Merge tag '2.1.2'

Conflicts:
	system/database/DB_driver.php
	user_guide/changelog.html
	user_guide/database/active_record.html
	user_guide/database/caching.html
	user_guide/database/call_function.html
	user_guide/database/configuration.html
	user_guide/database/connecting.html
	user_guide/database/examples.html
	user_guide/database/fields.html
	user_guide/database/forge.html
	user_guide/database/helpers.html
	user_guide/database/index.html
	user_guide/database/queries.html
	user_guide/database/results.html
	user_guide/database/table_data.html
	user_guide/database/transactions.html
	user_guide/database/utilities.html
	user_guide/doc_style/index.html
	user_guide/doc_style/template.html
	user_guide/general/alternative_php.html
	user_guide/general/ancillary_classes.html
	user_guide/general/autoloader.html
	user_guide/general/caching.html
	user_guide/general/cli.html
	user_guide/general/common_functions.html
	user_guide/general/controllers.html
	user_guide/general/core_classes.html
	user_guide/general/creating_drivers.html
	user_guide/general/creating_libraries.html
	user_guide/general/credits.html
	user_guide/general/drivers.html
	user_guide/general/environments.html
	user_guide/general/errors.html
	user_guide/general/helpers.html
	user_guide/general/hooks.html
	user_guide/general/libraries.html
	user_guide/general/managing_apps.html
	user_guide/general/models.html
	user_guide/general/profiling.html
	user_guide/general/quick_reference.html
	user_guide/general/requirements.html
	user_guide/general/reserved_names.html
	user_guide/general/routing.html
	user_guide/general/security.html
	user_guide/general/styleguide.html
	user_guide/general/urls.html
	user_guide/general/views.html
	user_guide/helpers/array_helper.html
	user_guide/helpers/captcha_helper.html
	user_guide/helpers/cookie_helper.html
	user_guide/helpers/date_helper.html
	user_guide/helpers/directory_helper.html
	user_guide/helpers/download_helper.html
	user_guide/helpers/email_helper.html
	user_guide/helpers/file_helper.html
	user_guide/helpers/form_helper.html
	user_guide/helpers/html_helper.html
	user_guide/helpers/inflector_helper.html
	user_guide/helpers/language_helper.html
	user_guide/helpers/number_helper.html
	user_guide/helpers/path_helper.html
	user_guide/helpers/security_helper.html
	user_guide/helpers/smiley_helper.html
	user_guide/helpers/string_helper.html
	user_guide/helpers/text_helper.html
	user_guide/helpers/typography_helper.html
	user_guide/helpers/url_helper.html
	user_guide/helpers/xml_helper.html
	user_guide/index.html
	user_guide/installation/downloads.html
	user_guide/installation/index.html
	user_guide/installation/troubleshooting.html
	user_guide/installation/upgrade_120.html
	user_guide/installation/upgrade_130.html
	user_guide/installation/upgrade_131.html
	user_guide/installation/upgrade_132.html
	user_guide/installation/upgrade_133.html
	user_guide/installation/upgrade_140.html
	user_guide/installation/upgrade_141.html
	user_guide/installation/upgrade_150.html
	user_guide/installation/upgrade_152.html
	user_guide/installation/upgrade_153.html
	user_guide/installation/upgrade_154.html
	user_guide/installation/upgrade_160.html
	user_guide/installation/upgrade_161.html
	user_guide/installation/upgrade_162.html
	user_guide/installation/upgrade_163.html
	user_guide/installation/upgrade_170.html
	user_guide/installation/upgrade_171.html
	user_guide/installation/upgrade_172.html
	user_guide/installation/upgrade_200.html
	user_guide/installation/upgrade_201.html
	user_guide/installation/upgrade_202.html
	user_guide/installation/upgrade_203.html
	user_guide/installation/upgrade_210.html
	user_guide/installation/upgrade_211.html
	user_guide/installation/upgrade_b11.html
	user_guide/installation/upgrading.html
	user_guide/libraries/benchmark.html
	user_guide/libraries/caching.html
	user_guide/libraries/calendar.html
	user_guide/libraries/cart.html
	user_guide/libraries/config.html
	user_guide/libraries/email.html
	user_guide/libraries/encryption.html
	user_guide/libraries/file_uploading.html
	user_guide/libraries/form_validation.html
	user_guide/libraries/ftp.html
	user_guide/libraries/image_lib.html
	user_guide/libraries/input.html
	user_guide/libraries/javascript.html
	user_guide/libraries/language.html
	user_guide/libraries/loader.html
	user_guide/libraries/migration.html
	user_guide/libraries/output.html
	user_guide/libraries/pagination.html
	user_guide/libraries/parser.html
	user_guide/libraries/security.html
	user_guide/libraries/sessions.html
	user_guide/libraries/table.html
	user_guide/libraries/trackback.html
	user_guide/libraries/typography.html
	user_guide/libraries/unit_testing.html
	user_guide/libraries/uri.html
	user_guide/libraries/user_agent.html
	user_guide/libraries/xmlrpc.html
	user_guide/libraries/zip.html
	user_guide/license.html
	user_guide/overview/appflow.html
	user_guide/overview/at_a_glance.html
	user_guide/overview/cheatsheets.html
	user_guide/overview/features.html
	user_guide/overview/getting_started.html
	user_guide/overview/goals.html
	user_guide/overview/index.html
	user_guide/overview/mvc.html
	user_guide/toc.html
	user_guide/tutorial/conclusion.html
	user_guide/tutorial/create_news_items.html
	user_guide/tutorial/hard_coded_pages.html
	user_guide/tutorial/index.html
	user_guide/tutorial/news_section.html
	user_guide/tutorial/static_pages.html

