summaryrefslogtreecommitdiffstats
path: root/system
diff options
context:
space:
mode:
authorPhil Sturgeon <email@philsturgeon.co.uk>2011-08-15 18:00:53 +0200
committerPhil Sturgeon <email@philsturgeon.co.uk>2011-08-15 18:00:53 +0200
commit4fbda2a8814be5837ad3928c5e3cb8506bf8ab2a (patch)
tree89a5360e805bd2b68771630f45801e67bd95775e /system
parentdbac73b4011a85c4ac3b3a7a6a8e30533b881155 (diff)
parent08d186492af82a7087c0a45a80b7e8d469c83292 (diff)
Merge branch 'develop' of github.com:philsturgeon/codeigniter-reactor into develop
Diffstat (limited to 'system')
-rwxr-xr-xsystem/core/CodeIgniter.php12
-rwxr-xr-x[-rw-r--r--]system/core/Exceptions.php17
-rwxr-xr-x[-rw-r--r--]system/core/Hooks.php15
-rwxr-xr-x[-rw-r--r--]system/core/Input.php64
-rwxr-xr-x[-rw-r--r--]system/core/Lang.php13
-rwxr-xr-x[-rw-r--r--]system/core/Loader.php102
-rwxr-xr-x[-rw-r--r--]system/core/Model.php1
-rwxr-xr-x[-rw-r--r--]system/core/Output.php61
-rwxr-xr-x[-rw-r--r--]system/core/Router.php46
-rwxr-xr-x[-rw-r--r--]system/core/Security.php131
-rwxr-xr-x[-rw-r--r--]system/core/URI.php31
-rwxr-xr-x[-rw-r--r--]system/database/DB.php4
12 files changed, 423 insertions, 74 deletions
diff --git a/system/core/CodeIgniter.php b/system/core/CodeIgniter.php
index 5f795514f..0a1391d18 100755
--- a/system/core/CodeIgniter.php
+++ b/system/core/CodeIgniter.php
@@ -33,6 +33,12 @@
* @var string
*
*/
+ /**
+ * CodeIgniter Version
+ *
+ * @var string
+ *
+ */
define('CI_VERSION', '2.0.2');
/**
@@ -41,6 +47,12 @@
* @var boolean
*
*/
+ /**
+ * CodeIgniter Branch (Core = TRUE, Reactor = FALSE)
+ *
+ * @var string
+ *
+ */
define('CI_CORE', FALSE);
/*
diff --git a/system/core/Exceptions.php b/system/core/Exceptions.php
index bff86a92f..869739a5a 100644..100755
--- a/system/core/Exceptions.php
+++ b/system/core/Exceptions.php
@@ -30,8 +30,21 @@ class CI_Exceptions {
var $message;
var $filename;
var $line;
+
+ /**
+ * Nesting level of the output buffering mechanism
+ *
+ * @var int
+ * @access public
+ */
var $ob_level;
+ /**
+ * List if available error levels
+ *
+ * @var array
+ * @access public
+ */
var $levels = array(
E_ERROR => 'Error',
E_WARNING => 'Warning',
@@ -84,7 +97,8 @@ class CI_Exceptions {
* 404 Page Not Found Handler
*
* @access private
- * @param string
+ * @param string the page
+ * @param bool log error yes/no
* @return string
*/
function show_404($page = '', $log_error = TRUE)
@@ -115,6 +129,7 @@ class CI_Exceptions {
* @param string the heading
* @param string the message
* @param string the template name
+ * @param int the status code
* @return string
*/
function show_error($heading, $message, $template = 'error_general', $status_code = 500)
diff --git a/system/core/Hooks.php b/system/core/Hooks.php
index fd6380f0a..33f1c034c 100644..100755
--- a/system/core/Hooks.php
+++ b/system/core/Hooks.php
@@ -28,8 +28,23 @@
*/
class CI_Hooks {
+ /**
+ * Determines wether hooks are enabled
+ *
+ * @var bool
+ */
var $enabled = FALSE;
+ /**
+ * List of all hooks set in config/hooks.php
+ *
+ * @var array
+ */
var $hooks = array();
+ /**
+ * Determines wether hook is in progress, used to prevent infinte loops
+ *
+ * @var bool
+ */
var $in_progress = FALSE;
/**
diff --git a/system/core/Input.php b/system/core/Input.php
index cfbef942d..5a033e7b8 100644..100755
--- a/system/core/Input.php
+++ b/system/core/Input.php
