From 8ff2da1c7457cfd04a28776705cea64cbb96716a Mon Sep 17 00:00:00 2001 From: Michiel Vugteveen Date: Wed, 23 Nov 2011 10:09:57 +0100 Subject: tmp_path does not exists, should be tmp_name --- system/libraries/Upload.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'system/libraries') diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php index 05511b5d3..fe5907ab2 100644 --- a/system/libraries/Upload.php +++ b/system/libraries/Upload.php @@ -1055,7 +1055,7 @@ class CI_Upload { if (DIRECTORY_SEPARATOR !== '\\' && function_exists('exec')) { $output = array(); - @exec('file --brief --mime-type ' . escapeshellarg($file['tmp_path']), $output, $return_code); + @exec('file --brief --mime-type ' . escapeshellarg($file['tmp_name']), $output, $return_code); if ($return_code === 0 && strlen($output[0]) > 0) // A return status code != 0 would mean failed execution { $this->file_type = rtrim($output[0]); -- cgit v1.2.3-24-g4f1b From 59654319d20a7ec406e7d6f15cf6804e94897d14 Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Fri, 2 Dec 2011 14:28:54 +0200 Subject: Hotfix for a file type detection bug in the Upload library --- system/libraries/Upload.php | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'system/libraries') diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php index fe5907ab2..ff3461586 100644 --- a/system/libraries/Upload.php +++ b/system/libraries/Upload.php @@ -1042,14 +1042,17 @@ class CI_Upload { if (function_exists('mime_content_type')) { $this->file_type = @mime_content_type($file['tmp_name']); - return; + if (strlen($this->file_type) > 0) // Turned out it's possible ... + { + return; + } } /* This is an ugly hack, but UNIX-type systems provide a native way to detect the file type, * which is still more secure than depending on the value of $_FILES[$field]['type']. * * Notes: - * - a 'W' in the substr() expression bellow, would mean that we're using Windows + * - the DIRECTORY_SEPARATOR comparison ensures that we're not on a Windows system * - many system admins would disable the exec() function due to security concerns, hence the function_exists() check */ if (DIRECTORY_SEPARATOR !== '\\' && function_exists('exec')) -- cgit v1.2.3-24-g4f1b From f796655d37163e7fd046395ddfe765baf752ec77 Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Fri, 2 Dec 2011 15:00:36 +0200 Subject: Update a comment, just to be clearer --- system/libraries/Upload.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'system/libraries') diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php index ff3461586..506d15897 100644 --- a/system/libraries/Upload.php +++ b/system/libraries/Upload.php @@ -1042,7 +1042,7 @@ class CI_Upload { if (function_exists('mime_content_type')) { $this->file_type = @mime_content_type($file['tmp_name']); - if (strlen($this->file_type) > 0) // Turned out it's possible ... + if (strlen($this->file_type) > 0) // Turns out it's possible that mime_content_type() returns FALSE or an empty string { return; } -- cgit v1.2.3-24-g4f1b From a49e381fde010a7a83845910c0f772fb139f0b1e Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Fri, 9 Dec 2011 13:05:22 +0200 Subject: Improve CI_Upload::_file_mime_type() --- system/libraries/Upload.php | 102 +++++++++++++++++++++++++++++++++----------- 1 file changed, 78 insertions(+), 24 deletions(-) (limited to 'system/libraries') diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php index 506d15897..564d6000e 100644 --- a/system/libraries/Upload.php +++ b/system/libraries/Upload.php @@ -1018,50 +1018,104 @@ class CI_Upload { */ protected function _file_mime_type($file) { - // Use if the Fileinfo extension, if available (only versions above 5.3 support the FILEINFO_MIME_TYPE flag) - if ( (float) substr(phpversion(), 0, 3) >= 5.3 && function_exists('finfo_file')) + // We'll need this to validate the MIME info string (e.g. text/plain; charset=us-ascii) + $regexp = '/^([a-z\-]+\/[a-z0-9\-]+);\s.