summaryrefslogtreecommitdiffstats
path: root/system
diff options
context:
space:
mode:
Diffstat (limited to 'system')
-rw-r--r--system/core/CodeIgniter.php7
-rw-r--r--system/core/Common.php35
-rw-r--r--system/core/Exceptions.php2
-rw-r--r--system/core/Input.php31
-rw-r--r--system/core/Loader.php2
-rw-r--r--system/core/Log.php3
-rw-r--r--system/core/Output.php37
-rw-r--r--system/database/DB_query_builder.php4
-rw-r--r--system/database/drivers/mysqli/mysqli_driver.php27
-rw-r--r--system/database/drivers/pdo/subdrivers/pdo_pgsql_driver.php4
-rw-r--r--system/database/drivers/postgre/postgre_driver.php12
-rw-r--r--system/helpers/form_helper.php118
-rw-r--r--system/libraries/Email.php3
-rw-r--r--system/libraries/Upload.php2
14 files changed, 159 insertions, 128 deletions
diff --git a/system/core/CodeIgniter.php b/system/core/CodeIgniter.php
index c962fda20..c12116236 100644
--- a/system/core/CodeIgniter.php
+++ b/system/core/CodeIgniter.php
@@ -73,11 +73,10 @@ defined('BASEPATH') OR exit('No direct script access allowed');
* ------------------------------------------------------
*/
set_error_handler('_exception_handler');
+ register_shutdown_function('_shutdown_handler');
- if ( ! is_php('5.4'))
- {
- @ini_set('magic_quotes_runtime', 0); // Kill magic quotes
- }
+ // Kill magic quotes
+ is_php('5.4') OR @ini_set('magic_quotes_runtime', 0);
/*
* ------------------------------------------------------
diff --git a/system/core/Common.php b/system/core/Common.php
index 7f296b133..c25707e50 100644
--- a/system/core/Common.php
+++ b/system/core/Common.php
@@ -82,7 +82,7 @@ if ( ! function_exists('is_really_writable'))
function is_really_writable($file)
{
// If we're on a Unix server with safe_mode off we call is_writable
- if (DIRECTORY_SEPARATOR === '/' && (bool) @ini_get('safe_mode') === FALSE)
+ if (DIRECTORY_SEPARATOR === '/' && (is_php('5.4') OR (bool) @ini_get('safe_mode') === FALSE))
{
return is_writable($file);
}
@@ -429,10 +429,9 @@ if ( ! function_exists('log_message'))
*
* @param string the error level: 'error', 'debug' or 'info'
* @param string the error message
- * @param bool whether the error is a native PHP error
* @return void
*/
- function log_message($level, $message, $php_error = FALSE)
+ function log_message($level, $message)
{
static $_log;
@@ -442,7 +441,7 @@ if ( ! function_exists('log_message'))
$_log[0] =& load_class('Log', 'core');
}
- $_log[0]->write_log($level, $message, $php_error);
+ $_log[0]->write_log($level, $message);
}
}
@@ -577,6 +576,34 @@ if ( ! function_exists('_exception_handler'))
}
}
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('_shutdown_handler'))
+{
+ /**
+ * Shutdown Handler
+ *
+ * This is the shutdown handler that is declared at the top
+ * of CodeIgniter.php. The main reason we use this is to simulate
+ * a complete custom exception handler.
+ *
+ * E_STRICT is purposivly neglected because such events may have
+ * been caught. Duplication or none? None is preferred for now.
