diff options
19 files changed, 52 insertions, 93 deletions
diff --git a/system/core/Input.php b/system/core/Input.php index 5b8e62389..657fce625 100644 --- a/system/core/Input.php +++ b/system/core/Input.php @@ -330,10 +330,10 @@ class CI_Input { if (config_item('proxy_ips') != '' && $this->server('HTTP_X_FORWARDED_FOR') && $this->server('REMOTE_ADDR')) { - $has_ranges = strpos($proxies, '/') !== false; + $has_ranges = strpos($proxies, '/') !== FALSE; $proxies = preg_split('/[\s,]/', config_item('proxy_ips'), -1, PREG_SPLIT_NO_EMPTY); $proxies = is_array($proxies) ? $proxies : array($proxies); - + if ($has_ranges) { $long_ip = ip2long($_SERVER['REMOTE_ADDR']); @@ -341,21 +341,25 @@ class CI_Input { // Go through each of the IP Addresses to check for and // test against range notation - foreach($proxies as $ip) + foreach ($proxies as $ip) { - list($address, $mask_length) = explode('/', $ip); + list($address, $mask_length) = explode('/', $ip, 2); // Generate the bitmask for a 32 bit IP Address - $bitmask = $bit_32 - (1 << (32 - (int)$mask_length)); - if (($long_ip & $bitmask) == $address) + $bitmask = $bit_32 - (1 << (32 - (int) $mask_length)); + if (($long_ip & $bitmask) === $address) { $this->ip_address = $_SERVER['HTTP_X_FORWARDED_FOR']; break; } } - } else { - $this->ip_address = in_array($_SERVER['REMOTE_ADDR'], $proxies) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR']; + } + else + { + $this->ip_address = in_array($_SERVER['REMOTE_ADDR'], $proxies) + ? $_SERVER['HTTP_X_FORWARDED_FOR'] + : $_SERVER['REMOTE_ADDR']; } } elseif ( ! $this->server('HTTP_CLIENT_IP') && $this->server('REMOTE_ADDR')) diff --git a/system/database/DB_driver.php b/system/database/DB_driver.php index e61af91b7..b64b977cb 100644 --- a/system/database/DB_driver.php +++ b/system/database/DB_driver.php @@ -79,6 +79,10 @@ abstract class CI_DB_driver { protected $_protect_identifiers = TRUE; protected $_reserved_identifiers = array('*'); // Identifiers that should NOT be escaped + // clause and character used for LIKE escape sequences + protected $_like_escape_str = " ESCAPE '%s' "; + protected $_like_escape_chr = '!'; + /** * The syntax to count rows is slightly different across different * database engines, so this string appears in each driver and is diff --git a/system/database/drivers/cubrid/cubrid_driver.php b/system/database/drivers/cubrid/cubrid_driver.php index a3d0287f5..28724e0e8 100644 --- a/system/database/drivers/cubrid/cubrid_driver.php +++ b/system/database/drivers/cubrid/cubrid_driver.php @@ -45,10 +45,6 @@ class CI_DB_cubrid_driver extends CI_DB { // The character used for escaping - no need in CUBRID protected $_escape_char = '`'; - // clause and character used for LIKE escape sequences - not used in CUBRID - protected $_like_escape_str = ''; - protected $_like_escape_chr = ''; - protected $_random_keyword = ' RAND()'; // database specific random keyword // CUBRID-specific properties @@ -72,6 +68,8 @@ class CI_DB_cubrid_driver extends CI_DB { } } + // -------------------------------------------------------------------- + /** * Non-persistent database connection * diff --git a/system/database/drivers/ibase/ibase_driver.php b/system/database/drivers/ibase/ibase_driver.php index c9027670d..f7811bf46 100644 --- a/system/database/drivers/ibase/ibase_driver.php +++ b/system/database/drivers/ibase/ibase_driver.php @@ -45,10 +45,6 @@ class CI_DB_ibase_driver extends CI_DB { // The character used to escape with protected $_escape_char = '"'; - // clause and character used for LIKE escape sequences - protected $_like_escape_str = " ESCAPE '%s' "; - protected $_like_escape_chr = '!'; - protected $_random_keyword = ' Random()'; // database specific random keyword // Keeps track of the resource for the current transaction diff --git a/system/database/drivers/mssql/mssql_driver.php b/system/database/drivers/mssql/mssql_driver.php index 1714704a8..b4a1af7ba 100644 --- a/system/database/drivers/mssql/mssql_driver.php +++ b/system/database/drivers/mssql/mssql_driver.php @@ -45,10 +45,6 @@ class CI_DB_mssql_driver extends CI_DB { // The character used for escaping protected $_escape_char = '"'; - // clause and character used for LIKE escape sequences - protected $_like_escape_str = " ESCAPE '%s' "; - protected $_like_escape_chr = '!'; - protected $_random_keyword = ' NEWID()'; // MSSQL-specific properties diff --git a/system/database/drivers/mysql/mysql_driver.php b/system/database/drivers/mysql/mysql_driver.php index 35473016f..6b4d84dfb 100644 --- a/system/database/drivers/mysql/mysql_driver.php +++ b/system/database/drivers/mysql/mysql_driver.php @@ -45,10 +45,6 @@ class CI_DB_mysql_driver extends CI_DB { // The character used for escaping protected $_escape_char = '`'; - // clause and character used for LIKE escape sequences - not used in MySQL - protected $_like_escape_str = ''; - protected $_like_escape_chr = '\\'; - protected $_random_keyword = ' RAND()'; // database specific random keyword /** diff --git a/system/database/drivers/mysqli/mysqli_driver.php b/system/database/drivers/mysqli/mysqli_driver.php index 9558dfd86..453ddcc3f 100644 --- a/system/database/drivers/mysqli/mysqli_driver.php +++ b/system/database/drivers/mysqli/mysqli_driver.php @@ -45,10 +45,6 @@ class CI_DB_mysqli_driver extends CI_DB { // The character used for escaping protected $_escape_char = '`'; - // clause and character used for LIKE escape sequences - not used in MySQL - protected $_like_escape_str = ''; - protected $_like_escape_chr = '\\'; - protected $_random_keyword = ' RAND()'; // database specific random keyword /** diff --git a/system/database/drivers/oci8/oci8_driver.php b/system/database/drivers/oci8/oci8_driver.php index 691247fee..7bf18949b 100644 --- a/system/database/drivers/oci8/oci8_driver.php +++ b/system/database/drivers/oci8/oci8_driver.php @@ -54,10 +54,6 @@ class CI_DB_oci8_driver extends CI_DB { // The character used for excaping protected $_escape_char = '"'; - // clause and character used for LIKE escape sequences - protected $_like_escape_str = " ESCAPE '%s' "; - protected $_like_escape_chr = '!'; - /** * The syntax to count rows is slightly different across different * database engines, so this string appears in each driver and is diff --git a/system/database/drivers/odbc/odbc_driver.php b/system/database/drivers/odbc/odbc_driver.php index 8f0a474b0..fbf6a4cb1 100644 --- a/system/database/drivers/odbc/odbc_driver.php +++ b/system/database/drivers/odbc/odbc_driver.php @@ -45,9 +45,7 @@ class CI_DB_odbc_driver extends CI_DB { // the character used to excape - not necessary for ODBC protected $_escape_char = ''; - // clause and character used for LIKE escape sequences protected $_like_escape_str = " {escape '%s'} "; - protected $_like_escape_chr = '!'; protected $_random_keyword; diff --git a/system/database/drivers/pdo/pdo_driver.php b/system/database/drivers/pdo/pdo_driver.php index 705b16560..0ffe3bc13 100644 --- a/system/database/drivers/pdo/pdo_driver.php +++ b/system/database/drivers/pdo/pdo_driver.php @@ -45,10 +45,6 @@ class CI_DB_pdo_driver extends CI_DB { // The character used to escaping protected $_escape_char = '"'; - // clause and character used for LIKE escape sequences - protected $_like_escape_str = " ESCAPE '%s' "; - protected $_like_escape_chr = '!'; - protected $_random_keyword; public $trans_enabled = FALSE; diff --git a/system/database/drivers/pdo/subdrivers/pdo_cubrid_driver.php b/system/database/drivers/pdo/subdrivers/pdo_cubrid_driver.php index 05eeacfe6..eb3714783 100644 --- a/system/database/drivers/pdo/subdrivers/pdo_cubrid_driver.php +++ b/system/database/drivers/pdo/subdrivers/pdo_cubrid_driver.php @@ -44,10 +44,6 @@ class CI_DB_pdo_cubrid_driver extends CI_DB_pdo_driver { protected $_escape_char = '`'; - // clause and character used for LIKE escape sequences - not used in CUBRID - protected $_like_escape_str = ''; - protected $_like_escape_chr = '\\'; - protected $_random_keyword = ' RAND()'; /** diff --git a/system/database/drivers/pdo/subdrivers/pdo_mysql_driver.php b/system/database/drivers/pdo/subdrivers/pdo_mysql_driver.php index 78afe246c..b6807026d 100644 --- a/system/database/drivers/pdo/subdrivers/pdo_mysql_driver.php +++ b/system/database/drivers/pdo/subdrivers/pdo_mysql_driver.php @@ -44,10 +44,6 @@ class CI_DB_pdo_mysql_driver extends CI_DB_pdo_driver { protected $_escape_char = '`'; - // clause and character used for LIKE escape sequences - not used in MySQL - protected $_like_escape_str = ''; - protected $_like_escape_chr = '\\'; - protected $_random_keyword = ' RAND()'; /** diff --git a/system/database/drivers/pdo/subdrivers/pdo_odbc_driver.php b/system/database/drivers/pdo/subdrivers/pdo_odbc_driver.php index 392754ff7..dd7a1af52 100644 --- a/system/database/drivers/pdo/subdrivers/pdo_odbc_driver.php +++ b/system/database/drivers/pdo/subdrivers/pdo_odbc_driver.php @@ -46,7 +46,6 @@ class CI_DB_pdo_odbc_driver extends CI_DB_pdo_driver { protected $_escape_char = ''; // clause and character used for LIKE escape sequences - protected $_like_escape_chr = '!'; protected $_like_escape_str = " {escape '%s'} "; protected $_random_keyword = ' RAND()'; diff --git a/system/database/drivers/postgre/postgre_driver.php b/system/database/drivers/postgre/postgre_driver.php index 8c11c477b..1d6e9567a 100644 --- a/system/database/drivers/postgre/postgre_driver.php +++ b/system/database/drivers/postgre/postgre_driver.php @@ -44,10 +44,6 @@ class CI_DB_postgre_driver extends CI_DB { protected $_escape_char = '"'; - // clause and character used for LIKE escape sequences - protected $_like_escape_str = " ESCAPE '%s' "; - protected $_like_escape_chr = '!'; - protected $_random_keyword = ' RANDOM()'; // database specific random keyword /** diff --git a/system/database/drivers/sqlite/sqlite_driver.php b/system/database/drivers/sqlite/sqlite_driver.php index 19824dbbf..2744a63cf 100644 --- a/system/database/drivers/sqlite/sqlite_driver.php +++ b/system/database/drivers/sqlite/sqlite_driver.php @@ -45,10 +45,6 @@ class CI_DB_sqlite_driver extends CI_DB { // The character used to escape with - not needed for SQLite protected $_escape_char = '"'; - // clause and character used for LIKE escape sequences - protected $_like_escape_str = " ESCAPE '%s' "; - protected $_like_escape_chr = '!'; - protected $_random_keyword = ' Random()'; // database specific random keyword /** diff --git a/system/database/drivers/sqlite3/sqlite3_driver.php b/system/database/drivers/sqlite3/sqlite3_driver.php index cc35d319f..23145e7f9 100644 --- a/system/database/drivers/sqlite3/sqlite3_driver.php +++ b/system/database/drivers/sqlite3/sqlite3_driver.php @@ -46,10 +46,6 @@ class CI_DB_sqlite3_driver extends CI_DB { // The character used for escaping protected $_escape_char = '"'; - // clause and character used for LIKE escape sequences - protected $_like_escape_str = ' ESCAPE \'%s\' '; - protected $_like_escape_chr = '!'; - protected $_random_keyword = ' RANDOM()'; /** diff --git a/system/database/drivers/sqlsrv/sqlsrv_driver.php b/system/database/drivers/sqlsrv/sqlsrv_driver.php index bda450e88..abcaf4577 100644 --- a/system/database/drivers/sqlsrv/sqlsrv_driver.php +++ b/system/database/drivers/sqlsrv/sqlsrv_driver.php @@ -45,10 +45,6 @@ class CI_DB_sqlsrv_driver extends CI_DB { // The character used for escaping protected $_escape_char = '"'; - // clause and character used for LIKE escape sequences - protected $_like_escape_str = " ESCAPE '%s' "; - protected $_like_escape_chr = '!'; - protected $_random_keyword = ' NEWID()'; // SQLSRV-specific properties diff --git a/tests/codeigniter/database/query_builder/escape_test.php b/tests/codeigniter/database/query_builder/escape_test.php index c6380ddf1..27e678f22 100644 --- a/tests/codeigniter/database/query_builder/escape_test.php +++ b/tests/codeigniter/database/query_builder/escape_test.php @@ -27,7 +27,7 @@ class Escape_test extends CI_TestCase { if (strpos(DB_DRIVER, 'mysql') !