summaryrefslogtreecommitdiffstats
path: root/system/helpers
diff options
context:
space:
mode:
Diffstat (limited to 'system/helpers')
-rw-r--r--system/helpers/array_helper.php4
-rw-r--r--system/helpers/captcha_helper.php89
-rw-r--r--system/helpers/download_helper.php21
-rw-r--r--system/helpers/file_helper.php4
-rw-r--r--system/helpers/form_helper.php45
-rw-r--r--system/helpers/index.html3
-rw-r--r--system/helpers/inflector_helper.php1
-rw-r--r--system/helpers/path_helper.php2
-rw-r--r--system/helpers/string_helper.php2
-rw-r--r--system/helpers/text_helper.php2
-rw-r--r--system/helpers/url_helper.php8
11 files changed, 133 insertions, 48 deletions
diff --git a/system/helpers/array_helper.php b/system/helpers/array_helper.php
index e07b52bb5..2ce55b9c4 100644
--- a/system/helpers/array_helper.php
+++ b/system/helpers/array_helper.php
@@ -62,7 +62,7 @@ if ( ! function_exists('element'))
* @param mixed
* @return mixed depends on what the array contains
*/
- function element($item, $array, $default = NULL)
+ function element($item, array $array, $default = NULL)
{
return array_key_exists($item, $array) ? $array[$item] : $default;
}
@@ -99,7 +99,7 @@ if ( ! function_exists('elements'))
* @param mixed
* @return mixed depends on what the array contains
*/
- function elements($items, $array, $default = NULL)
+ function elements($items, array $array, $default = NULL)
{
$return = array();
diff --git a/system/helpers/captcha_helper.php b/system/helpers/captcha_helper.php
index 201987ac8..85bcfb5a0 100644
--- a/system/helpers/captcha_helper.php
+++ b/system/helpers/captcha_helper.php
@@ -125,9 +125,94 @@ if ( ! function_exists('create_captcha'))
if (empty($word))
{
$word = '';
- for ($i = 0, $mt_rand_max = strlen($pool) - 1; $i < $word_length; $i++)
+ $pool_length = strlen($pool);
+ $rand_max = $pool_length - 1;
+
+ // PHP7 or a suitable polyfill
+ if (function_exists('random_int'))
+ {
+ try
+ {
+ for ($i = 0; $i < $word_length; $i++)
+ {
+ $word .= $pool[random_int(0, $rand_max)];
+ }
+ }
+ catch (Exception $e)
+ {
+ // This means fallback to the next possible
+ // alternative to random_int()
+ $word = '';
+ }
+ }
+ }
+
+ if (empty($word))
+ {
+ // Nobody will have a larger character pool than
+ // 256 characters, but let's handle it just in case ...
+ //
+ // No, I do not care that the fallback to mt_rand() can
+ // handle it; if you trigger this, you're very obviously
+ // trying to break it. -- Narf
+ if ($pool_length > 256)
+ {
+ return FALSE;
+ }
+
+ // We'll try using the operating system's PRNG first,
+ // which we can access through CI_Security::get_random_bytes()
+ $security = get_instance()->security;
+
+ // To avoid numerous get_random_bytes() calls, we'll
+ // just try fetching as much bytes as we need at once.
+ if (($bytes = $security->get_random_bytes($pool_length)) !== FALSE)
+ {
+ $byte_index = $word_index = 0;
+ while ($word_index < $word_length)
+ {
+ if (($rand_index = unpack('C', $bytes[$byte_index++])) > $rand_max)
+ {
+ // Was this the last byte we have?
+ // If so, try to fetch more.
+ if ($byte_index === $pool_length)
+ {
+ // No failures should be possible if
+ // the first get_random_bytes() call
+ // didn't return FALSE, but still ...