@@ -28,15 +28,51 @@
*/
class CI_Input {
+ /**
+ * IP address of the current user
+ *
+ * @var string
+ */
var $ip_address = FALSE;
+ /**
+ * user agent (web browser) being used by the current user
+ *
+ * @var string
+ */
var $user_agent = FALSE;
+ /**
+ * If FALSE, then $_GET will be set to an empty array
+ *
+ * @var bool
+ */
var $_allow_get_array = TRUE;
+ /**
+ * If TRUE, then newlines are standardized
+ *
+ * @var bool
+ */
var $_standardize_newlines = TRUE;
- var $_enable_xss = FALSE; // Set automatically based on config setting
- var $_enable_csrf = FALSE; // Set automatically based on config setting
-
+ /**
+ * Determines whether the XSS filter is always active when GET, POST or COOKIE data is encountered
+ * Set automatically based on config setting
+ *
+ * @var bool
+ */
+ var $_enable_xss = FALSE;
+ /**
+ * Enables a CSRF cookie token to be set.
+ * Set automatically based on config setting
+ *
+ * @var bool
+ */
+ var $_enable_csrf = FALSE;
+ /**
+ * List of all HTTP request headers
+ *
+ * @var array
+ */
protected $headers = array();
-
+
/**
* Constructor
@@ -147,7 +183,7 @@ class CI_Input {
}
return $post;
}
-
+
return $this->_fetch_from_array($_POST, $index, $xss_clean);
}
@@ -402,9 +438,9 @@ class CI_Input {
function _sanitize_globals()
{
// It would be "wrong" to unset any of these GLOBALS.
- $protected = array('_SERVER', '_GET', '_POST', '_FILES', '_REQUEST',
+ $protected = array('_SERVER', '_GET', '_POST', '_FILES', '_REQUEST',
'_SESSION', '_ENV', 'GLOBALS', 'HTTP_RAW_POST_DATA',
- 'system_folder', 'application_folder', 'BM', 'EXT',
+ 'system_folder', 'application_folder', 'BM', 'EXT',
'CFG', 'URI', 'RTR', 'OUT', 'IN');
// Unset globals for securiy.
@@ -523,7 +559,7 @@ class CI_Input {
{
$str = $this->uni->clean_string($str);
}
-
+
// Remove control characters
$str = remove_invisible_characters($str);
@@ -579,9 +615,11 @@ class CI_Input {
/**
* Request Headers
*
- * In Apache, you can simply call apache_request_headers(), however for
+ * In Apache, you can simply call apache_request_headers(), however for
* people running other webservers the function is undefined.
*
+ * @param bool XSS cleaning
+ *
* @return array
*/
public function request_headers($xss_clean = FALSE)
@@ -609,10 +647,10 @@ class CI_Input {
{
$key = str_replace('_', ' ', strtolower($key));
$key = str_replace(' ', '-', ucwords($key));
-
+
$this->headers[$key] = $val;
}
-
+
return $this->headers;
}
@@ -633,7 +671,7 @@ class CI_Input {
{
$this->request_headers();
}
-
+
if ( ! isset($this->headers[$index]))
{
return FALSE;
@@ -644,7 +682,7 @@ class CI_Input {
return $this->security->xss_clean($this->headers[$index]);
}
- return $this->headers[$index];
+ return $this->headers[$index];
}
// --------------------------------------------------------------------
diff --git a/system/core/Lang.php b/system/core/Lang.php
index 170e6c725..5ac671838 100644..100755
--- a/system/core/Lang.php
+++ b/system/core/Lang.php
@@ -26,7 +26,17 @@
*/
class CI_Lang {
+ /**
+ * List of translations
+ *
+ * @var array
+ */
var $language = array();
+ /**
+ * List of loaded language files
+ *
+ * @var array
+ */
var $is_loaded = array();
/**
@@ -47,6 +57,9 @@ class CI_Lang {
* @access public
* @param mixed the name of the language file to be loaded. Can be an array
* @param string the language (english, etc.)
