Merge tag '2.1.1'

Retagging 2.1.1 for final release

Conflicts:
	user_guide/changelog.html
	user_guide/database/active_record.html
	user_guide/database/caching.html
	user_guide/database/call_function.html
	user_guide/database/configuration.html
	user_guide/database/connecting.html
	user_guide/database/examples.html
	user_guide/database/fields.html
	user_guide/database/forge.html
	user_guide/database/helpers.html
	user_guide/database/index.html
	user_guide/database/queries.html
	user_guide/database/results.html
	user_guide/database/table_data.html
	user_guide/database/transactions.html
	user_guide/database/utilities.html
	user_guide/doc_style/index.html
	user_guide/general/alternative_php.html
	user_guide/general/ancillary_classes.html
	user_guide/general/autoloader.html
	user_guide/general/caching.html
	user_guide/general/cli.html
	user_guide/general/common_functions.html
	user_guide/general/controllers.html
	user_guide/general/core_classes.html
	user_guide/general/creating_drivers.html
	user_guide/general/creating_libraries.html
	user_guide/general/credits.html
	user_guide/general/drivers.html
	user_guide/general/environments.html
	user_guide/general/errors.html
	user_guide/general/helpers.html
	user_guide/general/hooks.html
	user_guide/general/libraries.html
	user_guide/general/managing_apps.html
	user_guide/general/models.html
	user_guide/general/profiling.html
	user_guide/general/quick_reference.html
	user_guide/general/requirements.html
	user_guide/general/reserved_names.html
	user_guide/general/routing.html
	user_guide/general/security.html
	user_guide/general/styleguide.html
	user_guide/general/urls.html
	user_guide/general/views.html
	user_guide/helpers/array_helper.html
	user_guide/helpers/captcha_helper.html
	user_guide/helpers/cookie_helper.html
	user_guide/helpers/date_helper.html
	user_guide/helpers/directory_helper.html
	user_guide/helpers/download_helper.html
	user_guide/helpers/email_helper.html
	user_guide/helpers/file_helper.html
	user_guide/helpers/form_helper.html
	user_guide/helpers/html_helper.html
	user_guide/helpers/inflector_helper.html
	user_guide/helpers/language_helper.html
	user_guide/helpers/number_helper.html
	user_guide/helpers/path_helper.html
	user_guide/helpers/security_helper.html
	user_guide/helpers/smiley_helper.html
	user_guide/helpers/string_helper.html
	user_guide/helpers/text_helper.html
	user_guide/helpers/typography_helper.html
	user_guide/helpers/url_helper.html
	user_guide/helpers/xml_helper.html
	user_guide/index.html
	user_guide/installation/downloads.html
	user_guide/installation/index.html
	user_guide/installation/troubleshooting.html
	user_guide/installation/upgrade_120.html
	user_guide/installation/upgrade_130.html
	user_guide/installation/upgrade_131.html
	user_guide/installation/upgrade_132.html
	user_guide/installation/upgrade_133.html
	user_guide/installation/upgrade_140.html
	user_guide/installation/upgrade_141.html
	user_guide/installation/upgrade_150.html
	user_guide/installation/upgrade_152.html
	user_guide/installation/upgrade_153.html
	user_guide/installation/upgrade_154.html
	user_guide/installation/upgrade_160.html
	user_guide/installation/upgrade_161.html
	user_guide/installation/upgrade_162.html
	user_guide/installation/upgrade_163.html
	user_guide/installation/upgrade_170.html
	user_guide/installation/upgrade_171.html
	user_guide/installation/upgrade_172.html
	user_guide/installation/upgrade_200.html
	user_guide/installation/upgrade_201.html
	user_guide/installation/upgrade_202.html
	user_guide/installation/upgrade_203.html
	user_guide/installation/upgrade_210.html
	user_guide/installation/upgrade_b11.html
	user_guide/installation/upgrading.html
	user_guide/libraries/benchmark.html
	user_guide/libraries/caching.html
	user_guide/libraries/calendar.html
	user_guide/libraries/cart.html
	user_guide/libraries/config.html
	user_guide/libraries/email.html
	user_guide/libraries/encryption.html
	user_guide/libraries/file_uploading.html
	user_guide/libraries/form_validation.html
	user_guide/libraries/ftp.html
	user_guide/libraries/image_lib.html
	user_guide/libraries/input.html
	user_guide/libraries/javascript.html
	user_guide/libraries/language.html
	user_guide/libraries/loader.html
	user_guide/libraries/migration.html
	user_guide/libraries/output.html
	user_guide/libraries/pagination.html
	user_guide/libraries/parser.html
	user_guide/libraries/security.html
	user_guide/libraries/sessions.html
	user_guide/libraries/table.html
	user_guide/libraries/trackback.html
	user_guide/libraries/typography.html
	user_guide/libraries/unit_testing.html
	user_guide/libraries/uri.html
	user_guide/libraries/user_agent.html
	user_guide/libraries/xmlrpc.html
	user_guide/libraries/zip.html
	user_guide/license.html
	user_guide/overview/appflow.html
	user_guide/overview/at_a_glance.html
	user_guide/overview/cheatsheets.html
	user_guide/overview/features.html
	user_guide/overview/getting_started.html
	user_guide/overview/goals.html
	user_guide/overview/index.html
	user_guide/overview/mvc.html
	user_guide/toc.html
	user_guide/tutorial/conclusion.html
	user_guide/tutorial/create_news_items.html
	user_guide/tutorial/hard_coded_pages.html
	user_guide/tutorial/index.html
	user_guide/tutorial/news_section.html
	user_guide/tutorial/static_pages.html