+ for ($i = 0; $i < 5; $i++)
+ {
+ if (($bytes = $security->get_random_bytes($pool_length)) === FALSE)
+ {
+ continue;
+ }
+
+ $byte_index = 0;
+ break;
+ }
+
+ if ($bytes === FALSE)
+ {
+ // Sadly, this means fallback to mt_rand()
+ $word = '';
+ break;
+ }
+ }
+
+ continue;
+ }
+
+ $word .= $pool[$rand_index];
+ $word_index++;
+ }
+ }
+ }
+
+ if (empty($word))
+ {
+ for ($i = 0; $i < $word_length; $i++)
{
- $word .= $pool[mt_rand(0, $mt_rand_max)];
+ $word .= $pool[mt_rand(0, $rand_max)];
}
}
elseif ( ! is_string($word))
diff --git a/system/helpers/download_helper.php b/system/helpers/download_helper.php
index 95c94a1b8..73f6456c4 100644
--- a/system/helpers/download_helper.php
+++ b/system/helpers/download_helper.php
@@ -69,16 +69,14 @@ if ( ! function_exists('force_download'))
}
elseif ($data === NULL)
{
- if (@is_file($filename) && ($filesize = @filesize($filename)) !== FALSE)
- {
- $filepath = $filename;
- $filename = explode('/', str_replace(DIRECTORY_SEPARATOR, '/', $filename));
- $filename = end($filename);
- }
- else
+ if ( ! @is_file($filename) OR ($filesize = @filesize($filename)) === FALSE)
{
return;
}
+
+ $filepath = $filename;
+ $filename = explode('/', str_replace(DIRECTORY_SEPARATOR, '/', $filename));
+ $filename = end($filename);
}
else
{
@@ -140,14 +138,7 @@ if ( ! function_exists('force_download'))
header('Expires: 0');
header('Content-Transfer-Encoding: binary');
header('Content-Length: '.$filesize);
-
- // Internet Explorer-specific headers
- if (isset($_SERVER['HTTP_USER_AGENT']) && strpos($_SERVER['HTTP_USER_AGENT'], 'MSIE') !== FALSE)
- {
- header('Cache-Control: no-cache, no-store, must-revalidate');
- }
-
- header('Pragma: no-cache');
+ header('Cache-Control: private, no-transform, no-store, must-revalidate');
// If we have raw data - just dump it
if ($data !== NULL)
diff --git a/system/helpers/file_helper.php b/system/helpers/file_helper.php
index 8b15e60a5..f6cb1629a 100644
--- a/system/helpers/file_helper.php
+++ b/system/helpers/file_helper.php
@@ -54,7 +54,7 @@ if ( ! function_exists('read_file'))
/**
* Read File
*
- * Opens the file specfied in the path and returns it as a string.
+ * Opens the file specified in the path and returns it as a string.
*
* @todo Remove in version 3.1+.
* @deprecated 3.0.0 It is now just an alias for PHP's native file_get_contents().
@@ -343,7 +343,7 @@ if ( ! function_exists('get_mime_by_extension'))
if ( ! is_array($mimes))
{
- $mimes =& get_mimes();
+ $mimes = get_mimes();
if (empty($mimes))
{
diff --git a/system/helpers/form_helper.php b/system/helpers/form_helper.php
index 53ee8eb11..fd807769a 100644
--- a/system/helpers/form_helper.php
+++ b/system/helpers/form_helper.php
@@ -197,7 +197,7 @@ if ( ! function_exists('form_input'))
*
* @param mixed
* @param string
- * @param string
+ * @param mixed
* @return string
*/
function form_input($data = '', $value = '', $extra = '')
@@ -208,7 +208,7 @@ if ( ! function_exists('form_input'))
'value' => $value
);
- return '<input '._parse_form_attributes($data, $defaults).$extra." />\n";
+ return '<input '._parse_form_attributes($data, $defaults)._attributes_to_string($extra)." />\n";
}
}
@@ -223,7 +223,7 @@ if ( ! function_exists('form_password'))
*
* @param mixed
* @param string
- * @param string
+ * @param mixed
* @return string
*/
function form_password($data = '', $value = '', $extra = '')
@@ -245,7 +245,7 @@ if ( ! function_exists('form_upload'))
*
* @param mixed
* @param string
- * @param string
+ * @param mixed
* @return string
*/
function form_upload($data = '', $value = '', $extra = '')
@@ -253,7 +253,8 @@ if ( ! function_exists('form_upload'))
$defaults = array('type' => 'file', 'name' => '');
is_array($data) OR $data = array('name' => $data);
$data['type'] = 'file';
- return '<input '._parse_form_attributes($data, $defaults).$extra." />\n";
+
+ return '<input '._parse_form_attributes($data, $defaults)._attributes_to_string($extra)." />\n";
}
}
@@ -266,7 +267,7 @@ if ( ! function_exists('form_textarea'))
*
* @param mixed $data
* @param string $value
- * @param string $extra
+ * @param mixed $extra
* @return string
*/
function form_textarea($data = '', $value = '', $extra = '')
@@ -287,7 +288,9 @@ if ( ! function_exists('form_textarea'))
unset($data['value']); // textareas don't use the value attribute
}
- return '<textarea '._parse_form_attributes($data, $defaults).$extra.'>'.html_escape($val)."</textarea>\n";
+ return '<textarea '._parse_form_attributes($data, $defaults)._attributes_to_string($extra).'>'
