summaryrefslogtreecommitdiffstats
path: root/system/libraries
diff options
context:
space:
mode:
authorFlorian Pritz <bluewind@xinu.at>2018-06-14 20:56:36 +0200
committerFlorian Pritz <bluewind@xinu.at>2018-06-14 20:56:36 +0200
commitfb56cdb3efd11f4ec6cf053b8f04cc51a7d3bd4e (patch)
treefd81b4a7064f3dba7bdfadbd7a29424539cef324 /system/libraries
parentf34668f94b6a69fa777c6025ccc798b5e3c1110f (diff)
parent30e2eafa86c4c7b6b39cea3e7089a90df9f603fb (diff)
Merge tag '3.1.9' of git://github.com/bcit-ci/CodeIgniter into dev
Signed-off-by: Florian Pritz <bluewind@xinu.at>
Diffstat (limited to 'system/libraries')
-rw-r--r--system/libraries/Email.php12
-rw-r--r--system/libraries/Form_validation.php6
-rw-r--r--system/libraries/Session/Session.php2
-rw-r--r--system/libraries/Session/Session_driver.php17
-rw-r--r--system/libraries/Session/drivers/Session_database_driver.php26
-rw-r--r--system/libraries/Session/drivers/Session_files_driver.php18
-rw-r--r--system/libraries/Session/drivers/Session_memcached_driver.php19
-rw-r--r--system/libraries/Session/drivers/Session_redis_driver.php18
8 files changed, 114 insertions, 4 deletions
diff --git a/system/libraries/Email.php b/system/libraries/Email.php
index a53e7e72a..cd74d6da1 100644
--- a/system/libraries/Email.php
+++ b/system/libraries/Email.php
@@ -1038,7 +1038,11 @@ class CI_Email {
$domain = defined('INTL_IDNA_VARIANT_UTS46')
? idn_to_ascii($domain, 0, INTL_IDNA_VARIANT_UTS46)
: idn_to_ascii($domain);
- $email = $account.'@'.$domain;
+
+ if ($domain !== FALSE)
+ {
+ $email = $account.'@'.$domain;
+ }
}
return (bool) filter_var($email, FILTER_VALIDATE_EMAIL);
@@ -1859,7 +1863,11 @@ class CI_Email {
$domain = defined('INTL_IDNA_VARIANT_UTS46')
? idn_to_ascii($domain, 0, INTL_IDNA_VARIANT_UTS46)
: idn_to_ascii($domain);
- $email = $account.'@'.$domain;
+
+ if ($domain !== FALSE)
+ {
+ $email = $account.'@'.$domain;
+ }
}
return (filter_var($email, FILTER_VALIDATE_EMAIL) === $email && preg_match('#\A[a-z0-9._+-]+@[a-z0-9.-]{1,253}\z#i', $email));
diff --git a/system/libraries/Form_validation.php b/system/libraries/Form_validation.php
index 6a97ee599..27187df2c 100644
--- a/system/libraries/Form_validation.php
+++ b/system/libraries/Form_validation.php
@@ -1234,7 +1234,11 @@ class CI_Form_validation {
$domain = defined('INTL_IDNA_VARIANT_UTS46')
? idn_to_ascii($matches[2], 0, INTL_IDNA_VARIANT_UTS46)
: idn_to_ascii($matches[2]);
- $str = $matches[1].'@'.$domain;
+
+ if ($domain !== FALSE)
+ {
+ $str = $matches[1].'@'.$domain;
+ }
}
return (bool) filter_var($str, FILTER_VALIDATE_EMAIL);
diff --git a/system/libraries/Session/Session.php b/system/libraries/Session/Session.php
index 9e762745f..aa1fafb5b 100644
--- a/system/libraries/Session/Session.php
+++ b/system/libraries/Session/Session.php
@@ -604,7 +604,7 @@ class CI_Session {
// ------------------------------------------------------------------------
/**
- * Unmark flash
+ * Unmark temp
*
* @param mixed $key Session data key(s)
* @return void
diff --git a/system/libraries/Session/Session_driver.php b/system/libraries/Session/Session_driver.php
index bef5ee41f..2fe30b8a2 100644
--- a/system/libraries/Session/Session_driver.php
+++ b/system/libraries/Session/Session_driver.php
@@ -113,6 +113,23 @@ abstract class CI_Session_driver implements SessionHandlerInterface {
// ------------------------------------------------------------------------
/**
+ * PHP 5.x validate ID
+ *
+ * Enforces session.use_strict_mode on PHP 5.x (7+ does it by itself)
+ *
+ * @return void
+ */
+ public function php5_validate_id()
+ {
+ if (PHP_VERSION_ID < 70000 && isset($_COOKIE[$this->_config['cookie_name']]) && ! $this->validateId($_COOKIE[$this->_config['cookie_name']]))
+ {
+ unset($_COOKIE[$this->_config['cookie_name']]);
+ }
+ }
+
+ // ------------------------------------------------------------------------
+
+ /**
* Cookie destroy
*
* Internal method to force removal of a cookie by the client
diff --git a/system/libraries/Session/drivers/Session_database_driver.php b/system/libraries/Session/drivers/Session_database_driver.php
index ae7a1b4a1..074accfe7 100644
--- a/system/libraries/Session/drivers/Session_database_driver.php
+++ b/system/libraries/Session/drivers/Session_database_driver.php
@@ -133,6 +133,8 @@ class CI_Session_database_driver extends CI_Session_driver implements SessionHan
return $this->_fail();
}
+ $this->php5_validate_id();
+
return $this->_success;
}
@@ -340,6 +342,30 @@ class CI_Session_database_driver extends CI_Session_driver implements SessionHan
: $this->_fail();
}
+ // --------------------------------------------------------------------
+
+ /**
+ * Validate ID
+ *
+ * Checks whether a session ID record exists server-side,
+ * to enforce session.use_strict_mode.
