From 3934a4a803ee2069ac7622e4c2565fb5fee11ce9 Mon Sep 17 00:00:00 2001 From: fesplugas Date: Mon, 4 Oct 2010 09:07:49 +0200 Subject: Fixed link --- system/libraries/Javascript.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/system/libraries/Javascript.php b/system/libraries/Javascript.php index efaaab4bf..c149bb111 100644 --- a/system/libraries/Javascript.php +++ b/system/libraries/Javascript.php @@ -22,7 +22,7 @@ * @subpackage Libraries * @category Javascript * @author ExpressionEngine Dev Team - * @link http://codeigniter.com/user_guide/general/errors.html + * @link http://codeigniter.com/user_guide/libraries/javascript.html */ class CI_Javascript { -- cgit v1.2.3-24-g4f1b From 71eee841e278ba5d08f836c047ef3c2e38fa34e1 Mon Sep 17 00:00:00 2001 From: Derek Jones Date: Tue, 5 Oct 2010 09:40:43 -0500 Subject: fixed bug where sess_expire_on_close was not being set from a config file, fixes #173 --- system/libraries/Session.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/system/libraries/Session.php b/system/libraries/Session.php index fc3ee0542..7394e5897 100644 --- a/system/libraries/Session.php +++ b/system/libraries/Session.php @@ -61,7 +61,7 @@ class CI_Session { // Set all the session preferences, which can either be set // manually via the $params array above or via the config file - foreach (array('sess_encrypt_cookie', 'sess_use_database', 'sess_table_name', 'sess_expiration', 'sess_match_ip', 'sess_match_useragent', 'sess_cookie_name', 'cookie_path', 'cookie_domain', 'sess_time_to_update', 'time_reference', 'cookie_prefix', 'encryption_key') as $key) + foreach (array('sess_encrypt_cookie', 'sess_use_database', 'sess_table_name', 'sess_expiration', 'sess_expire_on_close', 'sess_match_ip', 'sess_match_useragent', 'sess_cookie_name', 'cookie_path', 'cookie_domain', 'sess_time_to_update', 'time_reference', 'cookie_prefix', 'encryption_key') as $key) { $this->$key = (isset($params[$key])) ? $params[$key] : $this->CI->config->item($key); } -- cgit v1.2.3-24-g4f1b From 79bd0363faf287cafd9e9bd5608bc3e08df9ac87 Mon Sep 17 00:00:00 2001 From: Derek Jones Date: Wed, 6 Oct 2010 10:06:37 -0500 Subject: added suggested value to index.php for error_reporting() when a site goes live, closes #177 --- index.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/index.php b/index.php index 0eef7b895..c885893dd 100644 --- a/index.php +++ b/index.php @@ -6,7 +6,7 @@ *--------------------------------------------------------------- * * By default CI runs with error reporting set to ALL. For security - * reasons you are encouraged to change this when your site goes live. + * reasons you are encouraged to change this to 0 when your site goes live. * For more info visit: http://www.php.net/error_reporting * */ -- cgit v1.2.3-24-g4f1b From 49ced91d1f5ab50068a66fdddff6be3f5c420565 Mon Sep 17 00:00:00 2001 From: Shane Pearson Date: Wed, 6 Oct 2010 17:31:40 -0500 Subject: Fixed CSRF comments to avoid confusion. --- application/config/config.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/application/config/config.php b/application/config/config.php index 3f2be480f..0b85ac5fc 100644 --- a/application/config/config.php +++ b/application/config/config.php @@ -274,9 +274,9 @@ $config['global_xss_filtering'] = FALSE; /* |-------------------------------------------------------------------------- -| Cross Site Forgery Request +| Cross Site Request Forgery |-------------------------------------------------------------------------- -| Enables a CSFR cookie token to be set. When set to TRUE, token will be +| Enables a CSRF cookie token to be set. When set to TRUE, token will be | checked on a submitted form. If you are accepting user data, it is strongly | recommended CSRF protection be enabled. */ -- cgit v1.2.3-24-g4f1b From 2615e418539c3d6e2f912c66be99ffebfb8513ff Mon Sep 17 00:00:00 2001 From: Derek Jones Date: Wed, 6 Oct 2010 17:51:16 -0500 Subject: fixed a security issue which in certain cases could result in directory traversal --- system/core/Router.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/system/core/Router.php b/system/core/Router.php index b371d5241..d911eb224 100644 --- a/system/core/Router.php +++ b/system/core/Router.php @@ -345,7 +345,7 @@ class CI_Router { */ function set_class($class) { - $this->class = $class; + $this->class = str_replace(array('/', '.'), '', $class); } // -------------------------------------------------------------------- @@ -404,7 +404,7 @@ class CI_Router { */ function set_directory($dir) { - $this->directory = trim($dir, '/').'/'; + $this->directory = str_replace(array('/', '.'), '', $dir).'/'; } // -------------------------------------------------------------------- -- cgit v1.2.3-24-g4f1b From 2ef375969b77c5fdf84118d4a7a8e0bc97d9d2f6 Mon Sep 17 00:00:00 2001 From: Derek Jones Date: Wed, 6 Oct 2010 17:51:59 -0500 Subject: modified the security helper to assist in preventing directory traversal when using sanitize_filename() for user input --- system/libraries/Security.php | 10 +++++++--- user_guide/libraries/security.html | 5 +++++ 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/system/libraries/Security.php b/system/libraries/Security.php index 9a1590b5c..3c1e9cfba 100644 --- a/system/libraries/Security.php +++ b/system/libraries/Security.php @@ -680,11 +680,10 @@ class CI_Security { * @param string * @return string */ - function sanitize_filename($str) + function sanitize_filename($str, $relative_path = FALSE) { $bad = array( "../", - "./", "", "<", @@ -701,7 +700,6 @@ class CI_Security { '=', ';', '?', - '/', "%20", "%22", "%3c", // < @@ -717,6 +715,12 @@ class CI_Security { "%3b", // ; "%3d" // = ); + + if ( ! $relative_path) + { + $bad[] = './'; + $bad[] = '/'; + } return stripslashes(str_replace($bad, '', $str)); } diff --git a/user_guide/libraries/security.html b/user_guide/libraries/security.html index a50d94846..6d6216d95 100644 --- a/user_guide/libraries/security.html +++ b/user_guide/libraries/security.html @@ -102,6 +102,11 @@ Note: This function should only be used to deal with data upon submission. It's $filename = $this->security->sanitize_filename($this->input->post('filename')); +

If it is acceptable for the user input to include relative paths, e.g. file/in/some/approved/folder.txt, you can set the second optional parameter, + $relative_path to TRUE.

+ +$filename = $this->security->sanitize_filename($this->input->post('filename'), TRUE); + -- cgit v1.2.3-24-g4f1b