+ * @param bool return loaded array of translations
+ * @param bool add suffix to $langfile
+ * @param string alternative path to look for language file
* @return mixed
*/
function load($langfile = '', $idiom = '', $return = FALSE, $add_suffix = TRUE, $alt_path = '')
diff --git a/system/core/Loader.php b/system/core/Loader.php
index a0fbaa82e..e7fa3d3f6 100644..100755
--- a/system/core/Loader.php
+++ b/system/core/Loader.php
@@ -29,18 +29,91 @@
class CI_Loader {
// All these are set automatically. Don't mess with them.
+ /**
+ * Nesting level of the output buffering mechanism
+ *
+ * @var int
+ * @access protected
+ */
protected $_ci_ob_level;
+ /**
+ * List of paths to load views from
+ *
+ * @var array
+ * @access protected
+ */
protected $_ci_view_paths = array();
+ /**
+ * List of paths to load libraries from
+ *
+ * @var array
+ * @access protected
+ */
protected $_ci_library_paths = array();
+ /**
+ * List of paths to load models from
+ *
+ * @var array
+ * @access protected
+ */
protected $_ci_model_paths = array();
+ /**
+ * List of paths to load helpers from
+ *
+ * @var array
+ * @access protected
+ */
protected $_ci_helper_paths = array();
+ /**
+ * List of loaded base classes
+ * Set by the controller class
+ *
+ * @var array
+ * @access protected
+ */
protected $_base_classes = array(); // Set by the controller class
+ /**
+ * List of cached variables
+ *
+ * @var array
+ * @access protected
+ */
protected $_ci_cached_vars = array();
+ /**
+ * List of loaded classes
+ *
+ * @var array
+ * @access protected
+ */
protected $_ci_classes = array();
+ /**
+ * List of loaded files
+ *
+ * @var array
+ * @access protected
+ */
protected $_ci_loaded_files = array();
+ /**
+ * List of loaded models
+ *
+ * @var array
+ * @access protected
+ */
protected $_ci_models = array();
+ /**
+ * List of loaded helpers
+ *
+ * @var array
+ * @access protected
+ */
protected $_ci_helpers = array();
- protected $_ci_varmap = array('unit_test' => 'unit',
+ /**
+ * List of class name mappings
+ *
+ * @var array
+ * @access protected
+ */
+ protected $_ci_varmap = array('unit_test' => 'unit',
'user_agent' => 'agent');
/**
@@ -55,18 +128,18 @@ class CI_Loader {
$this->_ci_helper_paths = array(APPPATH, BASEPATH);
$this->_ci_model_paths = array(APPPATH);
$this->_ci_view_paths = array(APPPATH.'views/' => TRUE);
-
+
log_message('debug', "Loader Class Initialized");
}
// --------------------------------------------------------------------
-
+
/**
* Initialize the Loader
*
* This method is called once in CI_Controller.
*
- * @param array
+ * @param array
* @return object
*/
public function initialize()
@@ -101,7 +174,7 @@ class CI_Loader {
{
return $this->_ci_classes[$class];
}
-
+
return FALSE;
}
@@ -371,6 +444,7 @@ class CI_Loader {
* the controller class and its "view" files.
