From a72b60d96cbdbfc10fbe20d2c4a3c4a62358b4d3 Mon Sep 17 00:00:00 2001 From: Derek Allard Date: Wed, 31 Jan 2007 23:56:11 +0000 Subject: removed unescaped variable that could be used in XSS --- system/libraries/Input.php | 1278 +++++++++++++++++++++---------------------- system/libraries/Router.php | 1120 ++++++++++++++++++------------------- 2 files changed, 1199 insertions(+), 1199 deletions(-) (limited to 'system/libraries') diff --git a/system/libraries/Input.php b/system/libraries/Input.php index 4fd2061c7..f346cabaa 100644 --- a/system/libraries/Input.php +++ b/system/libraries/Input.php @@ -1,640 +1,640 @@ -use_xss_clean = ($CFG->item('global_xss_filtering') === TRUE) ? TRUE : FALSE; - $this->allow_get_array = ($CFG->item('enable_query_strings') === TRUE) ? TRUE : FALSE; - $this->_sanitize_globals(); - } - - // -------------------------------------------------------------------- - - /** - * Sanitize Globals - * - * This function does the following: - * - * Unsets $_GET data (if query strings are not enabled) - * - * Unsets all globals if register_globals is enabled - * - * Standardizes newline characters to \n - * - * @access private - * @return void - */ - function _sanitize_globals() - { - // Unset globals. This is effectively the same as register_globals = off - foreach (array($_GET, $_POST, $_COOKIE) as $global) - { - if ( ! is_array($global)) - { - global $global; - $$global = NULL; - } - else - { - foreach ($global as $key => $val) - { - global $$key; - $$key = NULL; - } - } - } - - // Is $_GET data allowed? If not we'll set the $_GET to an empty array - if ($this->allow_get_array == FALSE) - { - $_GET = array(); - } - - // Clean $_POST Data - if (is_array($_POST) AND count($_POST) > 0) - { - foreach($_POST as $key => $val) - { - $_POST[$this->_clean_input_keys($key)] = $this->_clean_input_data($val); - } - } - - // Clean $_COOKIE Data - if (is_array($_COOKIE) AND count($_COOKIE) > 0) - { - foreach($_COOKIE as $key => $val) - { - $_COOKIE[$this->_clean_input_keys($key)] = $this->_clean_input_data($val); - } - } - - log_message('debug', "Global POST and COOKIE data sanitized"); - } - - // -------------------------------------------------------------------- - - /** - * Clean Input Data - * - * This is a helper function. It escapes data and - * standardizes newline characters to \n - * - * @access private - * @param string - * @return string - */ - function _clean_input_data($str) - { - if (is_array($str)) - { - $new_array = array(); - foreach ($str as $key => $val) - { - $new_array[$this->_clean_input_keys($key)] = $this->_clean_input_data($val); - } - return $new_array; - } - - if ($this->use_xss_clean === TRUE) - { - $str = $this->xss_clean($str); - } - - // Standardize newlines - return preg_replace("/\015\012|\015|\012/", "\n", $str); - } - - // -------------------------------------------------------------------- - - /** - * Clean Keys - * - * This is a helper function. To prevent malicious users - * from trying to exploit keys we make sure that keys are - * only named with alpha-numeric text and a few other items. - * - * @access private - * @param string - * @return string - */ - function _clean_input_keys($str) - { - if ( ! preg_match("/^[a-z0-9:_\/-]+$/i", $str)) - { - exit('Disallowed Key Characters: '.$str); - } - - if ( ! get_magic_quotes_gpc()) - { - return addslashes($str); - } - - return $str; - } - - // -------------------------------------------------------------------- - - /** - * Fetch an item from the POST array - * - * @access public - * @param string - * @param bool - * @return string - */ - function post($index = '', $xss_clean = FALSE) - { - if ( ! isset($_POST[$index])) - { - return FALSE; - } - - if ($xss_clean === TRUE) - { - if (is_array($_POST[$index])) - { - foreach($_POST[$index] as $key => $val) - { - $_POST[$index][$key] = $this->xss_clean($val); - } - } - else - { - return $this->xss_clean($_POST[$index]); - } - } - - return $_POST[$index]; - } - - // -------------------------------------------------------------------- - - /** - * Fetch an item from the COOKIE array - * - * @access public - * @param string - * @param bool - * @return string - */ - function cookie($index = '', $xss_clean = FALSE) - { - if ( ! isset($_COOKIE[$index])) - { - return FALSE; - } - - if ($xss_clean === TRUE) - { - if (is_array($_COOKIE[$index])) - { - $cookie = array(); - foreach($_COOKIE[$index] as $key => $val) - { - $cookie[$key] = $this->xss_clean($val); - } - - return $cookie; - } - else - { - return $this->xss_clean($_COOKIE[$index]); - } - } - else - { - return $_COOKIE[$index]; - } - } - - // -------------------------------------------------------------------- - - /** - * Fetch an item from the SERVER array - * - * @access public - * @param string - * @param bool - * @return string - */ - function server($index = '', $xss_clean = FALSE) - { - if ( ! isset($_SERVER[$index])) - { - return FALSE; - } - - if ($xss_clean === TRUE) - { - return $this->xss_clean($_SERVER[$index]); - } - - return $_SERVER[$index]; - } - - // -------------------------------------------------------------------- - - /** - * Fetch the IP Address - * - * @access public - * @return string - */ - function ip_address() - { - if ($this->ip_address !== FALSE) - { - return $this->ip_address; - } - - if ($this->server('REMOTE_ADDR') AND $this->server('HTTP_CLIENT_IP')) - { - $this->ip_address = $_SERVER['HTTP_CLIENT_IP']; - } - elseif ($this->server('REMOTE_ADDR')) - { - $this->ip_address = $_SERVER['REMOTE_ADDR']; - } - elseif ($this->server('HTTP_CLIENT_IP')) - { - $this->ip_address = $_SERVER['HTTP_CLIENT_IP']; - } - elseif ($this->server('HTTP_X_FORWARDED_FOR')) - { - $this->ip_address = $_SERVER['HTTP_X_FORWARDED_FOR']; - } - - if ($this->ip_address === FALSE) - { - $this->ip_address = '0.0.0.0'; - return $this->ip_address; - } - - if (strstr($this->ip_address, ',')) - { - $x = explode(',', $this->ip_address); - $this->ip_address = end($x); - } - - if ( ! $this->valid_ip($this->ip_address)) - { - $this->ip_address = '0.0.0.0'; - } - - return $this->ip_address; - } - - // -------------------------------------------------------------------- - - /** - * Validate IP Address - * - * @access public - * @param string - * @return string - */ - function valid_ip($ip) - { - return ( ! preg_match( "/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/", $ip)) ? FALSE : TRUE; - } - - // -------------------------------------------------------------------- - - /** - * User Agent - * - * @access public - * @return string - */ - function user_agent() - { - if ($this->user_agent !