+ *
+ * @param string $id
+ * @return bool
+ */
+ public function validateId($id)
+ {
+ // Prevent previous QB calls from messing with our queries
+ $this->_db->reset_query();
+
+ $this->_db->select('1')->from($this->_config['save_path'])->where('id', $id);
+ empty($this->_config['match_ip']) OR $this->_db->where('ip_address', $_SERVER['REMOTE_ADDR']);
+ $result = $this->_db->get();
+ empty($result) OR $result = $result->row();
+
+ return ! empty($result);
+ }
+
// ------------------------------------------------------------------------
/**
diff --git a/system/libraries/Session/drivers/Session_files_driver.php b/system/libraries/Session/drivers/Session_files_driver.php
index c6d789aae..654f30010 100644
--- a/system/libraries/Session/drivers/Session_files_driver.php
+++ b/system/libraries/Session/drivers/Session_files_driver.php
@@ -148,6 +148,8 @@ class CI_Session_files_driver extends CI_Session_driver implements SessionHandle
.$name // we'll use the session cookie name as a prefix to avoid collisions
.($this->_config['match_ip'] ? md5($_SERVER['REMOTE_ADDR']) : '');
+ $this->php5_validate_id();
+
return $this->_success;
}
@@ -392,6 +394,22 @@ class CI_Session_files_driver extends CI_Session_driver implements SessionHandle
// --------------------------------------------------------------------
/**
+ * Validate ID
+ *
+ * Checks whether a session ID record exists server-side,
+ * to enforce session.use_strict_mode.
+ *
+ * @param string $id
+ * @return bool
+ */
+ public function validateId($id)
+ {
+ return is_file($this->_file_path.$id);
+ }
+
+ // --------------------------------------------------------------------
+
+ /**
* Byte-safe strlen()
*
* @param string $str
diff --git a/system/libraries/Session/drivers/Session_memcached_driver.php b/system/libraries/Session/drivers/Session_memcached_driver.php
index b109738c2..7d8e39022 100644
--- a/system/libraries/Session/drivers/Session_memcached_driver.php
+++ b/system/libraries/Session/drivers/Session_memcached_driver.php
@@ -145,6 +145,8 @@ class CI_Session_memcached_driver extends CI_Session_driver implements SessionHa
return $this->_fail();
}
+ $this->php5_validate_id();
+
return $this->_success;
}
@@ -290,6 +292,23 @@ class CI_Session_memcached_driver extends CI_Session_driver implements SessionHa
return $this->_success;
}
+ // --------------------------------------------------------------------
+
+ /**
+ * Validate ID
+ *
+ * Checks whether a session ID record exists server-side,
+ * to enforce session.use_strict_mode.
+ *
+ * @param string $id
+ * @return bool
+ */
+ public function validateId($id)
+ {
+ $this->_memcached-get($this->_key_prefix.$id);
+ return ($this->_memcached->getResultCode() === Memcached::RES_SUCCESS);
+ }
+
// ------------------------------------------------------------------------
/**
diff --git a/system/libraries/Session/drivers/Session_redis_driver.php b/system/libraries/Session/drivers/Session_redis_driver.php
index 413c30d67..d7a57550a 100644
--- a/system/libraries/Session/drivers/Session_redis_driver.php
+++ b/system/libraries/Session/drivers/Session_redis_driver.php
@@ -153,6 +153,8 @@ class CI_Session_redis_driver extends CI_Session_driver implements SessionHandle
return $this->_success;
}
+ $this->php5_validate_id();
+
return $this->_fail();
}
@@ -310,6 +312,22 @@ class CI_Session_redis_driver extends CI_Session_driver implements SessionHandle
return $this->_success;
}
+ // --------------------------------------------------------------------
+
+ /**
+ * Validate ID
+ *
+ * Checks whether a session ID record exists server-side,
+ * to enforce session.use_strict_mode.
+ *
+ * @param string $id
+ * @return bool
+ */
+ public function validateId($id)
+ {
+ return (bool) $this->_redis->exists($this->_key_prefix.$id);
+ }
+
// ------------------------------------------------------------------------
/**