+$/'; + + /* Fileinfo extension - most reliable method + * + * Unfortunately, prior to PHP 5.3 - it's only available as a PECL extension and the + * more convenient FILEINFO_MIME_TYPE flag doesn't exist. + */ + if (function_exists('finfo_file')) { - $finfo = new finfo(FILEINFO_MIME_TYPE); - if ($finfo !== FALSE) // This is possible, if there is no magic MIME database file found on the system + $finfo = finfo_open(FILEINFO_MIME); + if (is_resource($finfo)) // It is possible that a FALSE value is returned, if there is no magic MIME database file found on the system { - $file_type = $finfo->file($file['tmp_name']); + $mime = @finfo_file($finfo, $file['tmp_name']); + finfo_close($finfo); /* According to the comments section of the PHP manual page, * it is possible that this function returns an empty string * for some files (e.g. if they don't exist in the magic MIME database) */ - if (strlen($file_type) > 1) + if (is_string($mime) && preg_match($regexp, $mime, $matches)) { - $this->file_type = $file_type; + $this->file_type = $matches[1]; return; } } } - // Fall back to the deprecated mime_content_type(), if available - if (function_exists('mime_content_type')) + /* This is an ugly hack, but UNIX-type systems provide a "native" way to detect the file type, + * which is still more secure than depending on the value of $_FILES[$field]['type'], and as it + * was reported in issue #750 (https://github.com/EllisLab/CodeIgniter/issues/750) - it's better + * than mime_content_type() as well, hence the attempts to try calling the command line with + * three different functions. + * + * Notes: + * - the DIRECTORY_SEPARATOR comparison ensures that we're not on a Windows system + * - many system admins would disable the exec(), shell_exec(), popen() and similar functions + * due to security concerns, hence the function_exists() checks + */ + if (DIRECTORY_SEPARATOR !== '\\') { - $this->file_type = @mime_content_type($file['tmp_name']); - if (strlen($this->file_type) > 0) // Turns out it's possible that mime_content_type() returns FALSE or an empty string + $cmd = 'file --brief --mime ' . escapeshellarg($file['tmp_name']) . ' 2>&1'; + + if (function_exists('exec')) { - return; + /* This might look confusing, as $mime is being populated with all of the output when set in the second parameter. + * However, we only neeed the last line, which is the actual return value of exec(), and as such - it overwrites + * anything that could already be set for $mime previously. This effectively makes the second parameter a dummy + * value, which is only put to allow us to get the return status code. + */ + $mime = @exec($cmd, $mime, $return_status); + if ($return_status === 0 && is_string($mime) && preg_match($regexp, $mime, $matches)) + { + $this->file_type = $matches[1]; + return; + } + } + + if ( (bool) @ini_get('safe_mode') === FALSE && function_exists('shell_exec')) + { + $mime = @shell_exec($cmd); + if (strlen($mime) > 0) + { + $mime = explode("\n", trim($mime)); + if (preg_match($regexp, $mime[(count($mime) - 1)], $matches)) + { + $this->file_type = $matches[1]; + return; + } + } + } + + if (function_exists('popen')) + { + $proc = @popen($cmd, 'r'); + if (is_resource($proc)) + { + $mime = @fread($test, 512); + @pclose($proc); + if ($mime !== FALSE) + { + $mime = explode("\n", trim($mime)); + if (preg_match($regexp, $mime[(count($mime) - 1)], $matches)) + { + $this->file_type = $matches[1]; + return; + } + } + } } } - /* This is an ugly hack, but UNIX-type systems provide a native way to detect the file type, - * which is still more secure than depending on the value of $_FILES[$field]['type']. - * - * Notes: - * - the DIRECTORY_SEPARATOR comparison ensures that we're not on a Windows system - * - many system admins would disable the exec() function due to security concerns, hence the function_exists() check - */ - if (DIRECTORY_SEPARATOR !