+ *
+ * @link http://insomanic.me.uk/post/229851073/php-trick-catching-fatal-errors-e-error-with-a
+ * @return void
+ */
+ function _shutdown_handler()
+ {
+ $last_error = function_exists('error_get_last') ? error_get_last() : NULL;
+ if (isset($last_error) &&
+ ($last_error['type'] & (E_ERROR | E_PARSE | E_CORE_ERROR | E_CORE_WARNING | E_COMPILE_ERROR | E_COMPILE_WARNING)))
+ {
+ _exception_handler($last_error['type'], $last_error['message'], $last_error['file'], $last_error['line']);
+ }
+ }
+}
+
// --------------------------------------------------------------------
if ( ! function_exists('remove_invisible_characters'))
diff --git a/system/core/Exceptions.php b/system/core/Exceptions.php
index 9c68d06a5..d7e5ed4d9 100644
--- a/system/core/Exceptions.php
+++ b/system/core/Exceptions.php
@@ -91,7 +91,7 @@ class CI_Exceptions {
public function log_exception($severity, $message, $filepath, $line)
{
$severity = isset($this->levels[$severity]) ? $this->levels[$severity] : $severity;
- log_message('error', 'Severity: '.$severity.' --> '.$message. ' '.$filepath.' '.$line, TRUE);
+ log_message('error', 'Severity: '.$severity.' --> '.$message. ' '.$filepath.' '.$line);
}
// --------------------------------------------------------------------
diff --git a/system/core/Input.php b/system/core/Input.php
index 24e21ea08..8c32e459e 100644
--- a/system/core/Input.php
+++ b/system/core/Input.php
@@ -693,7 +693,14 @@ class CI_Input {
foreach ($_COOKIE as $key => $val)
{
- $_COOKIE[$this->_clean_input_keys($key)] = $this->_clean_input_data($val);
+ if (($cookie_key = $this->_clean_input_keys($key)) !== FALSE)
+ {
+ $_COOKIE[$cookie_key] = $this->_clean_input_data($val);
+ }
+ else
+ {
+ unset($_COOKIE[$key]);
+ }
}
}
@@ -706,7 +713,7 @@ class CI_Input {
$this->security->csrf_verify();
}
- log_message('debug', 'Global POST and COOKIE data sanitized');
+ log_message('debug', 'Global POST, GET and COOKIE data sanitized');
}
// --------------------------------------------------------------------
@@ -776,15 +783,25 @@ class CI_Input {
* only named with alpha-numeric text and a few other items.
*
* @param string $str Input string
- * @return string
+ * @param string $fatal Whether to terminate script exection
+ * or to return FALSE if an invalid
+ * key is encountered
+ * @return string|bool
*/
- protected function _clean_input_keys($str)
+ protected function _clean_input_keys($str, $fatal = TRUE)
{
if ( ! preg_match('/^[a-z0-9:_\/|-]+$/i', $str))
{
- set_status_header(503);
- echo 'Disallowed Key Characters.';
- exit(EXIT_USER_INPUT);
+ if ($fatal === TRUE)
+ {
+ return FALSE;
+ }
+ else
+ {
+ set_status_header(503);
+ echo 'Disallowed Key Characters.';
+ exit(EXIT_USER_INPUT);
+ }
}
// Clean UTF-8 if supported
diff --git a/system/core/Loader.php b/system/core/Loader.php
index 1709c2db1..2eef9979c 100644
--- a/system/core/Loader.php
+++ b/system/core/Loader.php
@@ -222,7 +222,7 @@ class CI_Loader {
{
foreach ($model as $key => $value)
{
- $this->model(is_int($key) ? $value : $key, $value);
+ is_int($key) ? $this->model($value, '', $db_conn) : $this->model($key, $value, $db_conn);
}
return;
}
diff --git a/system/core/Log.php b/system/core/Log.php
index e4d72b544..b2327b8f0 100644
--- a/system/core/Log.php
+++ b/system/core/Log.php
@@ -140,10 +140,9 @@ class CI_Log {
*
* @param string the error level: 'error', 'debug' or 'info'
* @param string the error message
- * @param bool whether the error is a native PHP error
* @return bool
*/
- public function write_log($level, $msg, $php_error = FALSE)
+ public function write_log($level, $msg)
{
if ($this->_enabled === FALSE)
{
diff --git a/system/core/Output.php b/system/core/Output.php
index 06d7a866b..7c2a64d24 100644
--- a/system/core/Output.php
+++ b/system/core/Output.php
@@ -841,14 +841,43 @@ class CI_Output {
$output = substr_replace($output, '', 0, $pos);
