *
- * @param string
- * @return string
- */
+ * Clean Input Data
+ *
+ * This is a helper function. It escapes data and
+ * standardizes newline characters to \n
+ *
+ * @param string
+ * @return string
+ */
protected function _clean_input_data($str)
{
if (is_array($str))
@@ -539,7 +563,7 @@ class CI_Input {
}
// Standardize newlines if needed
- if ($this->_standardize_newlines == TRUE && strpos($str, "\r") !== FALSE)
+ if ($this->_standardize_newlines === TRUE && strpos($str, "\r") !== FALSE)
{
return str_replace(array("\r\n", "\r", "\r\n\n"), PHP_EOL, $str);
}
@@ -550,15 +574,15 @@ class CI_Input {
// --------------------------------------------------------------------
/**
- * Clean Keys
- *
- * This is a helper function. To prevent malicious users
- * from trying to exploit keys we make sure that keys are
- * only named with alpha-numeric text and a few other items.
- *
- * @param string
- * @return string
- */
+ * Clean Keys
+ *
+ * This is a helper function. To prevent malicious users
+ * from trying to exploit keys we make sure that keys are
+ * only named with alpha-numeric text and a few other items.
+ *
+ * @param string
+ * @return string
+ */
protected function _clean_input_keys($str)
{
if ( ! preg_match('/^[a-z0-9:_\/-]+$/i', $str))
@@ -584,7 +608,7 @@ class CI_Input {
* In Apache, you can simply call apache_request_headers(), however for
* people running other webservers the function is undefined.
*
- * @param bool XSS cleaning
+ * @param bool XSS cleaning
* @return array
*/
public function request_headers($xss_clean = FALSE)
@@ -639,7 +663,7 @@ class CI_Input {
if ( ! isset($this->headers[$index]))
{
- return FALSE;
+ return NULL;
}
return ($xss_clean === TRUE)
@@ -695,4 +719,4 @@ class CI_Input {
}
/* End of file Input.php */
-/* Location: ./system/core/Input.php */
+/* Location: ./system/core/Input.php */ \ No newline at end of file