diff options
Diffstat (limited to 'user_guide')
| -rw-r--r-- | user_guide/changelog.html | 21 | ||||
| -rw-r--r-- | user_guide/database/active_record.html | 11 | ||||
| -rw-r--r-- | user_guide/general/common_functions.html | 2 | ||||
| -rw-r--r-- | user_guide/helpers/date_helper.html | 14 | ||||
| -rw-r--r-- | user_guide/installation/index.html | 4 | ||||
| -rw-r--r-- | user_guide/installation/upgrade_203.html | 14 | ||||
| -rw-r--r-- | user_guide/libraries/file_uploading.html | 7 | ||||
| -rw-r--r-- | user_guide/libraries/form_validation.html | 7 | ||||
| -rw-r--r-- | user_guide/libraries/input.html | 18 | ||||
| -rw-r--r-- | user_guide/libraries/security.html | 3 |
10 files changed, 79 insertions, 22 deletions
diff --git a/user_guide/changelog.html b/user_guide/changelog.html index 88b4363ea..e1a134def 100644 --- a/user_guide/changelog.html +++ b/user_guide/changelog.html @@ -66,17 +66,23 @@ Change Log <li>General Changes <ul> <li class="reactor">Callback validation rules can now accept parameters like any other validation rule.</li> + <li class="reactor">Ability to log certain error types, not all under a threshold.</li> + <li class="reactor">Added html_escape() to the <a href="general/common_functions.html">Common functions<a> to escape HTML output for preventing XSS easliy.</li> </ul> </li> <li>Helpers <ul> <li class="reactor">Added <samp>increment_string()</samp> to <a href="helpers/string_helper.html">String Helper</a> to turn "foo" into "foo-1" or "foo-1" into "foo-2".</li> + <li>Altered form helper - made action on form_open_multipart helper function call optional. Fixes (#65)</li> </ul> </li> <li>Database <ul> - <li class="reactor">Added a <a href="http://www.cubrid.org/" target="_blank">CUBRID</a> driver to the <a href="libraries/database.html">Database Driver</a>. Thanks to the CUBRID team for supplying this patch.</li> + <li class="reactor">Added a <a href="http://www.cubrid.org/" target="_blank">CUBRID</a> driver to the <a href="database/index.html">Database Driver</a>. Thanks to the CUBRID team for supplying this patch.</li> <li class="reactor">Typecast limit and offset in the <a href="database/queries.html">Database Driver</a> to integers to avoid possible injection.</li> + <li class="reactor"> + Added additional option 'none' for the optional third argument for <kbd>$this->db->like()</kbd> in the <a href="database/active_record.html">Database Driver</a>. + </li> </ul> </li> <li>Libraries @@ -85,6 +91,8 @@ Change Log <li class="reactor">Added support to set an optional parameter in your callback rules of validation using the <a href="libraries/form_validation.html">Form Validation Library</a>.</li> <li class="reactor">Added a <a href="libraries/migration.html">Migration Library</a> to assist with applying incremental updates to your database schema.</li> <li class="reactor">Driver children can be located in any package path.</li> + <li class="reactor">Added max_filename_increment config setting for Upload library.</li> + <li><samp>CI_Loader::_ci_autoloader()</samp> is now a protected method.</li> </ul> </li> </ul> @@ -95,6 +103,11 @@ Change Log <li class="reactor">If a config class was loaded first then a library with the same name is loaded, the config would be ignored.</li> <li class="reactor">Fixed a bug (Reactor #19) where 1) the 404_override route was being ignored in some cases, and 2) auto-loaded libraries were not available to the 404_override controller when a controller existed but the requested method did not.</li> <li class="rector">Fixed a bug (Reactor #89) where MySQL export would fail if the table had hyphens or other non alphanumeric/underscore characters.</li> + <li class="reactor">Fixed a bug (#200) where MySQL queries would be malformed after calling <samp>count_all()</samp> then <samp>db->get()</samp></li> + <li>Fixed a bug (#181) where a mis-spelling was in the form validation language file.</li> + <li>Fixed a bug (#160) - Removed unneeded array copy in the file cache driver.</li> + <li>Fixed a bug (#150) - <samp>field_data()</samp> now correctly returns column length.