summaryrefslogtreecommitdiffstats
path: root/system/libraries/Security.php
diff options
context:
space:
mode:
authorPhil Sturgeon <email@philsturgeon.co.uk>2011-02-16 20:03:49 +0100
committerPhil Sturgeon <email@philsturgeon.co.uk>2011-02-16 20:03:49 +0100
commit33ed0f37b6b8f2223cd3362bf8fca28102ab67c6 (patch)
tree99c613720a2fd8541764bb6fc893e0da28fa269b /system/libraries/Security.php
parent154da11c5bb4b7dc5c225f4fa018852ee45cc6eb (diff)
parentd8d1e24eee56d2466c91ecd72b3c8932eb3d0639 (diff)
Merged CodeIgniter Core changes and integrated rob1's secure cookie change into my secure cookie change.
Diffstat (limited to 'system/libraries/Security.php')
-rw-r--r--system/libraries/Security.php69
1 files changed, 37 insertions, 32 deletions
diff --git a/system/libraries/Security.php b/system/libraries/Security.php
index a73b8e1f7..58db4e79c 100644
--- a/system/libraries/Security.php
+++ b/system/libraries/Security.php
@@ -25,14 +25,15 @@
* @link http://codeigniter.com/user_guide/libraries/sessions.html
*/
class CI_Security {
- var $xss_hash = '';
- var $csrf_hash = '';
- var $csrf_expire = 7200; // Two hours (in seconds)
- var $csrf_token_name = 'ci_csrf_token';
- var $csrf_cookie_name = 'ci_csrf_token';
+
+ public $xss_hash = '';
+ public $csrf_hash = '';
+ public $csrf_expire = 7200; // Two hours (in seconds)
+ public $csrf_token_name = 'ci_csrf_token';
+ public $csrf_cookie_name = 'ci_csrf_token';
/* never allowed, string replacement */
- var $never_allowed_str = array(
+ public $never_allowed_str = array(
'document.cookie' => '[removed]',
'document.write' => '[removed]',
'.parentNode' => '[removed]',
@@ -44,7 +45,7 @@ class CI_Security {
'<![CDATA[' => '&lt;![CDATA['
);
/* never allowed, regex replacement */
- var $never_allowed_regex = array(
+ public $never_allowed_regex = array(
"javascript\s*:" => '[removed]',
"expression\s*(\(|&\#40;)" => '[removed]', // CSS and IE
"vbscript\s*:" => '[removed]', // IE, surprise!
@@ -53,6 +54,10 @@ class CI_Security {
public function __construct()
{
+ $this->csrf_token_name = (config_item('csrf_token_name')) ? config_item('csrf_token_name') : 'csrf_token_name';
+ $this->csrf_cookie_name = (config_item('csrf_cookie_name')) ? config_item('csrf_cookie_name') : 'csrf_cookie_name';
+ $this->csrf_expire = (config_item('csrf_expire')) ? config_item('csrf_expire') : 7200;
+
// Append application specific cookie prefix to token name
$this->csrf_cookie_name = (config_item('cookie_prefix')) ? config_item('cookie_prefix').$this->csrf_token_name : $this->csrf_token_name;
@@ -70,7 +75,7 @@ class CI_Security {
* @access public
* @return null
*/
- function csrf_verify()
+ public function csrf_verify()
{
// If no POST data exists we will set the CSRF cookie
if (count($_POST) == 0)
@@ -109,7 +114,7 @@ class CI_Security {
* @access public
* @return null
*/
- function csrf_set_cookie()
+ public function csrf_set_cookie()
{
$expire = time() + $this->csrf_expire;
$secure_cookie = (config_item('cookie_secure') === TRUE) ? 1 : 0;
@@ -124,10 +129,10 @@ class CI_Security {
/**
* Set Cross Site Request Forgery Protection Cookie
*
- * @access public
+ * @access private
* @return null
*/
- function _csrf_set_hash()
+ private function _csrf_set_hash()
{
if ($this->csrf_hash == '')
{
@@ -154,7 +159,7 @@ class CI_Security {
* @access public
* @return null
*/
- function csrf_show_error()
+ public function csrf_show_error()
{
show_error('The action you have requested is not allowed.');
}
@@ -187,7 +192,7 @@ class CI_Security {
* @param mixed string or array
* @return string
*/
- function xss_clean($str, $is_image = FALSE)
+ public function xss_clean($str, $is_image = FALSE)
{
/*
* Is the string an array?