== FALSE) - { - return $this->user_agent; - } - - $this->user_agent = ( ! isset($_SERVER['HTTP_USER_AGENT'])) ? FALSE : $_SERVER['HTTP_USER_AGENT']; - - return $this->user_agent; - } - - // -------------------------------------------------------------------- - - /** - * XSS Clean - * - * Sanitizes data so that Cross Site Scripting Hacks can be - * prevented.  This function does a fair amount of work but - * it is extremely thorough, designed to prevent even the - * most obscure XSS attempts.  Nothing is ever 100% foolproof, - * of course, but I haven't been able to get anything passed - * the filter. - * - * Note: This function should only be used to deal with data - * upon submission.  It's not something that should - * be used for general runtime processing. - * - * This function was based in part on some code and ideas I - * got from Bitflux: http://blog.bitflux.ch/wiki/XSS_Prevention - * - * To help develop this script I used this great list of - * vulnerabilities along with a few other hacks I've - * harvested from examining vulnerabilities in other programs: - * http://ha.ckers.org/xss.html - * - * @access public - * @param string - * @return string - */ - function xss_clean($str, $charset = 'ISO-8859-1') - { - /* - * Remove Null Characters - * - * This prevents sandwiching null characters - * between ascii characters, like Java\0script. - * - */ - $str = preg_replace('/\0+/', '', $str); - $str = preg_replace('/(\\\\0)+/', '', $str); - - /* - * Validate standard character entities - * - * Add a semicolon if missing. We do this to enable - * the conversion of entities to ASCII later. - * - */ - $str = preg_replace('#(&\#*\w+)[\x00-\x20]+;#u',"\\1;",$str); - - /* - * Validate UTF16 two byte encoding (x00) - * - * Just as above, adds a semicolon if missing. - * - */ - $str = preg_replace('#(&\#x*)([0-9A-F]+);*#iu',"\\1\\2;",$str); - - /* - * URL Decode - * - * Just in case stuff like this is submitted: - * - * Google - * - * Note: Normally urldecode() would be easier but it removes plus signs - * - */ - $str = preg_replace("/%u0([a-z0-9]{3})/i", "&#x\\1;", $str); - $str = preg_replace("/%([a-z0-9]{2})/i", "&#x\\1;", $str); - - /* - * Convert character entities to ASCII - * - * This permits our tests below to work reliably. - * We only convert entities that are within tags since - * these are the ones that will pose security problems. - * - */ - if (preg_match_all("/<(.+?)>/si", $str, $matches)) - { - for ($i = 0; $i < count($matches['0']); $i++) - { - $str = str_replace($matches['1'][$i], - $this->_html_entity_decode($matches['1'][$i], $charset), - $str); - } - } - - /* - * Not Allowed Under Any Conditions - */ - $bad = array( - 'document.cookie' => '[removed]', - 'document.write' => '[removed]', - 'window.location' => '[removed]', - "javascript\s*:" => '[removed]', - "Redirect\s+302" => '[removed]', - '' => '-->' - ); - - foreach ($bad as $key => $val) - { - $str = preg_replace("#".$key."#i", $val, $str); - } - - /* - * Convert all tabs to spaces - * - * This prevents strings like this: ja vascript - * Note: we deal with spaces between characters later. - * - */ - $str = preg_replace("#\t+#", " ", $str); - - /* - * Makes PHP tags safe - * - * Note: XML tags are inadvertently replaced too: - * - * '), array('<?php', '<?PHP', '<?', '?>'), $str); - - /* - * Compact any exploded words - * - * This corrects words like: j a v a s c r i p t - * These words are compacted back to their correct state. - * - */ - $words = array('javascript', 'vbscript', 'script', 'applet', 'alert', 'document', 'write', 'cookie', 'window'); - foreach ($words as $word) - { - $temp = ''; - for ($i = 0; $i < strlen($word); $i++) - { - $temp .= substr($word, $i, 1)."\s*"; - } - - $temp = substr($temp, 0, -3); - $str = preg_replace('#'.$temp.'#s', $word, $str); - $str = preg_replace('#'.ucfirst($temp).'#s', ucfirst($word), $str); - } - - /* - * Remove disallowed Javascript in links or img tags - */ - $str = preg_replace("#.*?#si", "", $str); - $str = preg_replace("##si", "", $str); - $str = preg_replace("#<(script|xss).*?\>#si", "", $str); - - /* - * Remove JavaScript Event Handlers - * - * Note: This code is a little blunt. It removes - * the event handler and anything up to the closing >, - * but it's unlikely to be a problem. - * - */ - $str = preg_replace('#(<[^>]+.*?)(onblur|onchange|onclick|onfocus|onload|onmouseover|onmouseup|onmousedown|onselect|onsubmit|onunload|onkeypress|onkeydown|onkeyup|onresize)[^>]*>#iU',"\\1>",$str); - - /* - * Sanitize naughty HTML elements - * - * If a tag containing any of the words in the list - * below is found, the tag gets converted to entities. - * - * So this: - * Becomes: <blink> - * - */ - $str = preg_replace('#<(/*\s*)(alert|applet|basefont|base|behavior|bgsound|blink|body|embed|expression|form|frameset|frame|head|html|ilayer|iframe|input|layer|link|meta|object|plaintext|style|script|textarea|title|xml|xss)([^>]*)>#is', "<\\1\\2\\3>", $str); - - /* - * Sanitize naughty scripting elements - * - * Similar to above, only instead of looking for - * tags it looks for PHP and JavaScript commands - * that are disallowed. Rather than removing the - * code, it simply converts the parenthesis to entities - * rendering the code un-executable. - * - * For example: eval('some code') - * Becomes: eval('some code') - * - */ - $str = preg_replace('#(alert|cmd|passthru|eval|exec|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si', "\\1\\2(\\3)", $str); - - /* - * Final clean up - * - * This adds a bit of extra precaution in case - * something got through the above filters - * - */ - $bad = array( - 'document.cookie' => '[removed]', - 'document.write' => '[removed]', - 'window.location' => '[removed]', - "javascript\s*:" => '[removed]', - "Redirect\s+302" => '[removed]', - '' => '-->' - ); - - foreach ($bad as $key => $val) - { - $str = preg_replace("#".$key."