*
* @param array
+ * @param string
* @return void
*/
public function vars($vars = array(), $val = '')
@@ -512,6 +586,8 @@ class CI_Loader {
* Loads a config file
*
* @param string
+ * @param bool
+ * @param bool
* @return void
*/
public function config($file = '', $use_sections = FALSE, $fail_gracefully = FALSE)
@@ -558,13 +634,13 @@ class CI_Loader {
* Prepends a parent path to the library, model, helper, and config path arrays
*
* @param string
- * @param boolean
+ * @param boolean
* @return void
*/
public function add_package_path($path, $view_cascade=TRUE)
{
$path = rtrim($path, '/').'/';
-
+
array_unshift($this->_ci_library_paths, $path);
array_unshift($this->_ci_model_paths, $path);
array_unshift($this->_ci_helper_paths, $path);
@@ -600,6 +676,7 @@ class CI_Loader {
* If no path is provided, the most recently added path is removed.
*
* @param type
+ * @param bool
* @return type
*/
public function remove_package_path($path = '', $remove_config_path = TRUE)
@@ -624,7 +701,7 @@ class CI_Loader {
unset($this->{$var}[$key]);
}
}
-
+
if (isset($this->_ci_view_paths[$path.'views/']))
{
unset($this->_ci_view_paths[$path.'views/']);
@@ -663,7 +740,7 @@ class CI_Loader {
{
$$_ci_val = ( ! isset($_ci_data[$_ci_val])) ? FALSE : $_ci_data[$_ci_val];
}
-
+
$file_exists = FALSE;
// Set the path to the requested file
@@ -685,11 +762,11 @@ class CI_Loader {
$file_exists = TRUE;
break;
}
-
+
if ( ! $cascade)
{
break;
- }
+ }
}
}
@@ -918,6 +995,7 @@ class CI_Loader {
*
* @param string
* @param string
+ * @param bool
* @param string an optional object name
* @return null
*/
@@ -1123,6 +1201,7 @@ class CI_Loader {
/**
* Get a reference to a specific library or model
*
+ * @param string
* @return bool
*/
protected function &_ci_get_component($component)
@@ -1139,6 +1218,7 @@ class CI_Loader {
* This function preps the name of various items to make loading them more reliable.
*
* @param mixed
+ * @param string
* @return array
*/
protected function _ci_prep_filename($filename, $extension)
diff --git a/system/core/Model.php b/system/core/Model.php
index 8566a0b66..e15ffbebc 100644..100755
--- a/system/core/Model.php
+++ b/system/core/Model.php
@@ -42,6 +42,7 @@ class CI_Model {
* Allows models to access CI's loaded classes using the same
* syntax as controllers.
*
+ * @param string
* @access private
*/
function __get($key)
diff --git a/system/core/Output.php b/system/core/Output.php
index 05ace919c..ccecafd2b 100644..100755
--- a/system/core/Output.php
+++ b/system/core/Output.php
@@ -28,15 +28,67 @@
*/
class CI_Output {
+ /**
+ * Current output string
+ *
+ * @var string
+ * @access protected
+ */
protected $final_output;
+ /**
+ * Cache expiration time
+ *
+ * @var int
+ * @access protected
+ */
protected $cache_expiration = 0;
+ /**
+ * List of server headers
+ *
+ * @var array
+ * @access protected
+ */
protected $headers = array();
- protected $mime_types = array();
+ /**
+ * List of mime types
+ *
+ * @var array
+ * @access protected
+ */
+ protected $mime_types = array();
+ /**
+ * Determines wether profiler is enabled
+ *
+ * @var book
+ * @access protected
+ */
protected $enable_profiler = FALSE;
+ /**
+ * Determines if output compression is enabled
+ *
+ * @var bool
+ * @access protected
+ */
protected $_zlib_oc = FALSE;
+ /**
+ * List of profiler sections
+ *
+ * @var array
+ * @access protected
+ */
protected $_profiler_sections = array();
- protected $parse_exec_vars = TRUE; // whether or not to parse variables like {elapsed_time} and {memory_usage}
+ /**
+ * Whether or not to parse variables like {elapsed_time} and {memory_usage}
+ *
+ * @var bool
+ * @access protected
+ */
+ protected $parse_exec_vars = TRUE;
+ /**
+ * Constructor
+ *
+ */
function __construct()
{
$this->_zlib_oc = @ini_get('zlib.output_compression');
@@ -127,6 +179,7 @@ class CI_Output {
*
* @access public
* @param string
+ * @param bool
* @return void
*/
function set_header($header, $replace = TRUE)
@@ -265,6 +318,7 @@ class CI_Output {
* benchmark timer so the page rendering speed and memory usage can be shown.