== '\\' && function_exists('exec')) + // Fall back to the deprecated mime_content_type(), if available (still better than $_FILES[$field]['type']) + if (function_exists('mime_content_type')) { - $output = array(); - @exec('file --brief --mime-type ' . escapeshellarg($file['tmp_name']), $output, $return_code); - if ($return_code === 0 && strlen($output[0]) > 0) // A return status code != 0 would mean failed execution + $this->file_type = @mime_content_type($file['tmp_name']); + if (strlen($this->file_type) > 0) // It's possible that mime_content_type() returns FALSE or an empty string { - $this->file_type = rtrim($output[0]); return; } } -- cgit v1.2.3-24-g4f1b From 750ffb9f6d545772c7139b5ee0c1402241c6ceb2 Mon Sep 17 00:00:00 2001 From: Andrew Mackrodt Date: Sat, 10 Dec 2011 23:42:07 +0000 Subject: Fix for Issue #538. --- system/libraries/Image_lib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'system/libraries') diff --git a/system/libraries/Image_lib.php b/system/libraries/Image_lib.php index 8902f524d..7f905128b 100644 --- a/system/libraries/Image_lib.php +++ b/system/libraries/Image_lib.php @@ -208,7 +208,7 @@ class CI_Image_lib { } else { - if (strpos($this->new_image, '/') === FALSE) + if (strpos($this->new_image, '/') === FALSE AND strpos($this->new_image, '\\') === FALSE) { $this->dest_folder = $this->source_folder; $this->dest_image = $this->new_image; -- cgit v1.2.3-24-g4f1b From 3b6ff4ddc5ca433ba7b68a51a617c00b93511889 Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Sun, 11 Dec 2011 14:57:36 +0200 Subject: Fix regular expression for validating MIME type string --- system/libraries/Upload.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'system/libraries') diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php index 564d6000e..c72fa3c6d 100644 --- a/system/libraries/Upload.php +++ b/system/libraries/Upload.php @@ -1019,7 +1019,7 @@ class CI_Upload { protected function _file_mime_type($file) { // We'll need this to validate the MIME info string (e.g. text/plain; charset=us-ascii) - $regexp = '/^([a-z\-]+\/[a-z0-9\-]+);\s.+$/'; + $regexp = '/^([a-z\-]+\/[a-z0-9\-\.\+]+);\s.+$/'; /* Fileinfo extension - most reliable method * -- cgit v1.2.3-24-g4f1b From f7aed129051475b4baeeb549a764464560c9dd34 Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Tue, 13 Dec 2011 11:01:06 +0200 Subject: Tweak MIME regular expression check again --- system/libraries/Upload.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'system/libraries') diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php index c72fa3c6d..91fbf66ca 100644 --- a/system/libraries/Upload.php +++ b/system/libraries/Upload.php @@ -1019,7 +1019,7 @@ class CI_Upload { protected function _file_mime_type($file) { // We'll need this to validate the MIME info string (e.g. text/plain; charset=us-ascii) - $regexp = '/^([a-z\-]+\/[a-z0-9\-\.\+]+);\s.+$/'; + $regexp = '/^([a-z\-]+\/[a-z0-9\-\.\+]+)(;\s.+)?$/'; /* Fileinfo extension - most reliable method * -- cgit v1.2.3-24-g4f1b From 010f1f4b315c8f5aef2e0b4c6571e4c4752f56c6 Mon Sep 17 00:00:00 2001 From: tubalmartin Date: Sat, 3 Mar 2012 22:24:31 +0100 Subject: Fixed a bug - CI_Upload::_file_mime_type() could've failed if popen() is used for the detection. --- system/libraries/Upload.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'system/libraries') diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php index 91fbf66ca..b0490de30 100644 --- a/system/libraries/Upload.php +++ b/system/libraries/Upload.php @@ -1095,7 +1095,7 @@ class CI_Upload { $proc = @popen($cmd, 'r'); if (is_resource($proc)) { - $mime = @fread($test, 512); + $mime = @fread($proc, 512); @pclose($proc); if ($mime !