#i", $val, $str); - } - - - log_message('debug', "XSS Filtering completed"); - return $str; - } - - // -------------------------------------------------------------------- - - /** - * HTML Entities Decode - * - * This function is a replacement for html_entity_decode() - * - * In some versions of PHP the native function does not work - * when UTF-8 is the specified character set, so this gives us - * a work-around. More info here: - * http://bugs.php.net/bug.php?id=25670 - * - * @access private - * @param string - * @param string - * @return string - */ - /* ------------------------------------------------- - /* Replacement for html_entity_decode() - /* -------------------------------------------------*/ - - /* - NOTE: html_entity_decode() has a bug in some PHP versions when UTF-8 is the - character set, and the PHP developers said they were not back porting the - fix to versions other than PHP 5.x. - */ - function _html_entity_decode($str, $charset='ISO-8859-1') - { - if (stristr($str, '&') === FALSE) return $str; - - // The reason we are not using html_entity_decode() by itself is because - // while it is not technically correct to leave out the semicolon - // at the end of an entity most browsers will still interpret the entity - // correctly. html_entity_decode() does not convert entities without - // semicolons, so we are left with our own little solution here. Bummer. - - if (function_exists('html_entity_decode') && (strtolower($charset) != 'utf-8' OR version_compare(phpversion(), '5.0.0', '>='))) - { - $str = html_entity_decode($str, ENT_COMPAT, $charset); - $str = preg_replace('~&#x([0-9a-f]{2,5})~ei', 'chr(hexdec("\\1"))', $str); - return preg_replace('~&#([0-9]{2,4})~e', 'chr(\\1)', $str); - } - - // Numeric Entities - $str = preg_replace('~&#x([0-9a-f]{2,5});{0,1}~ei', 'chr(hexdec("\\1"))', $str); - $str = preg_replace('~&#([0-9]{2,4});{0,1}~e', 'chr(\\1)', $str); - - // Literal Entities - Slightly slow so we do another check - if (stristr($str, '&') === FALSE) - { - $str = strtr($str, array_flip(get_html_translation_table(HTML_ENTITIES))); - } - - return $str; - } - -} -// END Input class +use_xss_clean = ($CFG->item('global_xss_filtering') === TRUE) ? TRUE : FALSE; + $this->allow_get_array = ($CFG->item('enable_query_strings') === TRUE) ? TRUE : FALSE; + $this->_sanitize_globals(); + } + + // -------------------------------------------------------------------- + + /** + * Sanitize Globals + * + * This function does the following: + * + * Unsets $_GET data (if query strings are not enabled) + * + * Unsets all globals if register_globals is enabled + * + * Standardizes newline characters to \n + * + * @access private + * @return void + */ + function _sanitize_globals() + { + // Unset globals. This is effectively the same as register_globals = off + foreach (array($_GET, $_POST, $_COOKIE) as $global) + { + if ( ! is_array($global)) + { + global $global; + $$global = NULL; + } + else + { + foreach ($global as $key => $val) + { + global $$key; + $$key = NULL; + } + } + } + + // Is $_GET data allowed? If not we'll set the $_GET to an empty array + if ($this->allow_get_array == FALSE) + { + $_GET = array(); + } + + // Clean $_POST Data + if (is_array($_POST) AND count($_POST) > 0) + { + foreach($_POST as $key => $val) + { + $_POST[$this->_clean_input_keys($key)] = $this->_clean_input_data($val); + } + } + + // Clean $_COOKIE Data + if (is_array($_COOKIE) AND count($_COOKIE) > 0) + { + foreach($_COOKIE as $key => $val) + { + $_COOKIE[$this->_clean_input_keys($key)] = $this->_clean_input_data($val); + } + } + + log_message('debug', "Global POST and COOKIE data sanitized"); + } + + // -------------------------------------------------------------------- + + /** + * Clean Input Data + * + * This is a helper function. It escapes data and + * standardizes newline characters to \n + * + * @access private + * @param string + * @return string + */ + function _clean_input_data($str) + { + if (is_array($str)) + { + $new_array = array(); + foreach ($str as $key => $val) + { + $new_array[$this->_clean_input_keys($key)] = $this->_clean_input_data($val); + } + return $new_array; + } + + if ($this->use_xss_clean === TRUE) + { + $str = $this->xss_clean($str); + } + + // Standardize newlines + return preg_replace("/\015\012|\015|\012/", "\n", $str); + } + + // -------------------------------------------------------------------- + + /** + * Clean Keys + * + * This is a helper function. To prevent malicious users + * from trying to exploit keys we make sure that keys are + * only named with alpha-numeric text and a few other items. + * + * @access private + * @param string + * @return string + */ + function _clean_input_keys($str) + { + if ( ! preg_match("/^[a-z0-9:_\/-]+$/i", $str)) + { + exit('Disallowed Key Characters.'); + } + + if ( ! get_magic_quotes_gpc()) + { + return addslashes($str); + } + + return $str; + } + + // -------------------------------------------------------------------- + + /** + * Fetch an item from the POST array + * + * @access public + * @param string + * @param bool + * @return string + */ + function post($index = '', $xss_clean = FALSE) + { + if ( ! isset($_POST[$index])) + { + return FALSE; + } + + if ($xss_clean === TRUE) + { + if (is_array($_POST[$index])) + { + foreach($_POST[$index] as $key => $val) + { + $_POST[$index][$key] = $this->xss_clean($val); + } + } + else + { + return $this->xss_clean($_POST[$index]); + } + } + + return $_POST[$index]; + } + + // -------------------------------------------------------------------- + + /** + * Fetch an item from the COOKIE array + * + * @access public + * @param string + * @param bool + * @return string + */ + function cookie($index = '', $xss_clean = FALSE) + { + if ( ! isset($_COOKIE[$index])) + { + return FALSE; + } + + if ($xss_clean === TRUE) + { + if (is_array($_COOKIE[$index])) + { + $cookie = array(); + foreach($_COOKIE[$index] as $key => $val) + { + $cookie[$key] = $this->xss_clean($val); + } + + return $cookie; + } + else + { + return $this->xss_clean($_COOKIE[$index]); + } + } + else + { + return $_COOKIE[$index]; + } + } + + // -------------------------------------------------------------------- + + /** + * Fetch an item from the SERVER array + * + * @access public + * @param string + * @param bool + * @return string + */ + function server($index = '', $xss_clean = FALSE) + { + if ( ! isset($_SERVER[$index])) + { + return FALSE; + } + + if ($xss_clean === TRUE) + { + return $this->xss_clean($_SERVER[$index]); + } + + return $_SERVER[$index]; + } + + // -------------------------------------------------------------------- + + /** + * Fetch the IP Address + * + * @access public + * @return string + */ + function ip_address() + { + if ($this->ip_address !== FALSE) + { + return $this->ip_address; + } + + if ($this->server('REMOTE_ADDR') AND $this->server('HTTP_CLIENT_IP')) + { + $this->ip_address = $_SERVER['HTTP_CLIENT_IP']; + } + elseif ($this->server('REMOTE_ADDR')) + { + $this->ip_address = $_SERVER['REMOTE_ADDR']; + } + elseif ($this->server('HTTP_CLIENT_IP')) + { + $this->ip_address = $_SERVER['HTTP_CLIENT_IP']; + } + elseif ($this->server('HTTP_X_FORWARDED_FOR')) + { + $this->ip_address = $_SERVER['HTTP_X_FORWARDED_FOR']; + } + + if ($this->ip_address === FALSE) + { + $this->ip_address = '0.0.0.0'; + return $this->ip_address; + } + + if (strstr($this->ip_address, ',')) + { + $x = explode(',', $this->ip_address); + $this->ip_address = end($x); + } + + if ( ! $this->valid_ip($this->ip_address)) + { + $this->ip_address = '0.0.0.0'; + } + + return $this->ip_address; + } + + // -------------------------------------------------------------------- + + /** + * Validate IP Address + * + * @access public + * @param string + * @return string + */ + function valid_ip($ip) + { + return ( ! preg_match( "/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/", $ip)) ? FALSE : TRUE; + } + + // -------------------------------------------------------------------- + + /** + * User Agent + * + * @access public + * @return string + */ + function user_agent() + { + if ($this->user_agent !