*
* @access public
+ * @param string
* @return mixed
*/
function _display($output = '')
@@ -401,6 +455,7 @@ class CI_Output {
* Write a Cache File
*
* @access public
+ * @param string
* @return void
*/
function _write_cache($output)
@@ -452,6 +507,8 @@ class CI_Output {
* Update/serve a cached file
*
* @access public
+ * @param object config class
+ * @param object uri class
* @return void
*/
function _display_cache(&$CFG, &$URI)
diff --git a/system/core/Router.php b/system/core/Router.php
index 668ac0954..6da667472 100644..100755
--- a/system/core/Router.php
+++ b/system/core/Router.php
@@ -28,12 +28,54 @@
*/
class CI_Router {
+ /**
+ * Config class
+ *
+ * @var object
+ * @access public
+ */
var $config;
+ /**
+ * List of routes
+ *
+ * @var array
+ * @access public
+ */
var $routes = array();
+ /**
+ * List of error routes
+ *
+ * @var array
+ * @access public
+ */
var $error_routes = array();
+ /**
+ * Current class name
+ *
+ * @var string
+ * @access public
+ */
var $class = '';
+ /**
+ * Current method name
+ *
+ * @var string
+ * @access public
+ */
var $method = 'index';
+ /**
+ * Sub-directory that contains the requested controller class
+ *
+ * @var string
+ * @access public
+ */
var $directory = '';
+ /**
+ * Default controller (and method if specific)
+ *
+ * @var string
+ * @access public
+ */
var $default_controller;
/**
@@ -95,7 +137,7 @@ class CI_Router {
{
include(APPPATH.'config/routes.php');
}
-
+
$this->routes = ( ! isset($route) OR ! is_array($route)) ? array() : $route;
unset($route);
@@ -251,7 +293,7 @@ class CI_Router {
$this->set_directory('');
$this->set_class($x[0]);
$this->set_method(isset($x[1]) ? $x[1] : 'index');
-
+
return $x;
}
else
diff --git a/system/core/Security.php b/system/core/Security.php
index 3617cadcc..dcc680a11 100644..100755
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -25,14 +25,49 @@
* @link http://codeigniter.com/user_guide/libraries/security.html
*/
class CI_Security {
-
+
+ /**
+ * Random Hash for protecting URLs
+ *
+ * @var string
+ * @access protected
+ */
protected $_xss_hash = '';
+ /**
+ * Random Hash for Cross Site Request Forgery Protection Cookie
+ *
+ * @var string
+ * @access protected
+ */
protected $_csrf_hash = '';
- protected $_csrf_expire = 7200; // Two hours (in seconds)
+ /**
+ * Expiration time for Cross Site Request Forgery Protection Cookie
+ * Defaults to two hours (in seconds)
+ *
+ * @var int
+ * @access protected
+ */
+ protected $_csrf_expire = 7200;
+ /**
+ * Token name for Cross Site Request Forgery Protection Cookie
+ *
+ * @var string
+ * @access protected
+ */
protected $_csrf_token_name = 'ci_csrf_token';
+ /**
+ * Cookie name for Cross Site Request Forgery Protection Cookie
+ *
+ * @var string
+ * @access protected
+ */
protected $_csrf_cookie_name = 'ci_csrf_token';
-
- /* never allowed, string replacement */
+ /**
+ * List of never allowed strings
+ *
+ * @var array
+ * @access protected
+ */
protected $_never_allowed_str = array(
'document.cookie' => '[removed]',
'document.write' => '[removed]',
@@ -46,13 +81,19 @@ class CI_Security {
);
/* never allowed, regex replacement */
+ /**
+ * List of never allowed regex replacement
+ *
+ * @var array
+ * @access protected
+ */
protected $_never_allowed_regex = array(
"javascript\s*:" => '[removed]',
"expression\s*(\(|&\#40;)" => '[removed]', // CSS and IE
"vbscript\s*:" => '[removed]', // IE, surprise!
