summaryrefslogtreecommitdiffstats
path: root/system/core
diff options
context:
space:
mode:
Diffstat (limited to 'system/core')
-rw-r--r--system/core/Common.php5
-rw-r--r--system/core/Input.php49
-rw-r--r--system/core/Log.php2
-rw-r--r--system/core/Output.php12
-rw-r--r--system/core/Security.php40
5 files changed, 86 insertions, 22 deletions
diff --git a/system/core/Common.php b/system/core/Common.php
index 9e23a4ea5..a9b8828e3 100644
--- a/system/core/Common.php
+++ b/system/core/Common.php
@@ -778,11 +778,9 @@ if ( ! function_exists('_stringify_attributes'))
*/
function _stringify_attributes($attributes, $js = FALSE)
{
- $atts = NULL;
-
if (empty($attributes))
{
- return $atts;
+ return NULL;
}
if (is_string($attributes))
@@ -792,6 +790,7 @@ if ( ! function_exists('_stringify_attributes'))
$attributes = (array) $attributes;
+ $atts = '';
foreach ($attributes as $key => $val)
{
$atts .= ($js) ? $key.'='.$val.',' : ' '.$key.'="'.$val.'"';
diff --git a/system/core/Input.php b/system/core/Input.php
index 3fb4121eb..47bdbfc5d 100644
--- a/system/core/Input.php
+++ b/system/core/Input.php
@@ -357,14 +357,15 @@ class CI_Input {
* @param string $prefix Cookie name prefix
* @param bool $secure Whether to only transfer cookies via SSL
* @param bool $httponly Whether to only makes the cookie accessible via HTTP (no javascript)
+ * @param string $samesite SameSite attribute
* @return void
*/
- public function set_cookie($name, $value = '', $expire = '', $domain = '', $path = '/', $prefix = '', $secure = NULL, $httponly = NULL)
+ public function set_cookie($name, $value = '', $expire = '', $domain = '', $path = '/', $prefix = '', $secure = NULL, $httponly = NULL, $samesite = NULL)
{
if (is_array($name))
{
// always leave 'name' in last place, as the loop will break otherwise, due to $$item
- foreach (array('value', 'expire', 'domain', 'path', 'prefix', 'secure', 'httponly', 'name') as $item)
+ foreach (array('value', 'expire', 'domain', 'path', 'prefix', 'secure', 'httponly', 'name', 'samesite') as $item)
{
if (isset($name[$item]))
{
@@ -405,7 +406,47 @@ class CI_Input {
$expire = ($expire > 0) ? time() + $expire : 0;
}
- setcookie($prefix.$name, $value, $expire, $path, $domain, $secure, $httponly);
+ isset($samesite) OR $samesite = config_item('cookie_samesite');
+ if (isset($samesite))
+ {
+ $samesite = ucfirst(strtolower($samesite));
+ in_array($samesite, array('Lax', 'Strict', 'None'), TRUE) OR $samesite = 'Lax';
+ }
+ else
+ {
+ $samesite = 'Lax';
+ }
+
+ if ($samesite === 'None' && ! $secure)
+ {
+ log_message('error', $name.' cookie sent with SameSite=None, but without Secure attribute.');
+ }
+
+ if ( ! is_php('7.3'))
+ {
+ $maxage = $expire - time();
+ if ($maxage < 1)
+ {
+ $maxage = 0;
+ }
+
+ $cookie_header = 'Set-Cookie: '.$prefix.$name.'='.rawurlencode($value);
+ $cookie_header .= ($expire === 0 ? '' : '; Expires='.gmdate('D, d-M-Y H:i:s T', $expire)).'; Max-Age='.$maxage;
+ $cookie_header .= '; Path='.$path.($domain !== '' ? '; Domain='.$domain : '');
+ $cookie_header .= ($secure ? '; Secure' : '').($httponly ? '; HttpOnly' : '').'; SameSite='.$samesite;
+ header($cookie_header);
+ return;
+ }
+
+ $setcookie_options = array(
+ 'expires' => $expire,
+ 'path' => $path,
+ 'domain' => $domain,
+ 'secure' => $secure,
+ 'httponly' => $httponly,
+ 'samesite' => $samesite,
+ );
+ setcookie($prefix.$name, $value, $setcookie_options);
}