== FALSE) + { + return $this->user_agent; + } + + $this->user_agent = ( ! isset($_SERVER['HTTP_USER_AGENT'])) ? FALSE : $_SERVER['HTTP_USER_AGENT']; + + return $this->user_agent; + } + + // -------------------------------------------------------------------- + + /** + * XSS Clean + * + * Sanitizes data so that Cross Site Scripting Hacks can be + * prevented.  This function does a fair amount of work but + * it is extremely thorough, designed to prevent even the + * most obscure XSS attempts.  Nothing is ever 100% foolproof, + * of course, but I haven't been able to get anything passed + * the filter. + * + * Note: This function should only be used to deal with data + * upon submission.  It's not something that should + * be used for general runtime processing. + * + * This function was based in part on some code and ideas I + * got from Bitflux: http://blog.bitflux.ch/wiki/XSS_Prevention + * + * To help develop this script I used this great list of + * vulnerabilities along with a few other hacks I've + * harvested from examining vulnerabilities in other programs: + * http://ha.ckers.org/xss.html + * + * @access public + * @param string + * @return string + */ + function xss_clean($str, $charset = 'ISO-8859-1') + { + /* + * Remove Null Characters + * + * This prevents sandwiching null characters + * between ascii characters, like Java\0script. + * + */ + $str = preg_replace('/\0+/', '', $str); + $str = preg_replace('/(\\\\0)+/', '', $str); + + /* + * Validate standard character entities + * + * Add a semicolon if missing. We do this to enable + * the conversion of entities to ASCII later. + * + */ + $str = preg_replace('#(&\#*\w+)[\x00-\x20]+;#u',"\\1;",$str); + + /* + * Validate UTF16 two byte encoding (x00) + * + * Just as above, adds a semicolon if missing. + * + */ + $str = preg_replace('#(&\#x*)([0-9A-F]+);*#iu',"\\1\\2;",$str); + + /* + * URL Decode + * + * Just in case stuff like this is submitted: + * + * Google + * + * Note: Normally urldecode() would be easier but it removes plus signs + * + */ + $str = preg_replace("/%u0([a-z0-9]{3})/i", "&#x\\1;", $str); + $str = preg_replace("/%([a-z0-9]{2})/i", "&#x\\1;", $str); + + /* + * Convert character entities to ASCII + * + * This permits our tests below to work reliably. + * We only convert entities that are within tags since + * these are the ones that will pose security problems. + * + */ + if (preg_match_all("/<(.+?)>/si", $str, $matches)) + { + for ($i = 0; $i < count($matches['0']); $i++) + { + $str = str_replace($matches['1'][$i], + $this->_html_entity_decode($matches['1'][$i], $charset), + $str); + } + } + + /* + * Not Allowed Under Any Conditions + */ + $bad = array( + 'document.cookie' => '[removed]', + 'document.write' => '[removed]', + 'window.location' => '[removed]', + "javascript\s*:" => '[removed]', + "Redirect\s+302" => '[removed]', + '' => '-->' + ); + + foreach ($bad as $key => $val) + { + $str = preg_replace("#".$key."#i", $val, $str); + } + + /* + * Convert all tabs to spaces + * + * This prevents strings like this: ja vascript + * Note: we deal with spaces between characters later. + * + */ + $str = preg_replace("#\t+#", " ", $str); + + /* + * Makes PHP tags safe + * + * Note: XML tags are inadvertently replaced too: + * + * '), array('<?php', '<?PHP', '<?', '?>'), $str); + + /* + * Compact any exploded words + * + * This corrects words like: j a v a s c r i p t + * These words are compacted back to their correct state. + * + */ + $words = array('javascript', 'vbscript', 'script', 'applet', 'alert', 'document', 'write', 'cookie', 'window'); + foreach ($words as $word) + { + $temp = ''; + for ($i = 0; $i < strlen($word); $i++) + { + $temp .= substr($word, $i, 1)."\s*"; + } + + $temp = substr($temp, 0, -3); + $str = preg_replace('#'.$temp.'#s', $word, $str); + $str = preg_replace('#'.ucfirst($temp).'#s', ucfirst($word), $str); + } + + /* + * Remove disallowed Javascript in links or img tags + */ + $str = preg_replace("#.*?#si", "", $str); + $str = preg_replace("##si", "", $str); + $str = preg_replace("#<(script|xss).*?\>#si", "", $str); + + /* + * Remove JavaScript Event Handlers + * + * Note: This code is a little blunt. It removes + * the event handler and anything up to the closing >, + * but it's unlikely to be a problem. + * + */ + $str = preg_replace('#(<[^>]+.*?)(onblur|onchange|onclick|onfocus|onload|onmouseover|onmouseup|onmousedown|onselect|onsubmit|onunload|onkeypress|onkeydown|onkeyup|onresize)[^>]*>#iU',"\\1>",$str); + + /* + * Sanitize naughty HTML elements + * + * If a tag containing any of the words in the list + * below is found, the tag gets converted to entities. + * + * So this: + * Becomes: <blink> + * + */ + $str = preg_replace('#<(/*\s*)(alert|applet|basefont|base|behavior|bgsound|blink|body|embed|expression|form|frameset|frame|head|html|ilayer|iframe|input|layer|link|meta|object|plaintext|style|script|textarea|title|xml|xss)([^>]*)>#is', "<\\1\\2\\3>", $str); + + /* + * Sanitize naughty scripting elements + * + * Similar to above, only instead of looking for + * tags it looks for PHP and JavaScript commands + * that are disallowed. Rather than removing the + * code, it simply converts the parenthesis to entities + * rendering the code un-executable. + * + * For example: eval('some code') + * Becomes: eval('some code') + * + */ + $str = preg_replace('#(alert|cmd|passthru|eval|exec|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si', "\\1\\2(\\3)", $str); + + /* + * Final clean up + * + * This adds a bit of extra precaution in case + * something got through the above filters + * + */ + $bad = array( + 'document.cookie' => '[removed]', + 'document.write' => '[removed]', + 'window.location' => '[removed]', + "javascript\s*:" => '[removed]', + "Redirect\s+302" => '[removed]', + '' => '-->' + ); + + foreach ($bad as $key => $val) + { + $str = preg_replace("#".$key."