// Remove closing tag and save it for later
- $pos = strpos($output, '</');
- $closing_tag = substr($output, $pos, strlen($output));
+ $pos = strrpos($output, '</');
+ $closing_tag = substr($output, $pos);
$output = substr_replace($output, '', $pos);
}
// Remove CSS comments
$output = preg_replace('!/\*[^*]*\*+([^/][^*]*\*+)*/!i', '', $output);
+ // Remove Javascript inline comments
+ if ($has_tags === TRUE && strpos(strtolower($open_tag), 'script') !== FALSE)
+ {
+ $lines = preg_split('/\r?\n|\n?\r/', $output);
+ foreach ($lines as &$line)
+ {
+ $in_string = $in_dstring = FALSE;
+ for ($i = 0, $len = strlen($line); $i < $len; $i++)
+ {
+ if ( ! $in_string && ! $in_dstring && substr($line, $i, 2) === '//')
+ {
+ $line = substr($line, 0, $i);
+ break;
+ }
+
+ if ($line[$i] === "'" && ! $in_dstring)
+ {
+ $in_string = ! $in_string;
+ }
+ elseif ($line[$i] === '"' && ! $in_string)
+ {
+ $in_dstring = ! $in_dstring;
+ }
+ }
+ }
+
+ $output = implode("\n", $lines);
+ }
+
// Remove spaces around curly brackets, colons,
// semi-colons, parenthesis, commas
$chunks = preg_split('/([\'|"]).+(?![^\\\]\\1)\\1/iU', $output, -1, PREG_SPLIT_OFFSET_CAPTURE);
@@ -899,11 +928,11 @@ class CI_Output {
}
}
- if ($value === "'")
+ if ($value === "'" && ! $in_dstring)
{
$in_string = ! $in_string;
}
- elseif ($value === '"')
+ elseif ($value === '"' && ! $in_string)
{
$in_dstring = ! $in_dstring;
}
diff --git a/system/database/DB_query_builder.php b/system/database/DB_query_builder.php
index e6a108209..a36501eb6 100644
--- a/system/database/DB_query_builder.php
+++ b/system/database/DB_query_builder.php
@@ -1138,7 +1138,7 @@ abstract class CI_DB_query_builder extends CI_DB_driver {
* ORDER BY
*
* @param string $orderby
- * @param string $direction ASC or DESC
+ * @param string $direction ASC, DESC or RANDOM
* @param bool $escape
* @return CI_DB_query_builder
*/
@@ -1152,7 +1152,7 @@ abstract class CI_DB_query_builder extends CI_DB_driver {
// Do we have a seed value?
$orderby = ctype_digit((string) $orderby)
- ? $orderby = sprintf($this->_random_keyword[1], $orderby)
+ ? sprintf($this->_random_keyword[1], $orderby)
: $this->_random_keyword[0];
}
elseif (empty($orderby))
diff --git a/system/database/drivers/mysqli/mysqli_driver.php b/system/database/drivers/mysqli/mysqli_driver.php
index ef2cb8a8d..0f3c6fc62 100644
--- a/system/database/drivers/mysqli/mysqli_driver.php
+++ b/system/database/drivers/mysqli/mysqli_driver.php
@@ -241,9 +241,10 @@ class CI_DB_mysqli_driver extends CI_DB {
// even if the queries produce a successful result.
$this->_trans_failure = ($test_mode === TRUE);
- $this->simple_query('SET AUTOCOMMIT=0');
- $this->simple_query('START TRANSACTION'); // can also be BEGIN or BEGIN WORK
- return TRUE;
+ $this->conn_id->autocommit(FALSE);
+ return is_php('5.5')
+ ? $this->conn_id->begin_transaction()
+ : $this->simple_query('START TRANSACTION'); // can also be BEGIN or BEGIN WORK
}
// --------------------------------------------------------------------
@@ -261,9 +262,13 @@ class CI_DB_mysqli_driver extends CI_DB {
return TRUE;
}
- $this->simple_query('COMMIT');
- $this->simple_query('SET AUTOCOMMIT=1');
- return TRUE;
+ if ($this->conn_id->commit())
+ {
+ $this->conn_id->autocommit(TRUE);
+ return TRUE;
+ }
+
+ return FALSE;
}
// --------------------------------------------------------------------
@@ -281,9 +286,13 @@ class CI_DB_mysqli_driver extends CI_DB {
return TRUE;
}
- $this->simple_query('ROLLBACK');
- $this->simple_query('SET AUTOCOMMIT=1');
- return TRUE;
+ if ($this->conn_id->rollback())
+ {
+ $this->conn_id->autocommit(TRUE);
+ return TRUE;
+ }
+
+ return FALSE;
}
// --------------------------------------------------------------------
diff --git a/system/database/drivers/pdo/subdrivers/pdo_pgsql_driver.php b/system/database/drivers/pdo/subdrivers/pdo_pgsql_driver.php
