summaryrefslogtreecommitdiffstats
path: root/system/helpers/form_helper.php
diff options
context:
space:
mode:
Diffstat (limited to 'system/helpers/form_helper.php')
-rw-r--r--system/helpers/form_helper.php116
1 files changed, 75 insertions, 41 deletions
diff --git a/system/helpers/form_helper.php b/system/helpers/form_helper.php
index fd807769a..4a4a7c89f 100644
--- a/system/helpers/form_helper.php
+++ b/system/helpers/form_helper.php
@@ -6,7 +6,7 @@
*
* This content is released under the MIT License (MIT)
*
- * Copyright (c) 2014 - 2015, British Columbia Institute of Technology
+ * Copyright (c) 2014 - 2017, British Columbia Institute of Technology
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
@@ -28,10 +28,10 @@
*
* @package CodeIgniter
* @author EllisLab Dev Team
- * @copyright Copyright (c) 2008 - 2014, EllisLab, Inc. (http://ellislab.com/)
- * @copyright Copyright (c) 2014 - 2015, British Columbia Institute of Technology (http://bcit.ca/)
+ * @copyright Copyright (c) 2008 - 2014, EllisLab, Inc. (https://ellislab.com/)
+ * @copyright Copyright (c) 2014 - 2017, British Columbia Institute of Technology (http://bcit.ca/)
* @license http://opensource.org/licenses/MIT MIT License
- * @link http://codeigniter.com
+ * @link https://codeigniter.com
* @since Version 1.0.0
* @filesource
*/
@@ -44,7 +44,7 @@ defined('BASEPATH') OR exit('No direct script access allowed');
* @subpackage Helpers
* @category Helpers
* @author EllisLab Dev Team
- * @link http://codeigniter.com/user_guide/helpers/form_helper.html
+ * @link https://codeigniter.com/user_guide/helpers/form_helper.html
*/
// ------------------------------------------------------------------------
@@ -90,18 +90,47 @@ if ( ! function_exists('form_open'))
$form = '<form action="'.$action.'"'.$attributes.">\n";
- // Add CSRF field if enabled, but leave it out for GET requests and requests to external websites
- if ($CI->config->item('csrf_protection') === TRUE && strpos($action, $CI->config->base_url()) !== FALSE && ! stripos($form, 'method="get"'))
+ if (is_array($hidden))
{
- $hidden[$CI->security->get_csrf_token_name()] = $CI->security->get_csrf_hash();
+ foreach ($hidden as $name => $value)
+ {
+ $form .= '<input type="hidden" name="'.$name.'" value="'.html_escape($value).'" />'."\n";
+ }
}
- if (is_array($hidden))
+ // Add CSRF field if enabled, but leave it out for GET requests and requests to external websites
+ if ($CI->config->item('csrf_protection') === TRUE && strpos($action, $CI->config->base_url()) !== FALSE && ! stripos($form, 'method="get"'))
{
- foreach ($hidden as $name => $value)
+ // Prepend/append random-length "white noise" around the CSRF
+ // token input, as a form of protection against BREACH attacks
+ if (FALSE !== ($noise = $CI->security->get_random_bytes(1)))
{
- $form .= '<input type="hidden" name="'.$name.'" value="'.html_escape($value).'" style="display:none;" />'."\n";
+ list(, $noise) = unpack('c', $noise);
}
+ else
+ {
+ $noise = mt_rand(-128, 127);
+ }
+
+ // Prepend if $noise has a negative value, append if positive, do nothing for zero
+ $prepend = $append = '';
+ if ($noise < 0)
+ {
+ $prepend = str_repeat(" ", abs($noise));
+ }
+ elseif ($noise > 0)
+ {
+ $append = str_repeat(" ", $noise);
+ }
+
+ $form .= sprintf(
+ '%s<input type="hidden" name="%s" value="%s" />%s%s',
+ $prepend,
+ $CI->security->get_csrf_token_name(),
+ $CI->security->get_csrf_hash(),
+ $append,
+ "\n"
+ );
}
return $form;
@@ -244,11 +273,10 @@ if ( ! function_exists('form_upload'))
* Identical to the input function but adds the "file" type
*
* @param mixed
- * @param string
* @param mixed
* @return string
*/
- function form_upload($data = '', $value = '', $extra = '')
+ function form_upload($data = '', $extra = '')
{
$defaults = array('type' => 'file', 'name' => '');
is_array($data) OR $data = array('name' => $data);
@@ -568,7 +596,7 @@ if ( ! function_exists('form_label'))
*
* @param string The text to appear onscreen
* @param string The id the label applies to
- * @param string Additional attributes
+ * @param array Additional attributes
* @return string
*/
function form_label($label_text = '', $id = '', $attributes = array())
@@ -653,25 +681,6 @@ if ( ! function_exists('form_close'))
// ------------------------------------------------------------------------
-if ( ! function_exists('form_prep'))
-{
- /**
- * Form Prep
- *
- * Formats text so that it can be safely placed in a form field in the event it has HTML tags.
- *
- * @deprecated 3.0.0 An alias for html_escape()
- * @param string|string[] $str Value to escape
- * @return string|string[] Escaped values
- */
- function form_prep($str)
- {
- return html_escape($str, TRUE);
- }
-}
-
-// ------------------------------------------------------------------------
-
if ( ! function_exists('set_value'))
{
/**
@@ -769,12 +778,11 @@ if ( ! function_exists('set_checkbox'))
{
return $CI->form_validation->set_checkbox($field, $value, $default);
}
- elseif (($input = $CI->input->post($field, FALSE)) === NULL)
- {
- return ($default === TRUE) ? ' checked="checked"' : '';
- }
+ // Form inputs are always strings ...
$value = (string) $value;
+ $input = $CI->input->post($field, FALSE);
+
if (is_array($input))
{
// Note: in_array('', array(0)) returns TRUE, do not use it
@@ -789,7 +797,13 @@ if ( ! function_exists('set_checkbox'))
return '';
}
- return ($input === $value) ? ' checked="checked"' : '';
+ // Unchecked checkbox and radio inputs are not even submitted by browsers ...
+ if ($CI->input->method() === 'post')
+ {
+ return ($input === $value) ? ' checked="checked"' : '';
+ }
+
+ return ($default === TRUE) ? ' checked="checked"' : '';
}
}
@@ -816,12 +830,32 @@ if ( ! function_exists('set_radio'))
{
return $CI->form_validation->set_radio($field, $value, $default);
}
- elseif (($input = $CI->input->post($field, FALSE)) === NULL)
+
+ // Form inputs are always strings ...
+ $value = (string) $value;
+ $input = $CI->input->post($field, FALSE);
+
+ if (is_array($input))
+ {
+ // Note: in_array('', array(0)) returns TRUE, do not use it
+ foreach ($input as &$v)
+ {
+ if ($value === $v)
+ {
+ return ' checked="checked"';
+ }
+ }
+
+ return '';
+ }
+
+ // Unchecked checkbox and radio inputs are not even submitted by browsers ...
+ if ($CI->input->method() === 'post')
{
- return ($default === TRUE) ? ' checked="checked"' : '';
+ return ($input === $value) ? ' checked="checked"' : '';
}
- return ($input === (string) $value) ? ' checked="checked"' : '';
+ return ($default === TRUE) ? ' checked="checked"' : '';
}
}
generated by cgit v1.2.3-24-g4f1b (git 2.32.0) at 2024-07-20 01:58:49 +0200