#i", $val, $str); + } + + + log_message('debug', "XSS Filtering completed"); + return $str; + } + + // -------------------------------------------------------------------- + + /** + * HTML Entities Decode + * + * This function is a replacement for html_entity_decode() + * + * In some versions of PHP the native function does not work + * when UTF-8 is the specified character set, so this gives us + * a work-around. More info here: + * http://bugs.php.net/bug.php?id=25670 + * + * @access private + * @param string + * @param string + * @return string + */ + /* ------------------------------------------------- + /* Replacement for html_entity_decode() + /* -------------------------------------------------*/ + + /* + NOTE: html_entity_decode() has a bug in some PHP versions when UTF-8 is the + character set, and the PHP developers said they were not back porting the + fix to versions other than PHP 5.x. + */ + function _html_entity_decode($str, $charset='ISO-8859-1') + { + if (stristr($str, '&') === FALSE) return $str; + + // The reason we are not using html_entity_decode() by itself is because + // while it is not technically correct to leave out the semicolon + // at the end of an entity most browsers will still interpret the entity + // correctly. html_entity_decode() does not convert entities without + // semicolons, so we are left with our own little solution here. Bummer. + + if (function_exists('html_entity_decode') && (strtolower($charset) != 'utf-8' OR version_compare(phpversion(), '5.0.0', '>='))) + { + $str = html_entity_decode($str, ENT_COMPAT, $charset); + $str = preg_replace('~&#x([0-9a-f]{2,5})~ei', 'chr(hexdec("\\1"))', $str); + return preg_replace('~&#([0-9]{2,4})~e', 'chr(\\1)', $str); + } + + // Numeric Entities + $str = preg_replace('~&#x([0-9a-f]{2,5});{0,1}~ei', 'chr(hexdec("\\1"))', $str); + $str = preg_replace('~&#([0-9]{2,4});{0,1}~e', 'chr(\\1)', $str); + + // Literal Entities - Slightly slow so we do another check + if (stristr($str, '&') === FALSE) + { + $str = strtr($str, array_flip(get_html_translation_table(HTML_ENTITIES))); + } + + return $str; + } + +} +// END Input class ?> \ No newline at end of file diff --git a/system/libraries/Router.php b/system/libraries/Router.php index 6d925a1c0..8dfc82580 100644 --- a/system/libraries/Router.php +++ b/system/libraries/Router.php @@ -1,561 +1,561 @@ -config =& load_class('Config'); - $this->_set_route_mapping(); - log_message('debug', "Router Class Initialized"); - } - - // -------------------------------------------------------------------- - - /** - * Set the route mapping - * - * This function determines what should be served based on the URI request, - * as well as any "routes" that have been set in the routing config file. - * - * @access private - * @return void - */ - function _set_route_mapping() - { - // Are query strings enabled in the config file? - // If so, we're done since segment based URIs are not used with query strings. - if ($this->config->item('enable_query_strings') === TRUE AND isset($_GET[$this->config->item('controller_trigger')])) - { - $this->set_class($_GET[$this->config->item('controller_trigger')]); - - if (isset($_GET[$this->config->item('function_trigger')])) - { - $this->set_method($_GET[$this->config->item('function_trigger')]); - } - - return; - } - - // Load the routes.php file. - @include(APPPATH.'config/routes'.EXT); - $this->routes = ( ! isset($route) OR ! is_array($route)) ? array() : $route; - unset($route); - - // Set the default controller so we can display it in the event - // the URI doesn't correlated to a valid controller. - $this->default_controller = ( ! isset($this->routes['default_controller']) OR $this->routes['default_controller'] == '') ? FALSE : strtolower($this->routes['default_controller']); - - // Fetch the complete URI string - $this->uri_string = $this->_get_uri_string(); - - // If the URI contains only a slash we'll kill it - if ($this->uri_string == '/') - { - $this->uri_string = ''; - } - - // Is there a URI string? If not, the default controller specified in the "routes" file will be shown. - if ($this->uri_string == '') - { - if ($this->default_controller === FALSE) - { - show_error("Unable to determine what should be displayed. A default route has not been specified in the routing file."); - } - - $this->set_class($this->default_controller); - $this->set_method('index'); - - log_message('debug', "No URI present. Default controller set."); - return; - } - unset($this->routes['default_controller']); - - // Do we need to remove the suffix specified in the config file? - if ($this->config->item('url_suffix') != "") - { - $this->uri_string = preg_replace("|".preg_quote($this->config->item('url_suffix'))."$|", "", $this->uri_string); - } - - // Explode the URI Segments. The individual segments will - // be stored in the $this->segments array. - foreach(explode("/", preg_replace("|/*(.+?)/*$|", "\\1", $this->uri_string)) as $val) - { - // Filter segments for security - $val = trim($this->_filter_uri($val)); - - if ($val != '') - $this->segments[] = $val; - } - - // Parse any custom routing that may exist - $this->_parse_routes(); - - // Re-index the segment array so that it starts with 1 rather than 0 - $this->_reindex_segments(); - } - - // -------------------------------------------------------------------- - - /** - * Compile Segments - * - * This function takes an array of URI segments as - * input, and puts it into the $this->segments array. - * It also sets the current class/method - * - * @access private - * @param array - * @param bool - * @return void - */ - function _compile_segments($segments = array()) - { - $segments = $this->_validate_segments($segments); - - if (count($segments) == 0) - { - return; - } - - $this->set_class($segments[0]); - - if (isset($segments[1])) - { - // A scaffolding request. No funny business with the URL - if ($this->routes['scaffolding_trigger'] == $segments[1] AND $segments[1] != '_ci_scaffolding') - { - $this->scaffolding_request = TRUE; - unset($this->routes['scaffolding_trigger']); - } - else - { - // A standard method request - $this->set_method($segments[1]); - } - } - - // Update our "routed" segment array to contain the segments. - // Note: If there is no custom routing, this array will be - // identical to $this->segments - $this->rsegments = $segments; - } - - // -------------------------------------------------------------------- - - /** - * Validates the supplied segments. Attempts to determine the path to - * the controller. - * - * @access private - * @param array - * @return array - */ - function _validate_segments($segments) - { - // Does the requested controller exist in the root folder? - if (file_exists(APPPATH.'controllers/'.$segments[0].EXT)) - { - return $segments; - } - - // Is the controller in a sub-folder? - if (is_dir(APPPATH.'controllers/'.$segments[0])) - { - // Set the directory and remove it from the segment array - $this->set_directory($segments[0]); - $segments = array_slice($segments, 1); - - if (count($segments) > 0) - { - // Does the requested controller exist in the sub-folder? - if ( ! file_exists(APPPATH.'controllers/'.$this->fetch_directory().