index d0cdde2e2..fda3f238b 100644
--- a/system/database/drivers/pdo/subdrivers/pdo_pgsql_driver.php
+++ b/system/database/drivers/pdo/subdrivers/pdo_pgsql_driver.php
@@ -137,7 +137,7 @@ class CI_DB_pdo_pgsql_driver extends CI_DB_pdo_driver {
*/
public function is_write_type($sql)
{
- return (bool) preg_match('/^\s*"?(SET|INSERT(?![^\)]+\)\s+RETURNING)|UPDATE|DELETE|REPLACE|CREATE|DROP|TRUNCATE|LOAD|COPY|ALTER|RENAME|GRANT|REVOKE|LOCK|UNLOCK|REINDEX)\s+/i', $sql);
+ return (bool) preg_match('/^\s*"?(SET|INSERT(?![^\)]+\)\s+RETURNING)|UPDATE(?!.*\sRETURNING)|DELETE|CREATE|DROP|TRUNCATE|LOAD|COPY|ALTER|RENAME|GRANT|REVOKE|LOCK|UNLOCK|REINDEX)\s+/i', str_replace(array("\r\n", "\r", "\n"), ' ', $sql));
}
// --------------------------------------------------------------------
@@ -166,7 +166,7 @@ class CI_DB_pdo_pgsql_driver extends CI_DB_pdo_driver {
* ORDER BY
*
* @param string $orderby
- * @param string $direction ASC or DESC
+ * @param string $direction ASC, DESC or RANDOM
* @param bool $escape
* @return object
*/
diff --git a/system/database/drivers/postgre/postgre_driver.php b/system/database/drivers/postgre/postgre_driver.php
index ac7345ad6..b72fb873a 100644
--- a/system/database/drivers/postgre/postgre_driver.php
+++ b/system/database/drivers/postgre/postgre_driver.php
@@ -318,7 +318,7 @@ class CI_DB_postgre_driver extends CI_DB {
*/
public function is_write_type($sql)
{
- return (bool) preg_match('/^\s*"?(SET|INSERT(?![^\)]+\)\s+RETURNING)|UPDATE|DELETE|REPLACE|CREATE|DROP|TRUNCATE|LOAD|COPY|ALTER|RENAME|GRANT|REVOKE|LOCK|UNLOCK|REINDEX)\s+/i', $sql);
+ return (bool) preg_match('/^\s*"?(SET|INSERT(?![^\)]+\)\s+RETURNING)|UPDATE(?!.*\sRETURNING)|DELETE|CREATE|DROP|TRUNCATE|LOAD|COPY|ALTER|RENAME|GRANT|REVOKE|LOCK|UNLOCK|REINDEX)\s+/i', str_replace(array("\r\n", "\r", "\n"), ' ', $sql));
}
// --------------------------------------------------------------------
@@ -331,7 +331,7 @@ class CI_DB_postgre_driver extends CI_DB {
*/
protected function _escape_str($str)
{
- return pg_escape_string($str);
+ return pg_escape_string($this->conn_id, $str);
}
// --------------------------------------------------------------------
@@ -346,7 +346,11 @@ class CI_DB_postgre_driver extends CI_DB {
*/
public function escape($str)
{
- if (is_bool($str))
+ if (is_php('5.4.4') && (is_string($str) OR (is_object($str) && method_exists($str, '__toString'))))
+ {
+ return pg_escape_literal($this->conn_id, $str);
+ }
+ elseif (is_bool($str))
{
return ($str) ? 'TRUE' : 'FALSE';
}
@@ -512,7 +516,7 @@ class CI_DB_postgre_driver extends CI_DB {
* ORDER BY
*
* @param string $orderby
- * @param string $direction ASC or DESC
+ * @param string $direction ASC, DESC or RANDOM
* @param bool $escape
* @return object
*/
diff --git a/system/helpers/form_helper.php b/system/helpers/form_helper.php
index 146c0f588..0cc5bd157 100644
--- a/system/helpers/form_helper.php
+++ b/system/helpers/form_helper.php
@@ -675,37 +675,22 @@ if ( ! function_exists('set_select'))
*/
function set_select($field = '', $value = '', $default = FALSE)
{
- $OBJ =& _get_validation_object();
+ $CI =& get_instance();
- if ($OBJ === FALSE)
+ if (isset($CI->form_validation) && is_object($CI->form_validation) && $CI->form_validation->has_rule($field))
+ {
+ return $CI->form_validation->set_select($field, $value, $default);
+ }
+ elseif (($input = $CI->input->post($field, FALSE)) === NULL)
+ {
+ return ($default === TRUE) ? ' selected="selected"' : '';
+ }
+ elseif (is_array($input) && in_array($value, $input, TRUE))
{
- if ( ! isset($_POST[$field]))
- {
- if (count($_POST) === 0 && $default === TRUE)
- {
- return ' selected="selected"';
- }
- return '';
- }
-
- $field = $_POST[$field];
-
- if (is_array($field))
- {
- if ( ! in_array($value, $field))
- {
- return '';
- }
- }