"Redirect\s+302" => '[removed]'
);
-
+
/**
* Constructor
*/
@@ -95,7 +136,7 @@ class CI_Security {
}
// Do the tokens exist in both the _POST and _COOKIE arrays?
- if ( ! isset($_POST[$this->_csrf_token_name]) OR
+ if ( ! isset($_POST[$this->_csrf_token_name]) OR
! isset($_COOKIE[$this->_csrf_cookie_name]))
{
$this->csrf_show_error();
@@ -107,7 +148,7 @@ class CI_Security {
$this->csrf_show_error();
}
- // We kill this since we're done and we don't want to
+ // We kill this since we're done and we don't want to
// polute the _POST array
unset($_POST[$this->_csrf_token_name]);
@@ -117,7 +158,7 @@ class CI_Security {
$this->csrf_set_cookie();
log_message('debug', "CSRF token verified ");
-
+
return $this;
}
@@ -146,7 +187,7 @@ class CI_Security {
setcookie($this->_csrf_cookie_name, $this->_csrf_hash, $expire, config_item('cookie_path'), config_item('cookie_domain'), $secure_cookie);
log_message('debug', "CRSF cookie Set");
-
+
return $this;
}
@@ -165,9 +206,9 @@ class CI_Security {
// --------------------------------------------------------------------
/**
- * Get CSRF Hash
+ * Get CSRF Hash
*
- * Getter Method
+ * Getter Method
*
* @return string self::_csrf_hash
*/
@@ -215,6 +256,7 @@ class CI_Security {
* http://ha.ckers.org/xss.html
*
* @param mixed string or array
+ * @param bool
* @return string
*/
public function xss_clean($str, $is_image = FALSE)
@@ -263,7 +305,7 @@ class CI_Security {
*/
$str = preg_replace_callback("/[a-z]+=([\'\"]).*?\\1/si", array($this, '_convert_attribute'), $str);
-
+
$str = preg_replace_callback("/<\w+.*?(?=>|<|$)/si", array($this, '_decode_entity'), $str);
/*
@@ -276,7 +318,7 @@ class CI_Security {
*
* This prevents strings like this: ja vascript
* NOTE: we deal with spaces between characters later.
- * NOTE: preg_replace was found to be amazingly slow here on
+ * NOTE: preg_replace was found to be amazingly slow here on
* large blocks of data, so we use str_replace.
*/
@@ -304,8 +346,8 @@ class CI_Security {
*/
if ($is_image === TRUE)
{
- // Images have a tendency to have the PHP short opening and
- // closing tags every so often so we skip those and only
+ // Images have a tendency to have the PHP short opening and
+ // closing tags every so often so we skip those and only
// do the long opening tags.
$str = preg_replace('/<\?(php)/i', "&lt;?\\1", $str);
}
@@ -321,10 +363,10 @@ class CI_Security {
* These words are compacted back to their correct state.
*/
$words = array(
- 'javascript', 'expression', 'vbscript', 'script',
+ 'javascript', 'expression', 'vbscript', 'script',
'applet', 'alert', 'document', 'write', 'cookie', 'window'
);
-
+
foreach ($words as $word)
{
$temp = '';
@@ -341,8 +383,8 @@ class CI_Security {
/*
* Remove disallowed Javascript in links or img tags
- * We used to do some version comparisons and use of stripos for PHP5,
- * but it is dog slow compared to these simplified non-capturing
+ * We used to do some version comparisons and use of stripos for PHP5,
+ * but it is dog slow compared to these simplified non-capturing
* preg_match(), especially if the pattern exists in the string
*/
do
@@ -405,11 +447,11 @@ class CI_Security {
/*
* Images are Handled in a Special Way
- * - Essentially, we want to know that after all of the character
- * conversion is done whether any unwanted, likely XSS, code was found.
