diff options
Diffstat (limited to 'user_guide_src/source')
| -rw-r--r-- | user_guide_src/source/installation/upgrade_300.rst | 37 | ||||
| -rw-r--r-- | user_guide_src/source/libraries/form_validation.rst | 8 |
2 files changed, 32 insertions, 13 deletions
diff --git a/user_guide_src/source/installation/upgrade_300.rst b/user_guide_src/source/installation/upgrade_300.rst index 0aaadeebc..a95125666 100644 --- a/user_guide_src/source/installation/upgrade_300.rst +++ b/user_guide_src/source/installation/upgrade_300.rst @@ -239,8 +239,29 @@ If your application has relied on this feature, you should update it to filter URI segments through ``$this->security->xss_clean()`` whenever you output them. +**************************************************************** +Step 13: Check for usage of the 'xss_clean' Form validation rule +**************************************************************** + +A largely unknown rule about XSS cleaning is that it should *only be +applied to output*, as opposed to input data. + +We've made that mistake ourselves with our automatic and global XSS cleaning +feature (see step 13 above), so now in an effort to discourage that +practice, we're also removing 'xss_clean' from the officially supported +list of :doc:`form validation <../libraries/form_validation>` rules. + +Because the :doc:`Form Validation library <../libraries/form_validation>` +generally validates *input* data, the 'xss_clean' rule simply doesn't +belong in it. + +If you really, really need to apply that rule, you should now also load the +:doc:`Security Helper <../helpers/security_helper>`, which contains +``xss_clean()`` as a regular function and therefore can be also used as +a validation rule. + ******************************************************** -Step 13: Update usage of Input Class's get_post() method +Step 14: Update usage of Input Class's get_post() method ******************************************************** Previously, the :doc:`Input Class <../libraries/input>` method ``get_post()`` @@ -250,15 +271,15 @@ modified so that it searches in GET then in POST, as its name suggests. A method has been added, ``post_get()``, which searches in POST then in GET, as ``get_post()`` was doing before. -*********************************************************************** -Step 14: Update usage of Directory Helper's directory_map() function -*********************************************************************** +******************************************************************** +Step 15: Update usage of Directory Helper's directory_map() function +******************************************************************** In the resulting array, directories now end with a trailing directory separator (i.e. a slash, usually). ************************************************************* -Step 15: Update usage of Database Forge's drop_table() method +Step 16: Update usage of Database Forge's drop_table() method ************************************************************* Up until now, ``drop_table()`` added an IF EXISTS clause by default or it didn't work @@ -280,7 +301,7 @@ If your application relies on IF EXISTS, you'll have to change its usage. all drivers with the exception of ODBC. *********************************************************** -Step 16: Change usage of Email library with multiple emails +Step 17: Change usage of Email library with multiple emails *********************************************************** The :doc:`Email Library <../libraries/email>` will automatically clear the @@ -295,7 +316,7 @@ pass FALSE as the first parameter in the ``send()`` method: } *************************************************** -Step 17: Update your Form_validation language lines +Step 18: Update your Form_validation language lines *************************************************** Two improvements have been made to the :doc:`Form Validation Library @@ -326,7 +347,7 @@ files and error messages format: later. **************************************************************** -Step 18: Remove usage of (previously) deprecated functionalities +Step 19: Remove usage of (previously) deprecated functionalities **************************************************************** In addition to the ``$autoload['core']`` configuration setting, there's a diff --git a/user_guide_src/source/libraries/form_validation.rst b/user_guide_src/source/libraries/form_validation.rst index aae9e3b89..f964965ec 100644 --- a/user_guide_src/source/libraries/form_validation.rst +++ b/user_guide_src/source/libraries/form_validation.rst @@ -326,14 +326,13 @@ In addition to the validation method like the ones we used above, you can also prep your data in various ways. For example, you can set up rules like this:: - $this->form_validation->set_rules('username', 'Username', 'trim|required|min_length[5]|max_length[12]|xss_clean'); + $this->form_validation->set_rules('username', 'Username', 'trim|required|min_length[5]|max_length[12]'); $this->form_validation->set_rules('password', 'Password', 'trim|required|md5'); $this->form_validation->set_rules('passconf', 'Password Confirmation', 'trim|required|matches[password]'); $this->form_validation->set_rules('email', 'Email', 'trim|required|valid_email'); -In the above example, we are "trimming" the fields, converting the -password to MD5, and running the username through the `xss_clean()` -method, which removes malicious data. +In the above example, we are "trimming" the fields, checking for length +where necessary and converting the password to MD5. **Any native PHP function that accepts one parameter can be used as a rule, like htmlspecialchars, trim, md5, etc.** @@ -1002,7 +1001,6 @@ to use: ==================== ========= ======================================================================================================= Name Parameter Description ==================== ========= ======================================================================================================= -**xss_clean** No Runs the data through the XSS filtering method, described in the :doc:`Security Class <security>` page. **prep_for_form** No Converts special characters so that HTML data can be shown in a form field without breaking it. **prep_url** No Adds "\http://" to URLs if missing. **strip_image_tags** No Strips the HTML from image tags leaving the raw URL. |