Signed-off-by: Florian Pritz <bluewind@xinu.at>

1 files changed, 81 insertions, 70 deletions

diff --git a/system/core/Security.php b/system/core/Security.php
index 6f5ac1ed8..7af240ded 100755
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -1,4 +1,4 @@
-<?php  if ( ! defined('BASEPATH')) exit('No direct script access allowed');
+<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');
 /**
  * CodeIgniter
  *
@@ -69,16 +69,16 @@ class CI_Security {
 	 * @access protected
 	 */
 	protected $_never_allowed_str = array(
-					'document.cookie'	=> '[removed]',
-					'document.write'	=> '[removed]',
-					'.parentNode'		=> '[removed]',
-					'.innerHTML'		=> '[removed]',
-					'window.location'	=> '[removed]',
-					'-moz-binding'		=> '[removed]',
-					'<!--'				=> '&lt;!--',
-					'-->'				=> '--&gt;',
-					'<![CDATA['			=> '&lt;![CDATA[',
-					'<comment>'			=> '&lt;comment&gt;'
+		'document.cookie'	=> '[removed]',
+		'document.write'	=> '[removed]',
+		'.parentNode'		=> '[removed]',
+		'.innerHTML'		=> '[removed]',
+		'window.location'	=> '[removed]',
+		'-moz-binding'		=> '[removed]',
+		'<!--'				=> '&lt;!--',
+		'-->'				=> '--&gt;',
+		'<![CDATA['			=> '&lt;![CDATA[',
+		'<comment>'			=> '&lt;comment&gt;'
 	);
 
 	/* never allowed, regex replacement */
@@ -89,10 +89,11 @@ class CI_Security {
 	 * @access protected
 	 */
 	protected $_never_allowed_regex = array(
-					"javascript\s*:"			=> '[removed]',
-					"expression\s*(\(|&\#40;)"	=> '[removed]', // CSS and IE
-					"vbscript\s*:"				=> '[removed]', // IE, surprise!
-					"Redirect\s+302"			=> '[removed]'
+		'javascript\s*:',
+		'expression\s*(\(|&\#40;)', // CSS and IE
+		'vbscript\s*:', // IE, surprise!
+		'Redirect\s+302',
+		"([\"'])?data\s*:[^\\1]*?base64[^\\1]*?,[^\\1]*?\\1?"
 	);
 
 	/**
@@ -364,9 +365,9 @@ class CI_Security {
 		 * These words are compacted back to their correct state.
 		 */
 		$words = array(
-				'javascript', 'expression', 'vbscript', 'script',
-				'applet', 'alert', 'document', 'write', 'cookie', 'window'
-			);
+			'javascript', 'expression', 'vbscript', 'script', 'base64',
+			'applet', 'alert', 'document', 'write', 'cookie', 'window'
+		);
 
 		foreach ($words as $word)
 		{
@@ -524,38 +525,38 @@ class CI_Security {
 	public function sanitize_filename($str, $relative_path = FALSE)
 	{
 		$bad = array(
-						"../",
-						"<!--",
-						"-->",
-						"<",
-						">",
-						"'",
-						'"',
-						'&',
-						'$',
-						'#',
-						'{',
-						'}',
-						'[',
-						']',
-						'=',
-						';',
-						'?',
-						"%20",
-						"%22",
-						"%3c",		// <
-						"%253c",	// <
-						"%3e",		// >
-						"%0e",		// >
-						"%28",		// (
-						"%29",		// )
-						"%2528",	// (
-						"%26",		// &
-						"%24",		// $
-						"%3f",		// ?
-						"%3b",		// ;
-						"%3d"		// =
-					);
+			"../",
+			"<!--",
+			"-->",
+			"<",
+			">",
+			"'",
+			'"',
+			'&',
+			'$',
+			'#',
+			'{',
+			'}',
+			'[',
+			']',
+			'=',
+			';',
+			'?',
+			"%20",
+			"%22",
+			"%3c",		// <
+			"%253c",	// <
+			"%3e",		// >
+			"%0e",		// >
+			"%28",		// (
+			"%29",		// )
+			"%2528",	// (
+			"%26",		// &
+			"%24",		// $
+			"%3f",		// ?
+			"%3b",		// ;
+			"%3d"		// =
+		);
 