+ * - Essentially, we want to know that after all of the character
+ * conversion is done whether any unwanted, likely XSS, code was found.
* If not, we return TRUE, as the image is clean.
- * However, if the string post-conversion does not matched the
- * string post-removal of XSS, then it fails, as there was unwanted XSS
+ * However, if the string post-conversion does not matched the
+ * string post-removal of XSS, then it fails, as there was unwanted XSS
* code found and removed/changed during processing.
*/
@@ -478,7 +520,7 @@ class CI_Security {
// correctly. html_entity_decode() does not convert entities without
// semicolons, so we are left with our own little solution here. Bummer.
- if (function_exists('html_entity_decode') &&
+ if (function_exists('html_entity_decode') &&
(strtolower($charset) != 'utf-8'))
{
$str = html_entity_decode($str, ENT_COMPAT, $charset);
@@ -505,6 +547,7 @@ class CI_Security {
* Filename Security
*
* @param string
+ * @param bool
* @return string
*/
public function sanitize_filename($str, $relative_path = FALSE)
@@ -542,7 +585,7 @@ class CI_Security {
"%3b", // ;
"%3d" // =
);
-
+
if ( ! $relative_path)
{
$bad[] = './';
@@ -570,7 +613,7 @@ class CI_Security {
}
// --------------------------------------------------------------------
-
+
/*
* Remove Evil HTML Attributes (like evenhandlers and style)
*
@@ -578,7 +621,7 @@ class CI_Security {
* - Everything up until a space
* For example, everything between the pipes:
* <a |style=document.write('hello');alert('world');| class=link>
- * - Everything inside the quotes
+ * - Everything inside the quotes
* For example, everything between the pipes:
* <a |style="document.write('hello'); alert('world');"| class="link">
*
@@ -594,12 +637,12 @@ class CI_Security {
if ($is_image === TRUE)
{
/*
- * Adobe Photoshop puts XML metadata into JFIF images,
+ * Adobe Photoshop puts XML metadata into JFIF images,
* including namespacing, so we have to allow this for images.
*/
unset($evil_attributes[array_search('xmlns', $evil_attributes)]);
}
-
+
do {
$str = preg_replace(
"#<(/?[^><]+?)([^A-Za-z\-])(".implode('|', $evil_attributes).")(\s*=\s*)([\"][^>]*?[\"]|[\'][^>]*?[\']|[^>]*?)([\s><])([><]*)#i",
@@ -607,10 +650,10 @@ class CI_Security {
$str, -1, $count
);
} while ($count);
-
+
return $str;
}
-
+
// --------------------------------------------------------------------
/**
@@ -627,7 +670,7 @@ class CI_Security {
$str = '&lt;'.$matches[1].$matches[2].$matches[3];
// encode captured opening or closing brace to prevent recursive vectors
- $str .= str_replace(array('>', '<'), array('&gt;', '&lt;'),
+ $str .= str_replace(array('>', '<'), array('&gt;', '&lt;'),
$matches[4]);
return $str;
@@ -649,7 +692,7 @@ class CI_Security {
protected function _js_link_removal($match)
{
$attributes = $this->_filter_attributes(str_replace(array('<', '>'), '', $match[1]));
-
+
return str_replace($match[1], preg_replace("#href=.*?(alert\(|alert&\#40;|javascript\:|livescript\:|mocha\:|charset\=|window\.|document\.|\.cookie|<script|<xss|base64\s*,)#si", "", $attributes), $match[0]);
}
@@ -669,7 +712,7 @@ class CI_Security {
protected function _js_img_removal($match)
{
$attributes = $this->_filter_attributes(str_replace(array('<', '>'), '', $match[1]));
-
+