$segments[0].EXT)) - { - show_404(); - } - } - else - { - $this->set_class($this->default_controller); - $this->set_method('index'); - - // Does the default controller exist in the sub-folder? - if ( ! file_exists(APPPATH.'controllers/'.$this->fetch_directory().$this->default_controller.EXT)) - { - $this->directory = ''; - return array(); - } - - } - - return $segments; - } - - // Can't find the requested controller... - show_404(); - } - - // -------------------------------------------------------------------- - /** - * Re-index Segments - * - * This function re-indexes the $this->segment array so that it - * starts at 1 rather then 0. Doing so makes it simpler to - * use functions like $this->uri->segment(n) since there is - * a 1:1 relationship between the segment array and the actual segments. - * - * @access private - * @return void - */ - function _reindex_segments() - { - // Is the routed segment array different then the main segment array? - $diff = (count(array_diff($this->rsegments, $this->segments)) == 0) ? FALSE : TRUE; - - $i = 1; - foreach ($this->segments as $val) - { - $this->segments[$i++] = $val; - } - unset($this->segments[0]); - - if ($diff == FALSE) - { - $this->rsegments = $this->segments; - } - else - { - $i = 1; - foreach ($this->rsegments as $val) - { - $this->rsegments[$i++] = $val; - } - unset($this->rsegments[0]); - } - } - - // -------------------------------------------------------------------- - - /** - * Get the URI String - * - * @access private - * @return string - */ - function _get_uri_string() - { - if (strtoupper($this->config->item('uri_protocol')) == 'AUTO') - { - // If the URL has a question mark then it's simplest to just - // build the URI string from the zero index of the $_GET array. - // This avoids having to deal with $_SERVER variables, which - // can be unreliable in some environments - if (is_array($_GET) AND count($_GET) == 1) - { - // Note: Due to a bug in current() that affects some versions - // of PHP we can not pass function call directly into it - $keys = array_keys($_GET); - return current($keys); - } - - // Is there a PATH_INFO variable? - // Note: some servers seem to have trouble with getenv() so we'll test it two ways - $path = (isset($_SERVER['PATH_INFO'])) ? $_SERVER['PATH_INFO'] : @getenv('PATH_INFO'); - if ($path != '' AND $path != "/".SELF) - { - return $path; - } - - // No PATH_INFO?... What about QUERY_STRING? - $path = (isset($_SERVER['QUERY_STRING'])) ? $_SERVER['QUERY_STRING'] : @getenv('QUERY_STRING'); - if ($path != '') - { - return $path; - } - - // No QUERY_STRING?... Maybe the ORIG_PATH_INFO variable exists? - $path = (isset($_SERVER['ORIG_PATH_INFO'])) ? $_SERVER['ORIG_PATH_INFO'] : @getenv('ORIG_PATH_INFO'); - if ($path != '' AND $path != "/".SELF) - { - return $path; - } - - // We've exhausted all our options... - return ''; - } - else - { - $uri = strtoupper($this->config->item('uri_protocol')); - - if ($uri == 'REQUEST_URI') - { - return $this->_parse_request_uri(); - } - - return (isset($_SERVER[$uri])) ? $_SERVER[$uri] : @getenv($uri); - } - } - - // -------------------------------------------------------------------- - - /** - * Parse the REQUEST_URI - * - * Due to the way REQUEST_URI works it usually contains path info - * that makes it unusable as URI data. We'll trim off the unnecessary - * data, hopefully arriving at a valid URI that we can use. - * - * @access private - * @return string - */ - function _parse_request_uri() - { - if ( ! isset($_SERVER['REQUEST_URI']) OR $_SERVER['REQUEST_URI'] == '') - { - return ''; - } - - $request_uri = preg_replace("|/(.*)|", "\\1", str_replace("\\", "/", $_SERVER['REQUEST_URI'])); - - if ($request_uri == '' OR $request_uri == SELF) - { - return ''; - } - - $fc_path = FCPATH; - if (strpos($request_uri, '?') !== FALSE) - { - $fc_path .= '?'; - } - - $parsed_uri = explode("/", $request_uri); - - $i = 0; - foreach(explode("/", $fc_path) as $segment) - { - if (isset($parsed_uri[$i]) AND $segment == $parsed_uri[$i]) - { - $i++; - } - } - - $parsed_uri = implode("/", array_slice($parsed_uri, $i)); - - if ($parsed_uri != '') - { - $parsed_uri = '/'.$parsed_uri; - } - - return $parsed_uri; - } - - // -------------------------------------------------------------------- - - /** - * Filter segments for malicious characters - * - * @access private - * @param string - * @return string - */ - function _filter_uri($str) - { - if ($this->config->item('permitted_uri_chars') != '') - { - if ( ! preg_match("|^[".preg_quote($this->config->item('permitted_uri_chars'))."]+$|i", $str)) - { - exit('The URI you submitted has disallowed characters: '.$str); - } - } - return $str; - } - - // -------------------------------------------------------------------- - - /** - * Parse Routes - * - * This function matches any routes that may exist in - * the config/routes.php file against the URI to - * determine if the class/method need to be remapped. - * - * @access private - * @return void - */ - function _parse_routes() - { - // Do we even have any custom routing to deal with? - if (count($this->routes) == 0) - { - $this->_compile_segments($this->segments); - return; - } - - // Turn the segment array into a URI string - $uri = implode('/', $this->segments); - $num = count($this->segments); - - // Is there a literal match? If so we're done - if (isset($this->routes[$uri])) - { - $this->_compile_segments(explode('/', $this->routes[$uri])); - return; - } - - // Loop through the route array looking for wild-cards - foreach (array_slice($this->routes, 1) as $key => $val) - { - // Convert wild-cards to RegEx - $key = str_replace(':any', '.+', str_replace(':num', '[0-9]+', $key)); - - // Does the RegEx match? - if (preg_match('#^'.$key.'$#', $uri)) - { - // Do we have a back-reference? - if (strpos($val, '$') !== FALSE AND strpos($key, '(') !== FALSE) - { - $val = preg_replace('#^'.$key.'$#', $val, $uri); - } - - $this->_compile_segments(explode('/', $val)); - return; - } - } - - // If we got this far it means we didn't encounter a - // matching route so we'll set the site default route - $this->_compile_segments($this->segments); - } - - // -------------------------------------------------------------------- - - /** - * Set the class name - * - * @access public - * @param string - * @return void - */ - function set_class($class) - { - $this->class = $class; - } - - // -------------------------------------------------------------------- - - /** - * Fetch the current class - * - * @access public - * @return string - */ - function fetch_class() - { - return $this->class; - } - - // -------------------------------------------------------------------- - - /** - * Set the method name - * - * @access public - * @param string - * @return void - */ - function set_method($method) - { - $this->method = $method; - } - - // -------------------------------------------------------------------- - - /** - * Fetch the current method - * - * @access public - * @return string - */ - function fetch_method() - { - if ($this->method == $this->fetch_class()) - { - return 'index'; - } - - return $this->method; - } - - // -------------------------------------------------------------------- - - /** - * Set the directory name - * - * @access public - * @param string - * @return void - */ - function set_directory($dir) - { - $this->directory = $dir.'