Age | Commit message (Collapse) | Author | Files | Lines | |
---|---|---|---|---|---|
2014-01-25 | Add <math> to 'naughty' HTML elements | Andrey Andreev | 1 | -1/+1 | |
2014-01-25 | Previous commit caused side effects ... | Andrey Andreev | 1 | -2/+2 | |
2014-01-25 | Fix CI_Security::_remove_evil_attributes() being way too aggressive | Andrey Andreev | 1 | -2/+2 | |
2014-01-25 | Re-add 'on\w*' to evil attributes (rel #2667) | Andrey Andreev | 1 | -2/+1 | |
2014-01-25 | Partially fix #2667 | Andrey Andreev | 1 | -2/+8 | |
2014-01-24 | [ci skip] Add a link to PHP bug 54709 in is_really_writable()'s docblock | Andrey Andreev | 1 | -0/+1 | |
2014-01-24 | CI_Security: Also add <svg> to 'naughty' HTML elements | Andrey Andreev | 1 | -1/+1 | |
2014-01-24 | CI_Security: Add <select> and <keygen> tags to the list of 'naughty' HTML ↵ | Andrey Andreev | 1 | -1/+1 | |
elements | |||||
2014-01-24 | Fix syntax errors | Andrey Andreev | 1 | -2/+2 | |
2014-01-24 | CI_Security: Add 'form' and 'xlink:href' to evil attributes | Andrey Andreev | 1 | -1/+1 | |
2014-01-24 | Add &newline; and &tab; to CI_Security:: | Andrey Andreev | 1 | -1/+3 | |
2014-01-22 | CI_Security::_decode_entity() to replace dangerous HTML5 entities | Andrey Andreev | 1 | -1/+19 | |
Related to issue #2771 | |||||
2014-01-21 | Add <button> to the list of 'naugthy' html elements in CI_Security::xss_clean() | Andrey Andreev | 1 | -2/+2 | |
2014-01-20 | Fix #2729 | Andrey Andreev | 1 | -2/+3 | |
2014-01-20 | Merge branch 'develop' into feature/output_compressed_cache | Andrey Andreev | 1 | -4/+4 | |
2014-01-18 | Fix #2829 | Andrey Andreev | 1 | -4/+4 | |
2014-01-18 | Merge branch 'develop' into feature/output_compressed_cache | Andrey Andreev | 1 | -1/+1 | |
2014-01-18 | Fix 2 Router-related errors | Andrey Andreev | 1 | -1/+1 | |
2014-01-18 | Merge branch 'develop' into feature/output_compressed_cache | Andrey Andreev | 1 | -0/+3 | |
2014-01-18 | Fix CI_URI:: not being properly indexed | Andrey Andreev | 1 | -0/+3 | |
2014-01-18 | Merge branch 'develop' into feature/output_compressed_cache | Andrey Andreev | 5 | -355/+293 | |
2014-01-18 | Fix #2827 | Andrey Andreev | 1 | -1/+1 | |
2014-01-17 | Merge branch 'feature/uri_routing_overhaul' into 'develop' | Andrey Andreev | 3 | -352/+283 | |
2014-01-17 | Add autoloading library aliasing support (supersedes PR #2824) | Andrey Andreev | 1 | -2/+9 | |
2014-01-16 | URI Routing overhaul | Andrey Andreev | 3 | -352/+283 | |
- Allow multiple levels of controller directories (supersedes PRs #390, #2439) - Add support for per-directory 'defaul_controller' and '404_override' (resolves issue #2611; supersedes PR #939) - Fixed a bug where default_controller was called instead of triggering 404 if the current route is inside a directory - Removed a few calls from CI_Router to CI_URI that made a necessity for otherwise internal CI_URI methods to be public: - Removed CI_URI::_fetch_uri_string() and moved its logic into CI_URI::__construct() - Removed CI_URI::_remove_url_suffix, CI_URI::_explode_segments() and moved their logic into CI_URI::_set_uri_string() - Removed CI_URI::_reindex_segments() altogether ( doesn't need further manipulation, while is public anyway and can be properly (and more effectively) replaced on the spot) | |||||
2014-01-15 | Fix #2799 by adding conditional PCRE UTF-8 support to CI_URI::filter_uri() | Andrey Andreev | 2 | -2/+2 | |
Also did a tiny micro-optimization in the Utf8 class. | |||||
2014-01-15 | Merge changes from develop | Andrey Andreev | 5 | -61/+82 | |
2014-01-15 | Fix #2822: Incorrect usage of fwrite() | Andrey Andreev | 2 | -15/+41 | |
We only used to check (and not always) if the return value of fwrite() is boolean FALSE, while it is possible that the otherwise returned bytecount is less than the length of data that we're trying to write. This allowed incomplete writes over network streams and possibly a few other edge cases. | |||||
2014-01-15 | CI_URI changes related to the 'permitted_uri_chars' setting | Andrey Andreev | 2 | -15/+26 | |