== FALSE) { -- cgit v1.2.3-24-g4f1b From e463c4d71c2fdcc224e70f7576582220ae64e3d7 Mon Sep 17 00:00:00 2001 From: Wes Baker Date: Fri, 4 May 2012 18:44:24 -0400 Subject: Added a return false if an image doesn't pass XSS cleaning to prevent file_get_contents from returning a NULL and passing through unscathed. --- system/libraries/Upload.php | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'system/libraries') diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php index b0490de30..0e5d73b19 100644 --- a/system/libraries/Upload.php +++ b/system/libraries/Upload.php @@ -868,6 +868,10 @@ class CI_Upload { { return TRUE; // its an image, no "triggers" detected in the first 256 bytes, we're good } + else + { + return FALSE; + } } if (($data = @file_get_contents($file)) === FALSE) -- cgit v1.2.3-24-g4f1b From da981e4383c12ef182a95ee5aa88a8f8b5ee7632 Mon Sep 17 00:00:00 2001 From: Jamie Hurst Date: Thu, 24 May 2012 10:02:56 +0100 Subject: Adding width and height to list of clear variables to fix #1059 --- system/libraries/Image_lib.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'system/libraries') diff --git a/system/libraries/Image_lib.php b/system/libraries/Image_lib.php index 7f905128b..21ec2cb4b 100644 --- a/system/libraries/Image_lib.php +++ b/system/libraries/Image_lib.php @@ -104,7 +104,7 @@ class CI_Image_lib { */ function clear() { - $props = array('source_folder', 'dest_folder', 'source_image', 'full_src_path', 'full_dst_path', 'new_image', 'image_type', 'size_str', 'quality', 'orig_width', 'orig_height', 'rotation_angle', 'x_axis', 'y_axis', 'create_fnc', 'copy_fnc', 'wm_overlay_path', 'wm_use_truetype', 'dynamic_output', 'wm_font_size', 'wm_text', 'wm_vrt_alignment', 'wm_hor_alignment', 'wm_padding', 'wm_hor_offset', 'wm_vrt_offset', 'wm_font_color', 'wm_use_drop_shadow', 'wm_shadow_color', 'wm_shadow_distance', 'wm_opacity'); + $props = array('source_folder', 'dest_folder', 'source_image', 'full_src_path', 'full_dst_path', 'new_image', 'image_type', 'size_str', 'quality', 'orig_width', 'orig_height', 'width', 'height', 'rotation_angle', 'x_axis', 'y_axis', 'create_fnc', 'copy_fnc', 'wm_overlay_path', 'wm_use_truetype', 'dynamic_output', 'wm_font_size', 'wm_text', 'wm_vrt_alignment', 'wm_hor_alignment', 'wm_padding', 'wm_hor_offset', 'wm_vrt_offset', 'wm_font_color', 'wm_use_drop_shadow', 'wm_shadow_color', 'wm_shadow_distance', 'wm_opacity'); foreach ($props as $val) { -- cgit v1.2.3-24-g4f1b From da33cb5df443c41dce75cdf756ea4c3234b510fb Mon Sep 17 00:00:00 2001 From: Phil Sturgeon Date: Sun, 27 May 2012 20:28:18 +0100 Subject: Driver_Library had $lib_name set as static, and used non-static --- system/libraries/Driver.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'system/libraries') diff --git a/system/libraries/Driver.php b/system/libraries/Driver.php index 9881c1eec..a199d45f0 100644 --- a/system/libraries/Driver.php +++ b/system/libraries/Driver.php @@ -30,7 +30,7 @@ class CI_Driver_Library { protected $valid_drivers = array(); - protected static $lib_name; + protected $lib_name; // The first time a child is used it won't exist, so we instantiate it // subsequents calls will go straight to the proper child. -- cgit v1.2.3-24-g4f1b From 0a14913fe54e269e535c1f66f715823fa731c843 Mon Sep 17 00:00:00 2001 From: Pascal Kriete Date: Thu, 7 Jun 2012 16:15:51 -0400 Subject: Adding IPv6 support to the Input and Form_validation libraries. --- system/libraries/Form_validation.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'system/libraries') diff --git a/system/libraries/Form_validation.php b/system/libraries/Form_validation.php index a34809e05..9aab5da4b 100644 --- a/system/libraries/Form_validation.php +++ b/system/libraries/Form_validation.php @@ -1079,11 +1079,12 @@ class CI_Form_validation { * * @access public * @param string + * @param string "ipv4" or "ipv6" to validate a specific ip format * @return string */ - public function valid_ip($ip) + public function valid_ip($ip, $which = '') { - return $this->CI->input->valid_ip($ip); + return $this->CI->input->valid_ip($ip, $which); } // -------------------------------------------------------------------- -- cgit v1.2.3-24-g4f1b