- elseif (($field == '' OR $value == '') OR $field !== $value)
- {
- return '';
- }
-
return ' selected="selected"';
}
- return $OBJ->set_select($field, $value, $default);
+ return ($input === $value) ? ' selected="selected"' : '';
}
}
@@ -726,37 +711,22 @@ if ( ! function_exists('set_checkbox'))
*/
function set_checkbox($field = '', $value = '', $default = FALSE)
{
- $OBJ =& _get_validation_object();
+ $CI =& get_instance();
- if ($OBJ === FALSE)
+ if (isset($CI->form_validation) && is_object($CI->form_validation) && $CI->form_validation->has_rule($field))
+ {
+ return $CI->form_validation->set_checkbox($field, $value, $default);
+ }
+ elseif (($input = $CI->input->post($field, FALSE)) === NULL)
+ {
+ return ($default === TRUE) ? ' checked="checked"' : '';
+ }
+ elseif (is_array($input) && in_array($value, $input, TRUE))
{
- if ( ! isset($_POST[$field]))
- {
- if (count($_POST) === 0 && $default === TRUE)
- {
- return ' checked="checked"';
- }
- return '';
- }
-
- $field = $_POST[$field];
-
- if (is_array($field))
- {
- if ( ! in_array($value, $field))
- {
- return '';
- }
- }
- elseif (($field == '' OR $value == '') OR $field !== $value)
- {
- return '';
- }
-
return ' checked="checked"';
}
- return $OBJ->set_checkbox($field, $value, $default);
+ return ($input === $value) ? ' checked="checked"' : '';
}
}
@@ -770,47 +740,25 @@ if ( ! function_exists('set_radio'))
* Let's you set the selected value of a radio field via info in the POST array.
* If Form Validation is active it retrieves the info from the validation class
*
- * @param string
- * @param string
- * @param bool
+ * @param string $field
+ * @param string $value
+ * @param bool $default
* @return string
*/
function set_radio($field = '', $value = '', $default = FALSE)
{
- $OBJ =& _get_validation_object();
+ $CI =& get_instance();
- if ($OBJ === FALSE)
+ if (isset($CI->form_validation) && is_object($CI->form_validation) && $CI->form_validation->has_rule($field))
{
- if ( ! isset($_POST[$field]))
- {
- if (count($_POST) === 0 && $default === TRUE)
- {
- return ' checked="checked"';
- }
- return '';
- }
-
- $field = $_POST[$field];
-
- if (is_array($field))
- {
- if ( ! in_array($value, $field))
- {
- return '';
- }
- }
- else
- {
- if (($field == '' OR $value == '') OR $field !== $value)
- {
- return '';
- }
- }
-
- return ' checked="checked"';
+ return $CI->form_validation->set_radio($field, $value, $default);
+ }
+ elseif (($input = $CI->input->post($field, FALSE)) === NULL)
+ {
+ return ($default === TRUE) ? ' checked="checked"' : '';
}
- return $OBJ->set_radio($field, $value, $default);
+ return ($input === $value) ? ' checked="checked"' : '';
}
}
diff --git a/system/libraries/Email.php b/system/libraries/Email.php
index 082629a4c..efdbfd7c1 100644
--- a/system/libraries/Email.php
+++ b/system/libraries/Email.php
@@ -399,9 +399,9 @@ class CI_Email {
else
{
$this->_smtp_auth = ! ($this->smtp_user === '' && $this->smtp_pass === '');
- $this->_safe_mode = (bool) @ini_get('safe_mode');
}
+ $this->_safe_mode = ( ! is_php('5.4') && (bool) @ini_get('safe_mode'));
$this->charset = strtoupper($this->charset);
log_message('debug', 'Email Class Initialized');
@@ -451,7 +451,6 @@ class CI_Email {
$this->clear();
$this->_smtp_auth = ! ($this->smtp_user === '' && $this->smtp_pass === '');
- $this->_safe_mode = (bool) @ini_get('safe_mode');
return $this;
}
diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php
index 15eb74bd5..060973847 100644
--- a/system/libraries/Upload.php
+++ b/system/libraries/Upload.php
@@ -1245,7 +1245,7 @@ class CI_Upload {
}
}
- if ( (bool) @ini_get('safe_mode') === FALSE && function_usable('shell_exec'))
+ if ((bool) @ini_get('safe_mode') === FALSE && function_usable('shell_exec'))
{
$mime = @shell_exec($cmd);
if (strlen($mime) > 0)
generated by cgit v1.2.3-24-g4f1b (git 2.32.0) at 2024-09-12 10:15:04 +0200