// --------------------------------------------------------------------
@@ -565,7 +606,7 @@ class CI_Input {
$which = FILTER_FLAG_IPV6;
break;
default:
- $which = NULL;
+ $which = 0;
break;
}
diff --git a/system/core/Log.php b/system/core/Log.php
index f66f1aa48..683c16bac 100644
--- a/system/core/Log.php
+++ b/system/core/Log.php
@@ -122,7 +122,7 @@ class CI_Log {
{
$config =& get_config();
- isset(self::$func_overload) OR self::$func_overload = (extension_loaded('mbstring') && ini_get('mbstring.func_overload'));
+ isset(self::$func_overload) OR self::$func_overload = ( ! is_php('8.0') && extension_loaded('mbstring') && @ini_get('mbstring.func_overload'));
$this->_log_path = ($config['log_path'] !== '') ? $config['log_path'] : APPPATH.'logs/';
$this->_file_ext = (isset($config['log_file_extension']) && $config['log_file_extension'] !== '')
diff --git a/system/core/Output.php b/system/core/Output.php
index cef092600..8e3245b79 100644
--- a/system/core/Output.php
+++ b/system/core/Output.php
@@ -145,7 +145,7 @@ class CI_Output {
&& extension_loaded('zlib')
);
- isset(self::$func_overload) OR self::$func_overload = (extension_loaded('mbstring') && ini_get('mbstring.func_overload'));
+ isset(self::$func_overload) OR self::$func_overload = ( ! is_php('8.0') && extension_loaded('mbstring') && @ini_get('mbstring.func_overload'));
// Get mime types for later
$this->mimes =& get_mimes();
@@ -299,10 +299,14 @@ class CI_Output {
*/
public function get_header($header)
{
- // Combine headers already sent with our batched headers
+ // We only need [x][0] from our multi-dimensional array
+ $header_lines = array_map(function ($headers)
+ {
+ return array_shift($headers);
+ }, $this->headers);
+
$headers = array_merge(
- // We only need [x][0] from our multi-dimensional array
- array_map('array_shift', $this->headers),
+ $header_lines,
headers_list()
);
diff --git a/system/core/Security.php b/system/core/Security.php
index e1dc2a92f..d1d4f8432 100644
--- a/system/core/Security.php
+++ b/system/core/Security.php
@@ -193,7 +193,7 @@ class CI_Security {
$this->_csrf_set_hash();
}
- $this->charset = strtoupper(config_item('charset'));
+ $this->charset = strtoupper((string) config_item('charset'));
log_message('info', 'Security Class Initialized');
}
@@ -272,15 +272,35 @@ class CI_Security {
return FALSE;
}
- setcookie(
- $this->_csrf_cookie_name,
- $this->_csrf_hash,
- $expire,
- config_item('cookie_path'),
- config_item('cookie_domain'),
- $secure_cookie,
- config_item('cookie_httponly')
- );
+ if (is_php('7.3'))
+ {
+ setcookie(
+ $this->_csrf_cookie_name,
+ $this->_csrf_hash,
+ array(
+ 'expires' => $expire,
+ 'path' => config_item('cookie_path'),
+ 'domain' => config_item('cookie_domain'),
+ 'secure' => $secure_cookie,
+ 'httponly' => config_item('cookie_httponly'),
+ 'samesite' => 'Strict'
+ )
+ );
+ }
+ else
+ {
+ $domain = trim(config_item('cookie_domain'));
+ header('Set-Cookie: '.$this->_csrf_cookie_name.'='.$this->_csrf_hash
+ .'; Expires='.gmdate('D, d-M-Y H:i:s T', $expire)
+ .'; Max-Age='.$this->_csrf_expire
+ .'; Path='.rawurlencode(config_item('cookie_path'))
+ .($domain === '' ? '' : '; Domain='.$domain)
+ .($secure_cookie ? '; Secure' : '')
+ .(config_item('cookie_httponly') ? '; HttpOnly' : '')
+ .'; SameSite=Strict'
+ );
+ }
+
log_message('info', 'CSRF cookie sent');
return $this;
generated by cgit v1.2.3-24-g4f1b (git 2.32.0) at 2024-06-10 15:46:18 +0200