From 57fa143448577b670d8dd0e02b6e4cf31c4a7cff Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Fri, 28 Oct 2016 17:46:31 +0300 Subject: [ci skip] xss_clean() hardening - percent-sign tag (IE) - data: URI scheme inclinding whitespace (Chrome) --- system/core/Security.php | 21 +++++++++++---------- user_guide_src/source/changelog.rst | 2 +- 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/system/core/Security.php b/system/core/Security.php index b9160a252..d0308c5f9 100644 --- a/system/core/Security.php +++ b/system/core/Security.php @@ -133,15 +133,16 @@ class CI_Security { * @var array */ protected $_never_allowed_str = array( - 'document.cookie' => '[removed]', - 'document.write' => '[removed]', - '.parentNode' => '[removed]', - '.innerHTML' => '[removed]', - '-moz-binding' => '[removed]', - '' => '-->', - ' '<![CDATA[', - '' => '<comment>' + 'document.cookie' => '[removed]', + 'document.write' => '[removed]', + '.parentNode' => '[removed]', + '.innerHTML' => '[removed]', + '-moz-binding' => '[removed]', + '' => '-->', + ' '<![CDATA[', + '' => '<comment>', + '<%' => '<%' ); /** @@ -924,7 +925,7 @@ class CI_Security { return str_replace( $match[1], preg_replace( - '#href=.*?(?:(?:alert|prompt|confirm)(?:\(|&\#40;)|javascript:|livescript:|mocha:|charset=|window\.|document\.|\.cookie|_filter_attributes($match[1]) ), diff --git a/user_guide_src/source/changelog.rst b/user_guide_src/source/changelog.rst index 4be0b31d3..2482c493c 100644 --- a/user_guide_src/source/changelog.rst +++ b/user_guide_src/source/changelog.rst @@ -9,7 +9,7 @@ Release Date: Not Released - **Security** - - Fixed a new URL-encoding attack vector in :doc:`Security Library ` method ``xss_clean()`` affecting Firefox. + - Fixed a number of new vulnerabilities in :doc:`Security Library ` method ``xss_clean()``. - General Changes -- cgit v1.2.3-24-g4f1b From f52ad7a1a6340ea9d0e63dbf5fbf054b082fa3e9 Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Fri, 28 Oct 2016 17:56:50 +0300 Subject: [ci skip] Add download link check to build-release.sh --- build-release.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/build-release.sh b/build-release.sh index 490680e79..6b3b31d12 100755 --- a/build-release.sh +++ b/build-release.sh @@ -35,6 +35,10 @@ elif [ `grep -c -F --regexp="'$version_number'" user_guide_src/source/conf.py` - then echo "Provided version number doesn't match in user_guide_src/source/conf.py" exit 1 +elif [ `grep -c -F --regexp="$version_number (Current version) " user_guide_src/source/installation/downloads.rst` -ne 1 ] +then + echo "user_guide_src/source/installation/downloads.rst doesn't appear to contain a link for this version" + exit 1 elif [ ! -f "$upgrade_rst" ] then echo "${upgrade_rst} doesn't exist" -- cgit v1.2.3-24-g4f1b From a1f830dedc53e31a48c8722ed11e3e645526bdcc Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Fri, 28 Oct 2016 17:59:47 +0300 Subject: [ci skip] Prepare for 3.1.2 release --- system/core/CodeIgniter.php | 2 +- user_guide_src/source/changelog.rst | 2 +- user_guide_src/source/conf.py | 4 ++-- user_guide_src/source/installation/downloads.rst | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/system/core/CodeIgniter.php b/system/core/CodeIgniter.php index 32ad61899..a2067fb10 100644 --- a/system/core/CodeIgniter.php +++ b/system/core/CodeIgniter.php @@ -55,7 +55,7 @@ defined('BASEPATH') OR exit('No direct script access allowed'); * @var string * */ - const CI_VERSION = '3.1.2-dev'; + const CI_VERSION = '3.1.2'; /* * ------------------------------------------------------ diff --git a/user_guide_src/source/changelog.rst b/user_guide_src/source/changelog.rst index 2482c493c..437fdbabe 100644 --- a/user_guide_src/source/changelog.rst +++ b/user_guide_src/source/changelog.rst @@ -5,7 +5,7 @@ Change Log Version 3.1.2 ============= -Release Date: Not Released +Release Date: Oct 28, 2016 - **Security** diff --git a/user_guide_src/source/conf.py b/user_guide_src/source/conf.py index 17771fa9e..2f44e0cbe 100644 --- a/user_guide_src/source/conf.py +++ b/user_guide_src/source/conf.py @@ -48,9 +48,9 @@ copyright = u'2014 - 2016, British Columbia Institute of Technology' # built documents. # # The short X.Y version. -version = '3.1.2-dev' +version = '3.1.2' # The full version, including alpha/beta/rc tags. -release = '3.1.2-dev' +release = '3.1.2' # The language for content autogenerated by Sphinx. Refer to documentation # for a list of supported languages. diff --git a/user_guide_src/source/installation/downloads.rst b/user_guide_src/source/installation/downloads.rst index 1eacd4d33..6c1f007e3 100644 --- a/user_guide_src/source/installation/downloads.rst +++ b/user_guide_src/source/installation/downloads.rst @@ -2,7 +2,7 @@ Downloading CodeIgniter ####################### -- `CodeIgniter v3.1.2-dev (Current version) `_ +- `CodeIgniter v3.1.2 (Current version) `_ - `CodeIgniter v3.1.1 `_ - `CodeIgniter v3.1.0 `_ - `CodeIgniter v3.0.6 `_ -- cgit v1.2.3-24-g4f1b From 014be1e8726ebce6dd19284ae3deaee866d6b0e5 Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Fri, 28 Oct 2016 18:05:24 +0300 Subject: [ci skip] Fix upgrading instruction link titles --- user_guide_src/source/installation/upgrading.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/user_guide_src/source/installation/upgrading.rst b/user_guide_src/source/installation/upgrading.rst index 61b16e038..4e0b0453d 100644 --- a/user_guide_src/source/installation/upgrading.rst +++ b/user_guide_src/source/installation/upgrading.rst @@ -8,9 +8,9 @@ upgrading from. .. toctree:: :titlesonly: - Upgrading from 3.1.2 to 3.1.2 + Upgrading from 3.1.1 to 3.1.2 Upgrading from 3.1.0 to 3.1.1 - Upgrading from 3.0.6 to 3.1.x + Upgrading from 3.0.6 to 3.1.0 Upgrading from 3.0.5 to 3.0.6 Upgrading from 3.0.4 to 3.0.5 Upgrading from 3.0.3 to 3.0.4 -- cgit v1.2.3-24-g4f1b