@@ -211,9 +216,9 @@ class CI_Security {
/*
* Protect GET variables in URLs
*/
-
+
// 901119URL5918AMP18930PROTECT8198
-
+
$str = preg_replace('|\&([a-z\_0-9\-]+)\=([a-z\_0-9\-]+)|i', $this->xss_hash()."\\1=\\2", $str);
/*
@@ -260,7 +265,7 @@ class CI_Security {
*/
$str = preg_replace_callback("/[a-z]+=([\'\"]).*?\\1/si", array($this, '_convert_attribute'), $str);
-
+
$str = preg_replace_callback("/<\w+.*?(?=>|<|$)/si", array($this, '_decode_entity'), $str);
/*
@@ -369,7 +374,7 @@ class CI_Security {
$str = preg_replace("#<(/*)(script|xss)(.*?)\>#si", '[removed]', $str);
}
}
- while($original != $str);
+ while ($original != $str);
unset($original);
@@ -471,7 +476,7 @@ class CI_Security {
* @access public
* @return string
*/
- function xss_hash()
+ public function xss_hash()
{
if ($this->xss_hash == '')
{
@@ -494,11 +499,11 @@ class CI_Security {
* Callback function for xss_clean() to remove whitespace from
* things like j a v a s c r i p t
*
- * @access public
+ * @access private
* @param type
* @return type
*/
- function _compact_exploded_words($matches)
+ private function _compact_exploded_words($matches)
{
return preg_replace('/\s+/s', '', $matches[1]).$matches[2];
}
@@ -514,7 +519,7 @@ class CI_Security {
* @param array
* @return string
*/
- function _sanitize_naughty_html($matches)
+ private function _sanitize_naughty_html($matches)
{
// encode opening brace
$str = '&lt;'.$matches[1].$matches[2].$matches[3];
@@ -539,7 +544,7 @@ class CI_Security {
* @param array
* @return string
*/
- function _js_link_removal($match)
+ private function _js_link_removal($match)
{
$attributes = $this->_filter_attributes(str_replace(array('<', '>'), '', $match[1]));
return str_replace($match[1], preg_replace("#href=.*?(alert\(|alert&\#40;|javascript\:|charset\=|window\.|document\.|\.cookie|<script|<xss|base64\s*,)#si", "", $attributes), $match[0]);
@@ -557,7 +562,7 @@ class CI_Security {
* @param array
* @return string
*/
- function _js_img_removal($match)
+ private function _js_img_removal($match)
{
$attributes = $this->_filter_attributes(str_replace(array('<', '>'), '', $match[1]));
return str_replace($match[1], preg_replace("#src=.*?(alert\(|alert&\#40;|javascript\:|charset\=|window\.|document\.|\.cookie|<script|<xss|base64\s*,)#si", "", $attributes), $match[0]);
@@ -570,11 +575,11 @@ class CI_Security {
*
* Used as a callback for XSS Clean
*
- * @access public
+ * @access private
* @param array
* @return string
*/
- function _convert_attribute($match)
+ private function _convert_attribute($match)
{
return str_replace(array('>', '<', '\\'), array('&gt;', '&lt;', '\\\\'), $match[0]);
}
@@ -586,11 +591,11 @@ class CI_Security {
*
* Filters tag attributes for consistency and safety
*
- * @access public
+ * @access private
* @param string
* @return string
*/
- function _filter_attributes($str)
+ private function _filter_attributes($str)
{
$out = '';
@@ -612,11 +617,11 @@ class CI_Security {
*
* Used as a callback for XSS Clean
*
- * @access public
+ * @access private
* @param array
* @return string
*/
- function _decode_entity($match)
+ private function _decode_entity($match)
{
return $this->entity_decode($match[0], strtoupper(config_item('charset')));
}
@@ -642,7 +647,7 @@ class CI_Security {
* @param string
* @return string
*/
- function entity_decode($str, $charset='UTF-8')
+ public function entity_decode($str, $charset='UTF-8')
{
if (stristr($str, '&') === FALSE) return $str;
@@ -681,7 +686,7 @@ class CI_Security {
* @param string
* @return string
*/
- function sanitize_filename($str, $relative_path = FALSE)
+ public function sanitize_filename($str, $relative_path = FALSE)
{
$bad = array(
"../",
@@ -716,7 +721,7 @@ class CI_Security {
"%3b", // ;
"%3d" // =
);
-
+
if ( ! $relative_path)
{
$bad[] = './';