/'; - } - - // -------------------------------------------------------------------- - - /** - * Fetch the sub-directory (if any) that contains the requested controller class - * - * @access public - * @return string - */ - function fetch_directory() - { - return $this->directory; - } - -} -// END Router Class +config =& load_class('Config'); + $this->_set_route_mapping(); + log_message('debug', "Router Class Initialized"); + } + + // -------------------------------------------------------------------- + + /** + * Set the route mapping + * + * This function determines what should be served based on the URI request, + * as well as any "routes" that have been set in the routing config file. + * + * @access private + * @return void + */ + function _set_route_mapping() + { + // Are query strings enabled in the config file? + // If so, we're done since segment based URIs are not used with query strings. + if ($this->config->item('enable_query_strings') === TRUE AND isset($_GET[$this->config->item('controller_trigger')])) + { + $this->set_class($_GET[$this->config->item('controller_trigger')]); + + if (isset($_GET[$this->config->item('function_trigger')])) + { + $this->set_method($_GET[$this->config->item('function_trigger')]); + } + + return; + } + + // Load the routes.php file. + @include(APPPATH.'config/routes'.EXT); + $this->routes = ( ! isset($route) OR ! is_array($route)) ? array() : $route; + unset($route); + + // Set the default controller so we can display it in the event + // the URI doesn't correlated to a valid controller. + $this->default_controller = ( ! isset($this->routes['default_controller']) OR $this->routes['default_controller'] == '') ? FALSE : strtolower($this->routes['default_controller']); + + // Fetch the complete URI string + $this->uri_string = $this->_get_uri_string(); + + // If the URI contains only a slash we'll kill it + if ($this->uri_string == '/') + { + $this->uri_string = ''; + } + + // Is there a URI string? If not, the default controller specified in the "routes" file will be shown. + if ($this->uri_string == '') + { + if ($this->default_controller === FALSE) + { + show_error("Unable to determine what should be displayed. A default route has not been specified in the routing file."); + } + + $this->set_class($this->default_controller); + $this->set_method('index'); + + log_message('debug', "No URI present. Default controller set."); + return; + } + unset($this->routes['default_controller']); + + // Do we need to remove the suffix specified in the config file? + if ($this->config->item('url_suffix') != "") + { + $this->uri_string = preg_replace("|".preg_quote($this->config->item('url_suffix'))."$|", "", $this->uri_string); + } + + // Explode the URI Segments. The individual segments will + // be stored in the $this->segments array. + foreach(explode("/", preg_replace("|/*(.+?)/*$|", "\\1", $this->uri_string)) as $val) + { + // Filter segments for security + $val = trim($this->_filter_uri($val)); + + if ($val != '') + $this->segments[] = $val; + } + + // Parse any custom routing that may exist + $this->_parse_routes(); + + // Re-index the segment array so that it starts with 1 rather than 0 + $this->_reindex_segments(); + } + + // -------------------------------------------------------------------- + + /** + * Compile Segments + * + * This function takes an array of URI segments as + * input, and puts it into the $this->segments array. + * It also sets the current class/method + * + * @access private + * @param array + * @param bool + * @return void + */ + function _compile_segments($segments = array()) + { + $segments = $this->_validate_segments($segments); + + if (count($segments) == 0) + { + return; + } + + $this->set_class($segments[0]); + + if (isset($segments[1])) + { + // A scaffolding request. No funny business with the URL + if ($this->routes['scaffolding_trigger'] == $segments[1] AND $segments[1] != '_ci_scaffolding') + { + $this->scaffolding_request = TRUE; + unset($this->routes['scaffolding_trigger']); + } + else + { + // A standard method request + $this->set_method($segments[1]); + } + } + + // Update our "routed" segment array to contain the segments. + // Note: If there is no custom routing, this array will be + // identical to $this->segments + $this->rsegments = $segments; + } + + // -------------------------------------------------------------------- + + /** + * Validates the supplied segments. Attempts to determine the path to + * the controller. + * + * @access private + * @param array + * @return array + */ + function _validate_segments($segments) + { + // Does the requested controller exist in the root folder? + if (file_exists(APPPATH.'controllers/'.$segments[0].EXT)) + { + return $segments; + } + + // Is the controller in a sub-folder? + if (is_dir(APPPATH.'controllers/'.$segments[0])) + { + // Set the directory and remove it from the segment array + $this->set_directory($segments[0]); + $segments = array_slice($segments, 1); + + if (count($segments) > 0) + { + // Does the requested controller exist in the sub-folder? + if ( ! file_exists(APPPATH.'controllers/'.$this->fetch_directory().$segments[0].EXT)) + { + show_404(); + } + } + else + { + $this->set_class($this->default_controller); + $this->set_method('index'); + + // Does the default controller exist in the sub-folder? + if ( ! file_exists(APPPATH.'controllers/'.$this->fetch_directory().