diff options
Diffstat (limited to 'user_guide_src/source/installation/upgrade_300.rst')
| -rw-r--r-- | user_guide_src/source/installation/upgrade_300.rst | 87 |
1 files changed, 69 insertions, 18 deletions
diff --git a/user_guide_src/source/installation/upgrade_300.rst b/user_guide_src/source/installation/upgrade_300.rst index 8983f3d18..a3d712482 100644 --- a/user_guide_src/source/installation/upgrade_300.rst +++ b/user_guide_src/source/installation/upgrade_300.rst @@ -1,9 +1,7 @@ ############################# -Upgrading from 2.2.1 to 3.0.0 +Upgrading from 2.2.x to 3.0.0 ############################# -.. note:: These upgrade notes are for a version that is yet to be released. - Before performing an update you should take your site offline by replacing the index.php file with a static one. ************************************* @@ -212,26 +210,63 @@ is suitable for the command line. This of course requires another level of separ It is safe to move your old templates from _application/errors* to _application/views/errors/html*, but you'll have to copy the new _application/views/errors/cli* directory from the CodeIgniter archive. -******************************************************* -Step 9: Update your config/routes.php containing (:any) -******************************************************* +****************************************** +Step 9: Update your config/routes.php file +****************************************** + +Routes containing :any +====================== + +Historically, CodeIgniter has always provided the **:any** wildcard in +routing, with the intention of providing a way to match any character +**within** an URI segment. -Historically, CodeIgniter has always provided the **:any** wildcard in routing, -with the intention of providing a way to match any character **within** an URI segment. +However, the **:any** wildcard is actually just an alias for a regular +expression and used to be executed in that manner as **.+**. This is +considered a bug, as it also matches the / (forward slash) character, which +is the URI segment delimiter and that was never the intention. -However, the **:any** wildcard is actually just an alias for a regular expression -and used to be executed in that manner as **.+**. This is considered a bug, as it -also matches the / (forward slash) character, which is the URI segment delimiter -and that was never the intention. In CodeIgniter 3, the **:any** wildcard will now -represent **[^/]+**, so that it will not match a forward slash. +In CodeIgniter 3, the **:any** wildcard will now represent **[^/]+**, so +that it will not match a forward slash. -There are certainly many developers that have utilized this bug as an actual feature. -If you're one of them and want to match a forward slash, please use the **.+** -regular expression:: +There are certainly many developers that have utilized this bug as an actual +feature. If you're one of them and want to match a forward slash, please use +the **.+** regular expression:: (.+) // matches ANYTHING (:any) // matches any character, except for '/' +Directories and 'default_controller', '404_override' +==================================================== + +As you should know, the ``$route['default_controller']`` and +``$route['404_override']`` settings accept not only a controller name, but +also *controller/method* pairs. However, a bug in the routing logic has +made it possible for some users to use that as *directory/controller* +instead. + +As already said, this behavior was incidental and was never intended, nor +documented. If you've relied on it, your application will break with +CodeIgniter 3.0. + +Another notable change in version 3 is that 'default_controller' and +'404_override' are now applied *per directory*. To explain what this means, +let's take the following example:: + + $route['default_controller'] = 'main'; + +Now, assuming that your website is located at *example.com*, you already +know that if a user visits ``http://example.com/``, the above setting will +cause your 'Main' controller to be loaded. + +However, what happens if you have an *application/controllers/admin/* +directory and the user visits ``http://example.com/admin/``? +In CodeIgniter 3, the router will look for a 'Main' controller under the +admin/ directory as well. If not found, it will fallback to the parent +(*application/controllers/*) directory, like in version 2.x. + +The same rule applies to the '404_override' setting. + ************************************************************************* Step 10: Many functions now return NULL instead of FALSE on missing items ************************************************************************* @@ -514,6 +549,22 @@ PHP's native ``hash()`` function. It is deprecated and scheduled for removal in .. note:: This function is still available, but you're strongly encouraged to remove its usage sooner rather than later. +The $config['global_xss_filtering'] setting +=========================================== + +As already explained above, XSS filtering should not be done on input data, +but on output instead. Therefore, the ``$config['global_xss_filtering']``, +which automatically filters *input* data, is considered a bad practice and +is now deprecated. + +Instead, you should manually escape any user-provided data via the +:php:func:`xss_clean()` function when you need to output it, or use a +library like `HTML Purifier <http://htmlpurifier.org/>`_ that does that +for you. + +.. note:: The setting is still available, but you're strongly encouraged to + remove its usage sooner rather than later. + File helper read_file() ======================= @@ -574,7 +625,7 @@ Date helper standard_date() =========================== :doc:`Date Helper <../helpers/date_helper>` function ``standard_date()`` is being deprecated due -to the availability of native PHP `constants <http://www.php.net/manual/en/class.datetime.php#datetime.constants.types>`_, +to the availability of native PHP `constants <http://php.net/manual/en/class.datetime.php#datetime.constants.types>`_, which when combined with ``date()`` provide the same functionality. Furthermore, they have the exact same names as the ones supported by ``standard_date()``. Here are examples of how to replace its usage: @@ -758,7 +809,7 @@ It is now deprecated and scheduled for removal in CodeIgniter 3.1+. sooner rather than later. *********************************************************** -Step 18: Check your usage of Text helper highlight_phrase() +Step 20: Check your usage of Text helper highlight_phrase() *********************************************************** The default HTML tag used by :doc:`Text Helper <../helpers/text_helper>` function |