</li> + <li>Fixed a bug (#8) - <samp>load_class()</samp> now looks for core classes in <samp>APPPATH</samp> first, allowing them to be replaced.</li> </ul> <h2>Version 2.0.3</h2> @@ -114,7 +127,13 @@ Change Log <li>Visual updates to the welcome_message view file and default error templates. Thanks to <a href="https://bitbucket.org/danijelb">danijelb</a> for the pull request.</li> <li class="reactor">Added <samp>insert_batch()</samp> function to the PostgreSQL database driver. Thanks to epallerols for the patch.</li> <li class="reactor">Added "application/x-csv" to mimes.php.</li> + <li class="reactor">Added CSRF protection URI whitelisting.</li> <li>Fixed a bug where <a href="libraries/email.html">Email library</a> attachments with a "." in the name would using invalid MIME-types.</li> + <li>Added support for pem,p10,p12,p7a,p7c,p7m,p7r,p7s,crt,crl,der,kdb,rsa,cer,sst,csr Certs to mimes.php.</li> + <li>Added support pgp,gpg to mimes.php.</li> + <li>Added support 3gp, 3g2, mp4, wmv, f4v, vlc Video files to mimes.php.</li> + <li>Added support m4a, aac, m4u, xspf, au, ac3, flac, ogg Audio files to mimes.php.</li> + </ul> </li> <li>Helpers diff --git a/user_guide/database/active_record.html b/user_guide/database/active_record.html index 3f44fcd5b..92d9614d5 100644 --- a/user_guide/database/active_record.html +++ b/user_guide/database/active_record.html @@ -334,6 +334,13 @@ $this->db->or_where('id >', $id); $this->db->like('title', 'match', 'both'); <br /> // Produces: WHERE title LIKE '%match%' </code> </li> +If you do not want to use the wildcard (%) you can pass to the optional third argument the option 'none'. + +<code> + $this->db->like('title', 'match', 'none'); <br /> +// Produces: WHERE title LIKE 'match' +</code> + <li><strong>Associative array method:</strong> <code> @@ -525,7 +532,7 @@ $this->db->insert('mytable', $object); <p>Generates an insert string based on the data you supply, and runs the query. You can either pass an <strong>array</strong> or an <strong>object</strong> to the function. Here is an example using an array:</p> -<code> +<code> $data = array(<br/> array(<br /> 'title' => 'My title' ,<br /> @@ -537,7 +544,7 @@ $data = array(<br/> 'name' => 'Another Name' ,<br /> 'date' => 'Another date'<br /> )<br/> -);<br /> +);<br /> <br /> $this->db->update_batch('mytable', $data); <br /><br /> diff --git a/user_guide/general/common_functions.html b/user_guide/general/common_functions.html index 65457759d..7cff6321c 100644 --- a/user_guide/general/common_functions.html +++ b/user_guide/general/common_functions.html @@ -104,6 +104,8 @@ else<br /> <p>This function prevents inserting null characters between ascii characters, like Java\0script.</p> +<h2>html_escape(<var>$mixed</var>)</h2> +<p>This function provides short cut for htmlspecialchars() function. It accepts string and array. To prevent Cross Site Scripting (XSS), it is very useful.</p> </div> diff --git a/user_guide/helpers/date_helper.html b/user_guide/helpers/date_helper.html index f930ea3ae..5b00e25e0 100644 --- a/user_guide/helpers/date_helper.html +++ b/user_guide/helpers/date_helper.html @@ -234,6 +234,20 @@ $unix = human_to_unix($human);</code> +<h2>nice_date()</h2> + +<p>This function can take a number poorly-formed date formats and convert them into something useful. It also accepts well-formed dates.</p> +<p>The function will return a Unix timestamp by default. You can, optionally, pass a format string (the same type as the PHP date function accepts) as the second parameter. Example:</p> + +<code>$bad_time = 199605<br /> +<br /> +// Should Produce: 1996-05-01<br /> +$better_time = nice_date($bad_time,'Y-m-d');<br /> +<br /> +$bad_time = 9-11-2001<br /> +// Should Produce: 2001-09-11<br /> +$better_time = nice_date($human,'Y-m-d');</code> + <h2>timespan()</h2> diff --git a/user_guide/installation/index.html b/user_guide/installation/index.html index 5e8ab3883..84338e2e6 100644 --- a/user_guide/installation/index.html +++ b/user_guide/installation/index.html @@ -72,7 +72,9 @@ variables at the top of the file with the new name you've chosen.