== FALSE) { - $sql = "SELECT `value` FROM `misc` WHERE `key` LIKE '$string%' ESCAPE '';"; + $sql = "SELECT `value` FROM `misc` WHERE `key` LIKE '$string%' ESCAPE '!';"; } else { @@ -52,7 +52,7 @@ class Escape_test extends CI_TestCase { if (strpos(DB_DRIVER, 'mysql') !== FALSE) { - $sql = "SELECT `value` FROM `misc` WHERE `key` LIKE '$string%' ESCAPE '';"; + $sql = "SELECT `value` FROM `misc` WHERE `key` LIKE '$string%' ESCAPE '!';"; } else { diff --git a/user_guide_src/source/changelog.rst b/user_guide_src/source/changelog.rst index 378eec061..0316c38ab 100644 --- a/user_guide_src/source/changelog.rst +++ b/user_guide_src/source/changelog.rst @@ -145,7 +145,7 @@ Release Date: Not Released - Added capability for packages to hold database.php config files - Added subdrivers support (currently only used by PDO). - Added client compression support for MySQL and MySQLi. - - Removed :doc:`Loader Class <libraries/loader>` from Database error to better find the likely culprit. + - Removed :doc:`Loader Class <libraries/loader>` from Database error tracing to better find the likely culprit. - Libraries @@ -160,10 +160,12 @@ Release Date: Not Released - Changed the Cookie driver to select only one row when using database sessions. - Cookie driver now only writes to database at end of request when using database. - Cookie driver now uses PHP functions for faster array manipulation when using database. - - Added all_flashdata() method to session class. Returns an associative array of only flashdata. - - Added has_userdata() method to verify existence of userdata item. - - Added tempdata(), set_tempdata(), and unset_tempdata() methods for manipulating tempdata. - - Added max_filename_increment config setting for Upload library. + - Added ``all_flashdata()`` method to session class. Returns an associative array of only flashdata. + - Added ``has_userdata()`` method to verify existence of userdata item. + - Added ``tempdata()``, ``set_tempdata()``, and ``unset_tempdata()`` methods for manipulating tempdata. + - :doc:`File Uploading Library <libraries/upload>` changes include: + - Added *max_filename_increment* config setting. + - Added an "index" parameter to the ``data()`` method. - :doc:`Cart library <libraries/cart>` changes include: - It now auto-increments quantity's instead of just resetting it, this is the default behaviour of large e-commerce sites. - Product Name strictness can be disabled via the Cart Library by switching "$product_name_safe". @@ -174,9 +176,6 @@ Release Date: Not Released - Class properties wm_font_color, wm_shadow_color and wm_use_drop_shadow are now protected, to avoid breaking the text_watermark() method if they are set manually after initialization. - If property maintain_ratio is set to TRUE, image_reproportion() now doesn't need both width and height to be specified. - Property maintain_ratio is now taken into account when resizing images using ImageMagick library - - Removed SHA1 function in the :doc:`Encryption Library <libraries/encryption>`. - - Added $config['csrf_regeneration'] to the CSRF protection in the :doc:`Security library <libraries/security>`, which makes token regeneration optional. - - Added $config['csrf_exclude_uris'] to the CSRF protection in the :doc:`Security library <libraries/security>`, which allows you list URIs which will not have the CSRF validation functions run. - :doc:`Form Validation library <libraries/form_validation>` changes include: - Added method error_array() to return all error messages as an array. - Added method set_data() to set an alternative data array to be validated instead of the default $_POST. @@ -187,7 +186,7 @@ Release Date: Not Released - Native PHP functions used as rules can now accept an additional parameter, other than the data itself. - Updated set_rules() to accept an array of