$this->default_controller.EXT)) + { + $this->directory = ''; + return array(); + } + + } + + return $segments; + } + + // Can't find the requested controller... + show_404(); + } + + // -------------------------------------------------------------------- + /** + * Re-index Segments + * + * This function re-indexes the $this->segment array so that it + * starts at 1 rather then 0. Doing so makes it simpler to + * use functions like $this->uri->segment(n) since there is + * a 1:1 relationship between the segment array and the actual segments. + * + * @access private + * @return void + */ + function _reindex_segments() + { + // Is the routed segment array different then the main segment array? + $diff = (count(array_diff($this->rsegments, $this->segments)) == 0) ? FALSE : TRUE; + + $i = 1; + foreach ($this->segments as $val) + { + $this->segments[$i++] = $val; + } + unset($this->segments[0]); + + if ($diff == FALSE) + { + $this->rsegments = $this->segments; + } + else + { + $i = 1; + foreach ($this->rsegments as $val) + { + $this->rsegments[$i++] = $val; + } + unset($this->rsegments[0]); + } + } + + // -------------------------------------------------------------------- + + /** + * Get the URI String + * + * @access private + * @return string + */ + function _get_uri_string() + { + if (strtoupper($this->config->item('uri_protocol')) == 'AUTO') + { + // If the URL has a question mark then it's simplest to just + // build the URI string from the zero index of the $_GET array. + // This avoids having to deal with $_SERVER variables, which + // can be unreliable in some environments + if (is_array($_GET) AND count($_GET) == 1) + { + // Note: Due to a bug in current() that affects some versions + // of PHP we can not pass function call directly into it + $keys = array_keys($_GET); + return current($keys); + } + + // Is there a PATH_INFO variable? + // Note: some servers seem to have trouble with getenv() so we'll test it two ways + $path = (isset($_SERVER['PATH_INFO'])) ? $_SERVER['PATH_INFO'] : @getenv('PATH_INFO'); + if ($path != '' AND $path != "/".SELF) + { + return $path; + } + + // No PATH_INFO?... What about QUERY_STRING? + $path = (isset($_SERVER['QUERY_STRING'])) ? $_SERVER['QUERY_STRING'] : @getenv('QUERY_STRING'); + if ($path != '') + { + return $path; + } + + // No QUERY_STRING?... Maybe the ORIG_PATH_INFO variable exists? + $path = (isset($_SERVER['ORIG_PATH_INFO'])) ? $_SERVER['ORIG_PATH_INFO'] : @getenv('ORIG_PATH_INFO'); + if ($path != '' AND $path != "/".SELF) + { + return $path; + } + + // We've exhausted all our options... + return ''; + } + else + { + $uri = strtoupper($this->config->item('uri_protocol')); + + if ($uri == 'REQUEST_URI') + { + return $this->_parse_request_uri(); + } + + return (isset($_SERVER[$uri])) ? $_SERVER[$uri] : @getenv($uri); + } + } + + // -------------------------------------------------------------------- + + /** + * Parse the REQUEST_URI + * + * Due to the way REQUEST_URI works it usually contains path info + * that makes it unusable as URI data. We'll trim off the unnecessary + * data, hopefully arriving at a valid URI that we can use. + * + * @access private + * @return string + */ + function _parse_request_uri() + { + if ( ! isset($_SERVER['REQUEST_URI']) OR $_SERVER['REQUEST_URI'] == '') + { + return ''; + } + + $request_uri = preg_replace("|/(.*)|", "\\1", str_replace("\\", "/", $_SERVER['REQUEST_URI'])); + + if ($request_uri == '' OR $request_uri == SELF) + { + return ''; + } + + $fc_path = FCPATH; + if (strpos($request_uri, '?') !== FALSE) + { + $fc_path .= '?'; + } + + $parsed_uri = explode("/", $request_uri); + + $i = 0; + foreach(explode("/", $fc_path) as $segment) + { + if (isset($parsed_uri[$i]) AND $segment == $parsed_uri[$i]) + { + $i++; + } + } + + $parsed_uri = implode("/", array_slice($parsed_uri, $i)); + + if ($parsed_uri != '') + { + $parsed_uri = '/'.$parsed_uri; + } + + return $parsed_uri; + } + + // -------------------------------------------------------------------- + + /** + * Filter segments for malicious characters + * + * @access private + * @param string + * @return string + */ + function _filter_uri($str) + { + if ($this->config->item('permitted_uri_chars') != '') + { + if ( ! preg_match("|^[".preg_quote($this->config->item('permitted_uri_chars'))."]+$|i", $str)) + { + exit('The URI you submitted has disallowed characters.'); + } + } + return $str; + } + + // -------------------------------------------------------------------- + + /** + * Parse Routes + * + * This function matches any routes that may exist in + * the config/routes.php file against the URI to + * determine if the class/method need to be remapped. + * + * @access private + * @return void + */ + function _parse_routes() + { + // Do we even have any custom routing to deal with? + if (count($this->routes) == 0) + { + $this->_compile_segments($this->segments); + return; + } + + // Turn the segment array into a URI string + $uri = implode('/', $this->segments); + $num = count($this->segments); + + // Is there a literal match? If so we're done + if (isset($this->routes[$uri])) + { + $this->_compile_segments(explode('/', $this->routes[$uri])); + return; + } + + // Loop through the route array looking for wild-cards + foreach (array_slice($this->routes, 1) as $key => $val) + { + // Convert wild-cards to RegEx + $key = str_replace(':any', '.+', str_replace(':num', '[0-9]+', $key)); + + // Does the RegEx match? + if (preg_match('#^'.$key.'$#', $uri)) + { + // Do we have a back-reference? + if (strpos($val, '$') !== FALSE AND strpos($key, '(') !== FALSE) + { + $val = preg_replace('#^'.$key.'$#', $val, $uri); + } + + $this->_compile_segments(explode('/', $val)); + return; + } + } + + // If we got this far it means we didn't encounter a + // matching route so we'll set the site default route + $this->_compile_segments($this->segments); + } + + // -------------------------------------------------------------------- + + /** + * Set the class name + * + * @access public + * @param string + * @return void + */ + function set_class($class) + { + $this->class = $class; + } + + // -------------------------------------------------------------------- + + /** + * Fetch the current class + * + * @access public + * @return string + */ + function fetch_class() + { + return $this->class; + } + + // -------------------------------------------------------------------- + + /** + * Set the method name + * + * @access public + * @param string + * @return void + */ + function set_method($method) + { + $this->method = $method; + } + + // -------------------------------------------------------------------- + + /** + * Fetch the current method + * + * @access public + * @return string + */ + function fetch_method() + { + if ($this->method == $this->fetch_class()) + { + return 'index'; + } + + return $this->method; + } + + // -------------------------------------------------------------------- + + /** + * Set the directory name + * + * @access public + * @param string + * @return void + */ + function set_directory($dir) + { + $this->directory = $dir.'/'; + } + + // -------------------------------------------------------------------- + + /** + * Fetch the sub-directory (if any) that contains the requested controller class + * + * @access public + * @return string + */ + function fetch_directory() + { + return $this->directory; + } + +} +// END Router Class ?> \ No newline at end of file -- cgit v1.2.3-24-g4f1b