 		if ( ! $relative_path)
 		{
@@ -613,19 +614,20 @@ class CI_Security {
 			 */
 			unset($evil_attributes[array_search('xmlns', $evil_attributes)]);
 		}
-		
+
 		do {
 			$count = 0;
 			$attribs = array();
-			
+
 			// find occurrences of illegal attribute strings without quotes
-			preg_match_all("/(".implode('|', $evil_attributes).")\s*=\s*([^\s]*)/is",  $str, $matches, PREG_SET_ORDER);
-			
+			preg_match_all('/('.implode('|', $evil_attributes).')\s*=\s*([^\s>]*)/is', $str, $matches, PREG_SET_ORDER);
+
 			foreach ($matches as $attr)
 			{
+
 				$attribs[] = preg_quote($attr[0], '/');
 			}
-			
+
 			// find occurrences of illegal attribute strings with quotes (042 and 047 are octal quotes)
 			preg_match_all("/(".implode('|', $evil_attributes).")\s*=\s*(\042|\047)([^\\2]*?)(\\2)/is",  $str, $matches, PREG_SET_ORDER);
 
@@ -637,11 +639,11 @@ class CI_Security {
 			// replace illegal attribute strings that are inside an html tag
 			if (count($attribs) > 0)
 			{
-				$str = preg_replace("/<(\/?[^><]+?)([^A-Za-z\-])(".implode('|', $attribs).")([\s><])([><]*)/i", '<$1$2$4$5', $str, -1, $count);
+				$str = preg_replace("/<(\/?[^><]+?)([^A-Za-z<>\-])(.*?)(".implode('|', $attribs).")(.*?)([\s><])([><]*)/i", '<$1 $3$5$6$7', $str, -1, $count);
 			}
-			
+
 		} while ($count);
-		
+
 		return $str;
 	}
 
@@ -682,9 +684,15 @@ class CI_Security {
 	 */
 	protected function _js_link_removal($match)
 	{
-		$attributes = $this->_filter_attributes(str_replace(array('<', '>'), '', $match[1]));
-
-		return str_replace($match[1], preg_replace("#href=.*?(alert\(|alert&\#40;|javascript\:|livescript\:|mocha\:|charset\=|window\.|document\.|\.cookie|<script|<xss|base64\s*,)#si", "", $attributes), $match[0]);
+		return str_replace(
+			$match[1],
+			preg_replace(
+				'#href=.*?(alert\(|alert&\#40;|javascript\:|livescript\:|mocha\:|charset\=|window\.|document\.|\.cookie|<script|<xss|data\s*:)#si',
+				'',
+				$this->_filter_attributes(str_replace(array('<', '>'), '', $match[1]))
+			),
+			$match[0]
+		);
 	}
 
 	// --------------------------------------------------------------------
@@ -702,9 +710,15 @@ class CI_Security {
 	 */
 	protected function _js_img_removal($match)
 	{
-		$attributes = $this->_filter_attributes(str_replace(array('<', '>'), '', $match[1]));
-
-		return str_replace($match[1], preg_replace("#src=.*?(alert\(|alert&\#40;|javascript\:|livescript\:|mocha\:|charset\=|window\.|document\.|\.cookie|<script|<xss|base64\s*,)#si", "", $attributes), $match[0]);
+		return str_replace(
+			$match[1],
+			preg_replace(
+				'#src=.*?(alert\(|alert&\#40;|javascript\:|livescript\:|mocha\:|charset\=|window\.|document\.|\.cookie|<script|<xss|base64\s*,)#si',
+				'',
+				$this->_filter_attributes(str_replace(array('<', '>'), '', $match[1]))
+			),
+			$match[0]
+		);
 	}
 
 	// --------------------------------------------------------------------
@@ -819,14 +833,11 @@ class CI_Security {
 	 */
 	protected function _do_never_allowed($str)
 	{
-		foreach ($this->_never_allowed_str as $key => $val)
-		{
-			$str = str_replace($key, $val, $str);
-		}
+		$str = str_replace(array_keys($this->_never_allowed_str), $this->_never_allowed_str, $str);
 
-		foreach ($this->_never_allowed_regex as $key => $val)
+		foreach ($this->_never_allowed_regex as $regex)
 		{
-			$str = preg_replace("#".$key."#i", $val, $str);
+			$str = preg_replace('#'.$regex.'#is', '[removed]', $str);
 		}
 
 		return $str;