return str_replace($match[1], preg_replace("#src=.*?(alert\(|alert&\#40;|javascript\:|livescript\:|mocha\:|charset\=|window\.|document\.|\.cookie|<script|<xss|base64\s*,)#si", "", $attributes), $match[0]);
}
@@ -729,13 +772,13 @@ class CI_Security {
}
// --------------------------------------------------------------------
-
+
/**
* Validate URL entities
*
* Called by xss_clean()
*
- * @param string
+ * @param string
* @return string
*/
protected function _validate_entities($str)
@@ -743,9 +786,9 @@ class CI_Security {
/*
* Protect GET variables in URLs
*/
-
+
// 901119URL5918AMP18930PROTECT8198
-
+
$str = preg_replace('|\&([a-z\_0-9\-]+)\=([a-z\_0-9\-]+)|i', $this->xss_hash()."\\1=\\2", $str);
/*
@@ -769,7 +812,7 @@ class CI_Security {
* Un-Protect GET variables in URLs
*/
$str = str_replace($this->xss_hash(), '&', $str);
-
+
return $str;
}
@@ -794,7 +837,7 @@ class CI_Security {
{
$str = preg_replace("#".$key."#i", $val, $str);
}
-
+
return $str;
}
@@ -809,16 +852,16 @@ class CI_Security {
{
if ($this->_csrf_hash == '')
{
- // If the cookie exists we will use it's value.
+ // If the cookie exists we will use it's value.
// We don't necessarily want to regenerate it with
- // each page load since a page could contain embedded
+ // each page load since a page could contain embedded
// sub-pages causing this feature to fail
- if (isset($_COOKIE[$this->_csrf_cookie_name]) &&
+ if (isset($_COOKIE[$this->_csrf_cookie_name]) &&
$_COOKIE[$this->_csrf_cookie_name] != '')
{
return $this->_csrf_hash = $_COOKIE[$this->_csrf_cookie_name];
}
-
+
return $this->_csrf_hash = md5(uniqid(rand(), TRUE));
}
diff --git a/system/core/URI.php b/system/core/URI.php
index 20f0f006b..a3ae20cc3 100644..100755
--- a/system/core/URI.php
+++ b/system/core/URI.php
@@ -28,9 +28,34 @@
*/
class CI_URI {
+ /**
+ * List of cached uri segments
+ *
+ * @var array
+ * @access public
+ */
var $keyval = array();
+ /**
+ * Current uri string
+ *
+ * @var string
+ * @access public
+ */
var $uri_string;
+ /**
+ * List of uri segments
+ *
+ * @var array
+ * @access public
+ */
var $segments = array();
+ /**
+ * Re-indexed list of uri segments
+ * Starts at 1 instead of 0
+ *
+ * @var array
+ * @access public
+ */
var $rsegments = array();
/**
@@ -127,6 +152,7 @@ class CI_URI {
* Set the URI String
*
* @access public
+ * @param string
* @return string
*/
function _set_uri_string($str)
@@ -366,6 +392,11 @@ class CI_URI {
/**
* Identical to above only it uses the re-routed segment array
*
+ * @access public
+ * @param integer the starting segment number
+ * @param array an array of default values
+ * @return array
+ *
*/
function ruri_to_assoc($n = 3, $default = array())
{
diff --git a/system/database/DB.php b/system/database/DB.php
index 33207d885..8314d3b97 100644..100755
--- a/system/database/DB.php
+++ b/system/database/DB.php
@@ -21,6 +21,8 @@
* @category Database
* @author ExpressionEngine Dev Team
* @link http://codeigniter.com/user_guide/database/
+ * @param string
+ * @param bool Determines if active record should be used or not
*/
function &DB($params = '', $active_record_override = NULL)
{
@@ -35,7 +37,7 @@ function &DB($params = '', $active_record_override = NULL)
show_error('The configuration file database.php does not exist.');
}
}
-
+
include($file_path);
if ( ! isset($db) OR count($db) == 0)