</p> <p>For the best security, both the <dfn>system</dfn> and any <dfn>application</dfn> folders should be placed above web root so that they are not directly accessible via a browser. By default, .htaccess files are included in each folder to help prevent direct access, but it is best to remove them from public access entirely in case the web server configuration changes or doesn't abide by the .htaccess.</p> -<p>After moving them, open your main <kdb>index.php</kbd> file and set the <samp>$system_folder</samp> and <samp>$application_folder</samp> variables, preferably with a full path, e.g. '<dfn>/www/MyUser/system</dfn>'.</p> +<p>If you would like to keep your views public it is also possible to move the <dfn>views</dfn> folder out of your application folder.</p> + +<p>After moving them, open your main <kdb>index.php</kbd> file and set the <samp>$system_folder</samp>, <samp>$application_folder</samp> and <samp>$view_folder</samp> variables, preferably with a full path, e.g. '<dfn>/www/MyUser/system</dfn>'.</p> <p> One additional measure to take in production environments is to disable diff --git a/user_guide/installation/upgrade_203.html b/user_guide/installation/upgrade_203.html index 7dbc907ea..04899832d 100644 --- a/user_guide/installation/upgrade_203.html +++ b/user_guide/installation/upgrade_203.html @@ -65,27 +65,23 @@ Upgrading from 2.0.2 to 2.0.3 <p>Replace all files and directories in your "system" folder and replace your index.php file. If any modifications were made to your index.php they will need to be made fresh in this new one.</p> <p class="important"><strong>Note:</strong> If you have any custom developed files in these folders please make copies of them first.</p> - -<h2>Step 2: Update CodeIgniter files</h2> - -<p>Replace the files and directories in your "system" folder with the new versions:</p> -<h2>Step 3: Update your main index.php file</h2> +<h2>Step 2: Update your main index.php file</h2> <p>If you are running a stock <dfn>index.php</dfn> file simply replace your version with the new one.</p> <p>If your <dfn>index.php</dfn> file has internal modifications, please add your modifications to the new file and use it.</p> -<h2>Step 4: Replace config/user_agents.php</h2> +<h2>Step 3: Replace config/user_agents.php</h2> <p>This config file has been updated to contain more user agent types, please copy it to <kbd>application/config/user_agents.php</kbd>.</p> -<h2>Step 5: Change references of the EXT constant to ".php"</h2> +<h2>Step 4: Change references of the EXT constant to ".php"</h2> <p class="important"><strong>Note:</strong> The EXT Constant has been marked as deprecated, but has not been removed from the application. You are encouraged to make the changes sooner rather than later.</p> -<h2>Step 6: Remove APPPATH.'third_party' from autoload.php</h2> +<h2>Step 5: Remove APPPATH.'third_party' from autoload.php</h2> -<p>Open application/autoload.php, and look for the following:</p> +<p>Open application/config/autoload.php, and look for the following:</p> <code>$autoload['packages'] = array(APPPATH.'third_party');</code> diff --git a/user_guide/libraries/file_uploading.html b/user_guide/libraries/file_uploading.html index a88c67220..94b219355 100644 --- a/user_guide/libraries/file_uploading.html +++ b/user_guide/libraries/file_uploading.html @@ -305,6 +305,13 @@ $this->upload->initialize($config);</code> </tr> <tr> +<td class="td"><strong>max_filename_increment</strong></td> +<td class="td">100</td> +<td class="td">None</td> +<td class="td">When overwrite is set to FALSE, use this to set the maximum filename increment for CodeIgniter to append to the filename.</td> +</tr> + +<tr> <td class="td"><strong>encrypt_name</strong></td> <td class="td">FALSE</td> <td class="td">TRUE/FALSE (boolean)</td> diff --git a/user_guide/libraries/form_validation.html b/user_guide/libraries/form_validation.html index d9d8a4502..ede1913e0 100644 --- a/user_guide/libraries/form_validation.html +++ b/user_guide/libraries/form_validation.html @@ -1042,6 +1042,13 @@ POST array:</p> </tr> <tr> + <td class="td"><strong>is_unique</strong></td> + <td class="td">Yes</td> + <td class="td">Returns FALSE if the form element is not unique in a database table.