rules as well as a string. - Fields that have empty rules set no longer run through validation (and therefore are not considered erroneous). - - Allowed for setting table class defaults in a config file. + - Added support for setting :doc:`Table <libraries/table>` class defaults in a config file. - Added a Wincache driver to the :doc:`Caching Library <libraries/caching>`. - Added a Redis driver to the :doc:`Caching Library <libraries/caching>`. - :doc:`Email library <libraries/email>` changes include: @@ -196,7 +195,6 @@ Release Date: Not Released - Added dsn (delivery status notification) option. - Renamed method _set_header() to set_header() and made it public to enable adding custom headers in the :doc:`Email Library <libraries/email>`. - Successfully sent emails will automatically clear the parameters. - - Added an "index" parameter to the data() method in the :doc:`Upload Library <libraries/file_uploading>`. - :doc:`Pagination Library <libraries/pagination>` changes include: - Added support for the anchor "rel" attribute. - Added support for setting custom attributes. @@ -205,33 +203,38 @@ Release Date: Not Released - Removed the default `` `` from a number of the configuration variables. - Added the ability to use a proxy with the :doc:`XML-RPC Library <libraries/xmlrpc>`. - :doc:`Encryption Library <libraries/encrypt>` changes include: - - Added support for hashing algorithms other than SHA1 and MD5. + - Added support for hashing algorithms other than SHA1 and MD5. + - Removed previously deprecated ``sha1()`` method. - Core - Changed private methods in the :doc:`URI Library <libraries/uri>` to protected so MY_URI can override them. - - Removed CI_CORE boolean constant from CodeIgniter.php (no longer Reactor and Core versions). + - Removed ``CI_CORE`` boolean constant from CodeIgniter.php (no longer Reactor and Core versions). - :doc:`Loader Library <libraries/loader>` changes include: - Added method get_vars() to the Loader to retrieve all variables loaded with $this->load->vars(). - CI_Loader::_ci_autoloader() is now a protected method. - Added autoloading of drivers with $autoload['drivers']. - CI_Loader::library() will now load drivers as well, for backward compatibility of converted libraries (like Session). - - is_loaded() function from system/core/Commons.php now returns a reference. + - ``is_loaded()`` function from *system/core/Commons.php* now returns a reference. - $config['rewrite_short_tags'] now has no effect when using PHP 5.4 as *<?=* will always be available. - - Added method() to the :doc:`Input Library <libraries/input>` to retrieve $_SERVER['REQUEST_METHOD']. + - Added ``method()`` to the :doc:`Input Library <libraries/input>` to retrieve ``$_SERVER['REQUEST_METHOD']``. - Modified valid_ip() to use PHP's filter_var() in the :doc:`Input Library <libraries/input>`. - - Added support for HTTP-Only cookies with new config option ``cookie_httponly`` (default FALSE). + - Added support for HTTP-Only cookies with new config option *cookie_httponly* (default FALSE). - Renamed method _call_hook() to call_hook() in the :doc:`Hooks Library <general/hooks>`. - - Added get_content_type() method to the :doc:`Output Library <libraries/output>`. - - Added get_mimes() function to system/core/Commons.php to return the config/mimes.php array. - - Added a second argument to set_content_type() in the :doc:`Output Library <libraries/output>` that allows setting the document charset as well. - - $config['time_reference'] now supports all timezone strings supported by PHP. - - Added support for HTTP code 303 ("See Other") in set_status_header(). - - Changed :doc:`Config Library <libraries/config>` method site_url() to accept an array as well. - - Added method ``strip_image_tags()`` to the :doc:`Security Library <libraries/security>`. + - :doc:`Output Library <libraries/output>` changes include: + - Added method ``get_content_type()``. + - Added a second argument to