- Initialize and cache the value in the class constructor instead of searching for it every time - Removed the preg_quote() call from _filter_uri() to allow more fine-tuning from configuration - Renamed _filter_uri() to filter_uri() - it was public anyway and using it cannot break anything Related: issue #2799 | |||||
2014-01-15 | Fix incorrect checks for the fwrite() return value | Andrey Andreev | 1 | -1/+1 | |
! fwrite() could trigger false-positives as it is possible for it to return 0 instead of boolean FALSE. (issue #2822) Also removed an unnecessary log level check that caused an extra space to be inserted for the INFO level. (proposed in PR #2821) | |||||
2014-01-10 | Finally get rid of the CI_Router::_set_overrides() calls | Andrey Andreev | 2 | -38/+23 | |
2014-01-10 | Use config_item() in CI_Output::__construct() | Andrey Andreev | 1 | -3/+1 | |
2014-01-10 | Compress output before storing it to cache, if output compression is enabled | Andrey Andreev | 1 | -20/+62 | |
Based on PR #964 | |||||
2014-01-08 | Make newline standardization configurable | Andrey Andreev | 1 | -4/+5 | |
Added ['standardize_newlines'] Also altered the Session cookie driver, which experienced issues with this feature due to it's HMAC verification failing after the Input class alters newlines in non-encrypted session cookies. Supersedes PR #2470 | |||||
2014-01-08 | Fix #346 | Andrey Andreev | 1 | -14/+24 | |
When ['global_xss_filtering'] was turned on, the , , & superglobals were automatically overwritten. This resulted in one of the following problems: - xss_clean() being called twice - Inability to retrieve the original (not filtered) value XSS filtering is now only applied on demand by the Input class, and the default value for the parameter in CI_Input methods is changed to NULL. Unless a boolean value is passed to them, whether XSS filtering is applied depends on the ['global_xss_filtering'] value. | |||||
2014-01-08 | Fix #148 | Andrey Andreev | 1 | -4/+6 | |
CI_Input::_clean_input_data() assumed that all input data is URL-encoded while sanitizing it. However, PHP already performs URL-decoding on it, so this is either redudant or overly intrusive as it resulted in many, many reports of data containing '%' followed by 1 numeric characters being essentially destroyed. Supersedes PR #1229 | |||||
2014-01-08 | Optimize get_instance() calls/assignments | Andrey Andreev | 2 | -4/+2 | |
2014-01-08 | Update the CI_Hooks class | Marcos SF Filho | 1 | -18/+16 | |
2014-01-07 | Class for execute Hooks can be stored for reuse | Marcos SF Filho | 1 | -8/+33 | |
2014-01-07 | Fix a few bugs in CI_Hook (based on PR #2762) | Andrey Andreev | 1 | -4/+8 | |
2014-01-07 | Implement Loader method chaining | Andrey Andreev | 1 | -29/+46 | |
Requested in issue #2165 Supersedes PR #2319 | |||||
2014-01-07 | Fix #2268 (manually implementing PR #2269) | Andrey Andreev | 1 | -3/+3 | |
2014-01-06 | Make CI_Loader methods library(), driver(), vars() and language()'s first ↵ | Andrey Andreev | 1 | -6/+6 | |
parameters mandatory and fix a docblock | |||||
2014-01-06 | Make CI_Input::set_cookie() and cookie helpers set_cookie(), get_cookie(), ↵ | Andrey Andreev | 1 | -1/+1 | |
delete_cookie()'s first (name) parameter mandatory | |||||
2014-01-03 | Make CI_Lang::line()'s first parameter mandatory (optional doesn't make sense) | Andrey Andreev | 1 | -1/+1 | |
2014-01-03 | [ci skip] Remove a few spaces | Andrey Andreev | 1 | -3/+3 | |
2014-01-03 | A tiny improvement in ruri_string() | Andrey Andreev | 1 | -6/+1 | |
2013-11-27 | [ci skip] Remove a few more spaces | Andrey Andreev | 1 | -1/+1 | |
2013-11-17 | Always load application/config/constants.php | Andrey Andreev | 1 | -6/+4 | |
2013-11-16 | Update CodeIgniter.php | josephok | 1 | -9/+9 | |
require(APPPATH.'config/constants.php') should be in front of require(BASEPATH.'core/Common.php') because Common.php uses some constants defined in constants.php. |