Merge branch 'develop' of github.com:EllisLab/CodeIgniter into develop

4 files changed, 26 insertions, 9 deletions

diff --git a/user_guide/libraries/file_uploading.html b/user_guide/libraries/file_uploading.html
index a88c67220..94b219355 100644
--- a/user_guide/libraries/file_uploading.html
+++ b/user_guide/libraries/file_uploading.html
@@ -305,6 +305,13 @@ $this->upload->initialize($config);</code>
 </tr>
 
 <tr>
+<td class="td"><strong>max_filename_increment</strong></td>
+<td class="td">100</td>
+<td class="td">None</td>
+<td class="td">When overwrite is set to FALSE, use this to set the maximum filename increment for CodeIgniter to append to the filename.</td>
+</tr>
+
+<tr>
 <td class="td"><strong>encrypt_name</strong></td>
 <td class="td">FALSE</td>
 <td class="td">TRUE/FALSE (boolean)</td>
diff --git a/user_guide/libraries/form_validation.html b/user_guide/libraries/form_validation.html
index d9d8a4502..ede1913e0 100644
--- a/user_guide/libraries/form_validation.html
+++ b/user_guide/libraries/form_validation.html
@@ -1042,6 +1042,13 @@ POST array:</p>
 	</tr>
 
 	<tr>
+		<td class="td"><strong>is_unique</strong></td>
+		<td class="td">Yes</td>
+		<td class="td">Returns FALSE if the form element is not unique in a database table.</td>
+		<td class="td">is_unique[table.field]</td>
+	</tr>
+
+	<tr>
 		<td class="td"><strong>valid_email</strong></td>
 		<td class="td">No</td>
 		<td class="td">Returns FALSE if the form element does not contain a valid email address.</td>
diff --git a/user_guide/libraries/input.html b/user_guide/libraries/input.html
index 311f76ee9..77e28488a 100644
--- a/user_guide/libraries/input.html
+++ b/user_guide/libraries/input.html
@@ -73,11 +73,11 @@ Input Class
 <p>The security filtering function is called automatically when a new <a href="../general/controllers.html">controller</a> is invoked.  It does the following:</p>
 
 <ul>
-<li>Destroys the global GET array.  Since CodeIgniter does not utilize GET strings, there is no reason to allow it.</li>
+<li>If $config['allow_get_array'] is FALSE(default is TRUE), destroys the global GET array.</li>
 <li>Destroys all global variables in the event register_globals is turned on.</li>
-<li>Filters the POST/COOKIE array keys, permitting only alpha-numeric (and a few other) characters.</li>
+<li>Filters the GET/POST/COOKIE array keys, permitting only alpha-numeric (and a few other) characters.</li>
 <li>Provides XSS (Cross-site Scripting Hacks) filtering.  This can be enabled globally, or upon request.</li>
-<li>Standardizes newline characters to \n</li>
+<li>Standardizes newline characters to \n(In Windows \r\n)</li>
 </ul>
 
 
@@ -133,13 +133,13 @@ else<br />
 <code>$this->input->post('some_data', TRUE);</code>
 
 <p>To return an array of all POST items call without any parameters.</p>
-<p>To return all POST items and pass them through the XSS filter leave the first parameter blank while setting the second parameter to boolean;</p>
+<p>To return all POST items and pass them through the XSS filter set the first parameter NULL while setting the second parameter to boolean;</p>
 <p>The function returns FALSE (boolean) if there are no items in the POST.</p>
 
 <code>
-	$this->input->post(); // returns all POST items with XSS filter
+	$this->input->post(NULL, TRUE); // returns all POST items with XSS filter
 	<br />
-	$this->input->post(NULL, FALSE); // returns all POST items without XSS
+	$this->input->post(); // returns all POST items without XSS filter
 </code>
 
 <h2>$this->input->get()</h2>
@@ -149,13 +149,13 @@ else<br />
 <code>$this->input->get('some_data', TRUE);</code>
 
 <p>To return an array of all GET items call without any parameters.</p>
-<p>To return all GET items and pass them through the XSS filter leave the first parameter blank while setting the second parameter to boolean;</p>
+<p>To return all GET items and pass them through the XSS filter set the first parameter NULL while setting the second parameter to boolean;</p>
 <p>The function returns FALSE (boolean) if there are no items in the GET.</p>
 
 <code>
-	$this->input->get(); // returns all GET items with XSS filter
+	$this->input->get(NULL, TRUE); // returns all GET items with XSS filter
 	<br />
-	$this->input->get(NULL, FALSE); // returns all GET items without XSS filtering
+	$this->input->get(); // returns all GET items without XSS filtering
 </code>
 
 <h2>$this->input->get_post()</h2>
diff --git a/user_guide/libraries/security.html b/user_guide/libraries/security.html
index dd62a4386..cbe12d852 100644
--- a/user_guide/libraries/security.html
+++ b/user_guide/libraries/security.html
@@ -116,6 +116,9 @@ Note: This function should only be used to deal with data upon submission. It's
 
 <p>If you use the <a href="../helpers/form_helper.html">form helper</a> the <var>form_open()</var> function will automatically insert a hidden csrf field in your forms.</p>
 
+<p>Select URIs can be whitelisted from csrf protection (for example API endpoints expecting externally POSTed content). You can add these URIs by editing the 'csrf_exclude_uris' config parameter:</p>
+<code>$config['csrf_exclude_uris'] = array('api/person/add');</code>
+
 </div>
 <!-- END CONTENT -->