method ``set_content_type()`` that allows setting the document charset as well. + - Added ``get_mimes()`` function to *system/core/Commons.php* to return the *config/mimes.php* array. + - ``$config['time_reference']`` now supports all timezone strings supported by PHP. + - Added support for HTTP code 303 ("See Other") in ``set_status_header()``. + - Changed :doc:`Config Library <libraries/config>` method ``site_url()`` to accept an array as well. + - :doc:`Security Library <libraries/security>` changes include: + - Added method ``strip_image_tags()``. + - Added ``$config['csrf_regeneration']``, which makes token regeneration optional. + - Added ``$config['csrf_exclude_uris']``, which allows you list URIs which will not have the CSRF validation methods run. - Changed ``_exception_handler()`` to respect php.ini 'display_errors' setting. - - Added support for IPv4 range masks (e.g. 192.168.1.1/24) to specify ranges of IP addresses for use with the proxy_ips setting. - Removed redundant conditional to determine HTTP server protocol in ``set_status_header()`` + - Added support for IPv4 range masks (e.g. 192.168.1.1/24) to specify ranges of IP addresses for use with the *proxy_ips* setting. Bug fixes for 3.0 ------------------ @@ -315,12 +318,12 @@ Bug fixes for 3.0 - Fixed a bug (#666) - :doc:`Output library <libraries/output>`'s set_content_type() method didn't set the document charset. - Fixed a bug (#784, #861) - :doc:`Database Forge <database/forge>` method ``create_table()`` used to accept constraints for MSSQL/SQLSRV integer-type columns. - Fixed a bug (#706) - SQLSRV/MSSSQL didn't escape field names. -- Fixed a bug (#1452) - protect_identifiers() didn't properly detect identifiers with spaces in their names. -- Fixed a bug where protect_identifiers() ignored it's extra arguments when the value passed to it is an array. -- Fixed a bug where _has_operator() didn't detect BETWEEN. -- Fixed a bug in :doc:`Query Builder <database/query_builder>`'s join() method where it failed with identifiers containing dashes. +- Fixed a bug (#1452) - ``protect_identifiers()`` didn't properly detect identifiers with spaces in their names. +- Fixed a bug where ``protect_identifiers()`` ignored it's extra arguments when the value passed to it is an array. +- Fixed a bug where ``_has_operator()`` didn't detect BETWEEN. +- Fixed a bug in :doc:`Query Builder <database/query_builder>`'s ``join()`` method where it failed with identifiers containing dashes. - Fixed a bug (#1264) - :doc:`Database Forge <database/forge>` and :doc:`Database Utilities <database/utilities>` didn't update/reset the databases and tables list cache when a table or a database is created, dropped or renamed. -- Fixed a bug (#7) - :doc:`Query Builder <database/query_builder>`'s join() method only escaped one set of conditions. +- Fixed a bug (#7) - :doc:`Query Builder <database/query_builder>`'s ``join()`` method only escaped one set of conditions. - Fixed a bug (#1321) - Core Exceptions class couldn't find the errors/ folder in some cases. - Fixed a bug in the File-based :doc:`Cache Library <libraries/caching>` driver's get_metadata() method where a non-existent array key was accessed for the TTL value. - Fixed a bug (#1202) - :doc:`Encryption Library <libraries/encryption>` encode_from_legacy() didn't set back the encrypt mode on failure. @@ -346,6 +349,7 @@ Bug fixes for 3.0 - Fixed a bug in SQLSRV's ``affected_rows()`` method where an erroneous function name was used. - Fixed a bug (#1000) - Change syntax of ``$view_file`` to ``$_ci_view_file`` to prevent being overwritten by application. - Fixed a bug (#1757) - :doc:`Directory Helper <helpers/directory_helper>` function ``directory_map()`` was skipping files and directories named *0*. +- Fixed a bug (#1789) - :doc:`Database Library <libraries/database>` method ``escape_str()`` escaped quote characters in LIKE conditions twice under MySQL. Version 2.1.2 ============= |