+ .html_escape($val)
+ ."</textarea>\n";
}
}
@@ -301,12 +304,13 @@ if ( ! function_exists('form_multiselect'))
* @param string
* @param array
* @param mixed
- * @param string
+ * @param mixed
* @return string
*/
function form_multiselect($name = '', $options = array(), $selected = array(), $extra = '')
{
- if ( ! strpos($extra, 'multiple'))
+ $extra = _attributes_to_string($extra);
+ if (stripos($extra, 'multiple') === FALSE)
{
$extra .= ' multiple="multiple"';
}
@@ -372,7 +376,7 @@ if ( ! function_exists('form_dropdown'))
$extra = _attributes_to_string($extra);
- $multiple = (count($selected) > 1 && strpos($extra, 'multiple') === FALSE) ? ' multiple="multiple"' : '';
+ $multiple = (count($selected) > 1 && stripos($extra, 'multiple') === FALSE) ? ' multiple="multiple"' : '';
$form = '<select '.rtrim(_parse_form_attributes($data, $defaults)).$extra.$multiple.">\n";
@@ -420,7 +424,7 @@ if ( ! function_exists('form_checkbox'))
* @param mixed
* @param string
* @param bool
- * @param string
+ * @param mixed
* @return string
*/
function form_checkbox($data = '', $value = '', $checked = FALSE, $extra = '')
@@ -450,7 +454,7 @@ if ( ! function_exists('form_checkbox'))
unset($defaults['checked']);
}
- return '<input '._parse_form_attributes($data, $defaults).$extra." />\n";
+ return '<input '._parse_form_attributes($data, $defaults)._attributes_to_string($extra)." />\n";
}
}
@@ -464,13 +468,14 @@ if ( ! function_exists('form_radio'))
* @param mixed
* @param string
* @param bool
- * @param string
+ * @param mixed
* @return string
*/
function form_radio($data = '', $value = '', $checked = FALSE, $extra = '')
{
is_array($data) OR $data = array('name' => $data);
$data['type'] = 'radio';
+
return form_checkbox($data, $value, $checked, $extra);
}
}
@@ -484,7 +489,7 @@ if ( ! function_exists('form_submit'))
*
* @param mixed
* @param string
- * @param string
+ * @param mixed
* @return string
*/
function form_submit($data = '', $value = '', $extra = '')
@@ -495,7 +500,7 @@ if ( ! function_exists('form_submit'))
'value' => $value
);
- return '<input '._parse_form_attributes($data, $defaults).$extra." />\n";
+ return '<input '._parse_form_attributes($data, $defaults)._attributes_to_string($extra)." />\n";
}
}
@@ -508,7 +513,7 @@ if ( ! function_exists('form_reset'))
*
* @param mixed
* @param string
- * @param string
+ * @param mixed
* @return string
*/
function form_reset($data = '', $value = '', $extra = '')
@@ -519,7 +524,7 @@ if ( ! function_exists('form_reset'))
'value' => $value
);
- return '<input '._parse_form_attributes($data, $defaults).$extra." />\n";
+ return '<input '._parse_form_attributes($data, $defaults)._attributes_to_string($extra)." />\n";
}
}
@@ -532,7 +537,7 @@ if ( ! function_exists('form_button'))
*
* @param mixed
* @param string
- * @param string
+ * @param mixed
* @return string
*/
function form_button($data = '', $content = '', $extra = '')
@@ -548,7 +553,9 @@ if ( ! function_exists('form_button'))
unset($data['content']); // content is not an attribute
}
- return '<button '._parse_form_attributes($data, $defaults).$extra.'>'.$content."</button>\n";
+ return '<button '._parse_form_attributes($data, $defaults)._attributes_to_string($extra).'>'
+ .$content
+ ."</button>\n";
}
}
diff --git a/system/helpers/index.html b/system/helpers/index.html
index c942a79ce..b702fbc39 100644
--- a/system/helpers/index.html
+++ b/system/helpers/index.html
@@ -1,3 +1,4 @@
+<!DOCTYPE html>
<html>
<head>
<title>403 Forbidden</title>
@@ -7,4 +8,4 @@
<p>Directory access is forbidden.</p>
</body>
-</html> \ No newline at end of file
+</html>
diff --git a/system/helpers/inflector_helper.php b/system/helpers/inflector_helper.php
index d8ed45df9..f2890059f 100644
--- a/system/helpers/inflector_helper.php
+++ b/system/helpers/inflector_helper.php
@@ -133,6 +133,7 @@ if ( ! function_exists('plural'))
}
$plural_rules = array(
+ '/(quiz)$/' => '\1zes', // quizzes
'/^(ox)$/' => '\1\2en', // ox
'/([m|l])ouse$/' => '\1ice', // mouse, louse
'/(matr|vert|ind)ix|ex$/' => '\1ices', // matrix, vertex, index
diff --git a/system/helpers/path_helper.php b/system/helpers/path_helper.php
index c23ec6435..c96d0b8b3 100644
--- a/system/helpers/path_helper.php
+++ b/system/helpers/path_helper.php
@@ -61,7 +61,7 @@ if ( ! function_exists('set_realpath'))
function set_realpath($path, $check_existance = FALSE)
{
// Security check to make sure the path is NOT a URL. No remote file inclusion!