</td> + <td class="td">is_unique[table.field]</td> + </tr> + + <tr> <td class="td"><strong>valid_email</strong></td> <td class="td">No</td> <td class="td">Returns FALSE if the form element does not contain a valid email address.</td> diff --git a/user_guide/libraries/input.html b/user_guide/libraries/input.html index 311f76ee9..77e28488a 100644 --- a/user_guide/libraries/input.html +++ b/user_guide/libraries/input.html @@ -73,11 +73,11 @@ Input Class <p>The security filtering function is called automatically when a new <a href="../general/controllers.html">controller</a> is invoked. It does the following:</p> <ul> -<li>Destroys the global GET array. Since CodeIgniter does not utilize GET strings, there is no reason to allow it.</li> +<li>If $config['allow_get_array'] is FALSE(default is TRUE), destroys the global GET array.</li> <li>Destroys all global variables in the event register_globals is turned on.</li> -<li>Filters the POST/COOKIE array keys, permitting only alpha-numeric (and a few other) characters.</li> +<li>Filters the GET/POST/COOKIE array keys, permitting only alpha-numeric (and a few other) characters.</li> <li>Provides XSS (Cross-site Scripting Hacks) filtering. This can be enabled globally, or upon request.</li> -<li>Standardizes newline characters to \n</li> +<li>Standardizes newline characters to \n(In Windows \r\n)</li> </ul> @@ -133,13 +133,13 @@ else<br /> <code>$this->input->post('some_data', TRUE);</code> <p>To return an array of all POST items call without any parameters.</p> -<p>To return all POST items and pass them through the XSS filter leave the first parameter blank while setting the second parameter to boolean;</p> +<p>To return all POST items and pass them through the XSS filter set the first parameter NULL while setting the second parameter to boolean;</p> <p>The function returns FALSE (boolean) if there are no items in the POST.</p> <code> - $this->input->post(); // returns all POST items with XSS filter + $this->input->post(NULL, TRUE); // returns all POST items with XSS filter <br /> - $this->input->post(NULL, FALSE); // returns all POST items without XSS + $this->input->post(); // returns all POST items without XSS filter </code> <h2>$this->input->get()</h2> @@ -149,13 +149,13 @@ else<br /> <code>$this->input->get('some_data', TRUE);</code> <p>To return an array of all GET items call without any parameters.</p> -<p>To return all GET items and pass them through the XSS filter leave the first parameter blank while setting the second parameter to boolean;</p> +<p>To return all GET items and pass them through the XSS filter set the first parameter NULL while setting the second parameter to boolean;</p> <p>The function returns FALSE (boolean) if there are no items in the GET.</p> <code> - $this->input->get(); // returns all GET items with XSS filter + $this->input->get(NULL, TRUE); // returns all GET items with XSS filter <br /> - $this->input->get(NULL, FALSE); // returns all GET items without XSS filtering + $this->input->get(); // returns all GET items without XSS filtering </code> <h2>$this->input->get_post()</h2> diff --git a/user_guide/libraries/security.html b/user_guide/libraries/security.html index dd62a4386..cbe12d852 100644 --- a/user_guide/libraries/security.html +++ b/user_guide/libraries/security.html @@ -116,6 +116,9 @@ Note: This function should only be used to deal with data upon submission. It's <p>If you use the <a href="../helpers/form_helper.html">form helper</a> the <var>form_open()</var> function will automatically insert a hidden csrf field in your forms.</p> +<p>Select URIs can be whitelisted from csrf protection (for example API endpoints expecting externally POSTed content). You can add these URIs by editing the 'csrf_exclude_uris' config parameter:</p> +<code>$config['csrf_exclude_uris'] = array('api/person/add');</code> + </div> <!-- END CONTENT --> |