Signed-off-by: Florian Pritz <bluewind@xinu.at>

2 files changed, 132 insertions, 5 deletions

diff --git a/system/core/Input.php b/system/core/Input.php
index 9bfb5f1fb..3559d8607 100755
--- a/system/core/Input.php
+++ b/system/core/Input.php
@@ -365,18 +365,70 @@ class CI_Input {
 	/**
 	* Validate IP Address
 	*
+	* @access	public
+	* @param	string
+	* @param	string	ipv4 or ipv6
+	* @return	bool
+	*/
+	public function valid_ip($ip, $which = '')
+	{
+		$which = strtolower($which);
+
+		// First check if filter_var is available
+		if (is_callable('filter_var'))
+		{
+			switch ($which) {
+				case 'ipv4':
+					$flag = FILTER_FLAG_IPV4;
+					break;
+				case 'ipv6':
+					$flag = FILTER_FLAG_IPV6;
+					break;
+				default:
+					$flag = '';
+					break;
+			}
+
+			return (bool) filter_var($ip, FILTER_VALIDATE_IP, $flag);
+		}
+
+		if ($which !== 'ipv6' && $which !== 'ipv4')
+		{
+			if (strpos($ip, ':') !== FALSE)
+			{
+				$which = 'ipv6';
+			}
+			elseif (strpos($ip, '.') !== FALSE)
+			{
+				$which = 'ipv4';
+			}
+			else
+			{
+				return FALSE;
+			}
+		}
+
+		$func = '_valid_'.$which;
+		return $this->$func($ip);
+	}
+
+	// --------------------------------------------------------------------
+
+	/**
+	* Validate IPv4 Address
+	*
 	* Updated version suggested by Geert De Deckere
 	*
-	* @access	public
+	* @access	protected
 	* @param	string
-	* @return	string
+	* @return	bool
 	*/
-	function valid_ip($ip)
+	protected function _valid_ipv4($ip)
 	{
 		$ip_segments = explode('.', $ip);
 
 		// Always 4 segments needed
-		if (count($ip_segments) != 4)
+		if (count($ip_segments) !== 4)
 		{
 			return FALSE;
 		}
@@ -385,6 +437,7 @@ class CI_Input {
 		{
 			return FALSE;
 		}
+
 		// Check each segment
 		foreach ($ip_segments as $segment)
 		{
@@ -402,6 +455,80 @@ class CI_Input {
 	// --------------------------------------------------------------------
 
 	/**
+	* Validate IPv6 Address
+	*
+	* @access	protected
+	* @param	string
+	* @return	bool
+	*/
+	protected function _valid_ipv6($str)
+	{
+		// 8 groups, separated by :
+		// 0-ffff per group
+		// one set of consecutive 0 groups can be collapsed to ::
+
+		$groups = 8;
+		$collapsed = FALSE;
+
+		$chunks = array_filter(
+			preg_split('/(:{1,2})/', $str, NULL, PREG_SPLIT_DELIM_CAPTURE)
+		);
+
+		// Rule out easy nonsense
+		if (current($chunks) == ':' OR end($chunks) == ':')
+		{
+			return FALSE;
+		}
+
+		// PHP supports IPv4-mapped IPv6 addresses, so we'll expect those as well
+		if (strpos(end($chunks), '.') !== FALSE)
+		{
+			$ipv4 = array_pop($chunks);
+
+			if ( ! $this->_valid_ipv4($ipv4))
+			{
+				return FALSE;
+			}
+
+			$groups--;
+		}
+
+		while ($seg = array_pop($chunks))
+		{
+			if ($seg[0] == ':')
+			{
+				if (--$groups == 0)
+				{
+					return FALSE;	// too many groups
+				}
+
+				if (strlen($seg) > 2)
+				{
+					return FALSE;	// long separator
+				}
+
+				if ($seg == '::')
+				{
+					if ($collapsed)
+					{
+						return FALSE;	// multiple collapsed
+					}
+
+					$collapsed = TRUE;
+				}
+			}
+			elseif (preg_match("/[^0-9a-f]/i", $seg) OR strlen($seg) > 4)
+			{
+				return FALSE; // invalid segment
+			}
+		}
+
+		return $collapsed OR $groups == 1;
+	}
+
+	// --------------------------------------------------------------------
+
+	/**
 	* User Agent
 	*
 	* @access	public
diff --git a/system/core/Security.php b/system/core/Security.php
index a3e227437..6f5ac1ed8 100755
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -848,7 +848,7 @@ class CI_Security {
 			// each page load since a page could contain embedded
 			// sub-pages causing this feature to fail
 			if (isset($_COOKIE[$this->_csrf_cookie_name]) &&
-				$_COOKIE[$this->_csrf_cookie_name] != '')
+				preg_match('#^[0-9a-f]{32}$#iS', $_COOKIE[$this->_csrf_cookie_name]) === 1)
 			{
 				return $this->_csrf_hash = $_COOKIE[$this->_csrf_cookie_name];
 			}