- if (preg_match('#^(http:\/\/|https:\/\/|www\.|ftp|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})#i', $path))
+ if (preg_match('#^(http:\/\/|https:\/\/|www\.|ftp)#i', $path) OR filter_var($path, FILTER_VALIDATE_IP) === $path )
{
show_error('The path you submitted must be a local server path, not a URL');
}
diff --git a/system/helpers/string_helper.php b/system/helpers/string_helper.php
index 5860e15fb..637835160 100644
--- a/system/helpers/string_helper.php
+++ b/system/helpers/string_helper.php
@@ -253,7 +253,7 @@ if ( ! function_exists('increment_string'))
*/
function increment_string($str, $separator = '_', $first = 1)
{
- preg_match('/(.+)'.$separator.'([0-9]+)$/', $str, $match);
+ preg_match('/(.+)'.preg_quote($separator, '/').'([0-9]+)$/', $str, $match);
return isset($match[2]) ? $match[1].$separator.($match[2] + 1) : $str.$separator.$first;
}
}
diff --git a/system/helpers/text_helper.php b/system/helpers/text_helper.php
index f2290c895..fb47036f2 100644
--- a/system/helpers/text_helper.php
+++ b/system/helpers/text_helper.php
@@ -254,7 +254,7 @@ if ( ! function_exists('word_censor'))
* word you've submitted.
*
* @param string the text string
- * @param string the array of censoered words
+ * @param string the array of censored words
* @param string the optional replacement value
* @return string
*/
diff --git a/system/helpers/url_helper.php b/system/helpers/url_helper.php
index bf623b000..d65f92f1b 100644
--- a/system/helpers/url_helper.php
+++ b/system/helpers/url_helper.php
@@ -161,7 +161,7 @@ if ( ! function_exists('anchor'))
$site_url = is_array($uri)
? site_url($uri)
- : preg_match('#^(\w+:)?//#i', $uri) ? $uri : site_url($uri);
+ : (preg_match('#^(\w+:)?//#i', $uri) ? $uri : site_url($uri));
if ($title === '')
{
@@ -474,7 +474,7 @@ if ( ! function_exists('url_title'))
* @param string $str Input string
* @param string $separator Word separator
* (usually '-' or '_')
- * @param bool $lowercase Wether to transform the output string to lowercase
+ * @param bool $lowercase Whether to transform the output string to lowercase
* @return string
*/
function url_title($str, $separator = '-', $lowercase = FALSE)
@@ -492,7 +492,7 @@ if ( ! function_exists('url_title'))
$trans = array(
'&.+?;' => '',
- '[^a-z0-9 _-]' => '',
+ '[^\w\d _-]' => '',
'\s+' => $separator,
'('.$q_separator.')+' => $separator
);
@@ -500,7 +500,7 @@ if ( ! function_exists('url_title'))
$str = strip_tags($str);
foreach ($trans as $key => $val)
{
- $str = preg_replace('#'.$key.'#i', $val, $str);
+ $str = preg_replace('#'.$key.'#i'.(UTF8_ENABLED ? 'u' : ''), $val, $str);
}
if ($lowercase === TRUE)
generated by cgit v1.2.3-24-g4f1b (git 2.32.0) at 2024-11-15 03:15:06 +0100