From 4c316b6bdfa970e98127ea280fcc77ff1288190f Mon Sep 17 00:00:00 2001 From: Michiel Vugteveen Date: Fri, 4 May 2012 11:32:48 +0200 Subject: unset userdata --- system/libraries/Session.php | 45 +++++++++++++++++++++++--------------------- 1 file changed, 24 insertions(+), 21 deletions(-) (limited to 'system/libraries') diff --git a/system/libraries/Session.php b/system/libraries/Session.php index 3fa446d84..3195f0a91 100644 --- a/system/libraries/Session.php +++ b/system/libraries/Session.php @@ -36,146 +36,146 @@ */ class CI_Session { - /** + /** * Whether to encrypt the session cookie * * @var bool */ public $sess_encrypt_cookie = FALSE; - + /** * Whether to use to the database for session storage * * @var bool */ public $sess_use_database = FALSE; - + /** * Name of the database table in which to store sessions * * @var string */ public $sess_table_name = ''; - + /** * Length of time (in seconds) for sessions to expire * * @var int */ public $sess_expiration = 7200; - + /** * Whether to kill session on close of browser window * * @var bool */ public $sess_expire_on_close = FALSE; - + /** * Whether to match session on ip address * * @var bool */ public $sess_match_ip = FALSE; - + /** * Whether to match session on user-agent * * @var bool */ public $sess_match_useragent = TRUE; - + /** * Name of session cookie * * @var string */ public $sess_cookie_name = 'ci_session'; - + /** * Session cookie prefix * * @var string */ public $cookie_prefix = ''; - + /** * Session cookie path * * @var string */ public $cookie_path = ''; - + /** * Session cookie domain * * @var string */ public $cookie_domain = ''; - + /** * Whether to set the cookie only on HTTPS connections * * @var bool */ public $cookie_secure = FALSE; - + /** * Whether cookie should be allowed only to be sent by the server * * @var bool */ public $cookie_httponly = FALSE; - + /** * Interval at which to update session * * @var int */ public $sess_time_to_update = 300; - + /** * Key with which to encrypt the session cookie * * @var string */ public $encryption_key = ''; - + /** * String to indicate flash data cookies * * @var string */ public $flashdata_key = 'flash'; - + /** * Function to use to get the current time * * @var string */ public $time_reference = 'time'; - + /** * Probablity level of garbage collection of old sessions * * @var int */ public $gc_probability = 5; - + /** * Session data * * @var array */ public $userdata = array(); - + /** * Reference to CodeIgniter instance * * @var object */ public $CI; - + /** * Current time * @@ -570,6 +570,9 @@ class CI_Session { $this->cookie_domain, 0 ); + + // Kill session data + $this->userdata = array(); } // -------------------------------------------------------------------- -- cgit v1.2.3-24-g4f1b From bb2c83bddbf51c42815be3de60eab24fd87ae392 Mon Sep 17 00:00:00 2001 From: Wes Baker Date: Fri, 4 May 2012 18:44:24 -0400 Subject: Added a return false if an image doesn't pass XSS cleaning to prevent file_get_contents from returning a NULL and passing through unscathed. --- system/libraries/Upload.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'system/libraries') diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php index 8ad67050d..4a4a66f73 100644 --- a/system/libraries/Upload.php +++ b/system/libraries/Upload.php @@ -850,6 +850,10 @@ class CI_Upload { { return TRUE; // its an image, no "triggers" detected in the first 256 bytes, we're good } + else + { + return FALSE; + } } if (($data = @file_get_contents($file)) === FALSE) @@ -1099,4 +1103,4 @@ class CI_Upload { } /* End of file Upload.php */ -/* Location: ./system/libraries/Upload.php */ \ No newline at end of file +/* Location: ./system/libraries/Upload.php */ -- cgit v1.2.3-24-g4f1b From cdcceecba73dd9f54665f531d15c12f5c9679738 Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Wed, 9 May 2012 11:23:30 +0300 Subject: Fix issue #1342 --- system/libraries/Form_validation.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'system/libraries') diff --git a/system/libraries/Form_validation.php b/system/libraries/Form_validation.php index 5547c6a69..73f607be8 100644 --- a/system/libraries/Form_validation.php +++ b/system/libraries/Form_validation.php @@ -448,7 +448,7 @@ class CI_Form_validation { { $this->_field_data[$field]['postdata'] = $this->_reduce_array($validation_array, $row['keys']); } - elseif ( ! empty($validation_array[$field])) + elseif (isset($validation_array[$field])) { $this->_field_data[$field]['postdata'] = $validation_array[$field]; } -- cgit v1.2.3-24-g4f1b From ca7d822f224033196e0e327944a01f319c90f37f Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Fri, 11 May 2012 10:59:09 +0300 Subject: User_agent library improvements --- system/libraries/User_agent.php | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) (limited to 'system/libraries') diff --git a/system/libraries/User_agent.php b/system/libraries/User_agent.php index 0ac605fa4..ff596f04b 100644 --- a/system/libraries/User_agent.php +++ b/system/libraries/User_agent.php @@ -51,14 +51,14 @@ class CI_User_agent { * @var bool */ public $is_browser = FALSE; - + /** * Flag for if the user-agent is a robot * * @var bool */ public $is_robot = FALSE; - + /** * Flag for if the user-agent is a mobile browser * @@ -72,7 +72,7 @@ class CI_User_agent { * @var array */ public $languages = array(); - + /** * Character sets accepted by the current user agent * @@ -86,21 +86,21 @@ class CI_User_agent { * @var array */ public $platforms = array(); - + /** * List of browsers to compare against current user agent * * @var array */ public $browsers = array(); - + /** * List of mobile browsers to compare against current user agent * * @var array */ public $mobiles = array(); - + /** * List of robots to compare against current user agent * @@ -114,28 +114,28 @@ class CI_User_agent { * @var string */ public $platform = ''; - + /** * Current user-agent browser * * @var string */ public $browser = ''; - + /** * Current user-agent version * * @var string */ public $version = ''; - + /** * Current user-agent mobile name * * @var string */ public $mobile = ''; - + /** * Current user-agent robot name * @@ -330,7 +330,7 @@ class CI_User_agent { { foreach ($this->mobiles as $key => $val) { - if (FALSE !== (strpos(strtolower($this->agent), $key))) + if (FALSE !== (stripos($this->agent, $key))) { $this->is_mobile = TRUE; $this->mobile = $val; @@ -604,7 +604,7 @@ class CI_User_agent { /** * Test for a particular character set * - * @param string $charset + * @param string $charset * @return bool */ public function accept_charset($charset = 'utf-8') -- cgit v1.2.3-24-g4f1b From 46d53fb8799eb2f84798f0e7a5f57b065c2482e2 Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Fri, 11 May 2012 13:42:24 +0300 Subject: Fix issue #1349 --- system/libraries/Upload.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'system/libraries') diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php index 4a4a66f73..24d4bd4d0 100644 --- a/system/libraries/Upload.php +++ b/system/libraries/Upload.php @@ -725,7 +725,7 @@ class CI_Upload { public function get_extension($filename) { $x = explode('.', $filename); - return '.'.end($x); + return (count($x) !== 1) ? '.'.end($x) : ''; } // -------------------------------------------------------------------- -- cgit v1.2.3-24-g4f1b From fff6c2a3caa1ce14e58fcb3ee0d937d17985eea1 Mon Sep 17 00:00:00 2001 From: Andrey Andreev Date: Sun, 13 May 2012 22:15:23 +0300 Subject: Improve the solution for issue #1342 --- system/libraries/Form_validation.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'system/libraries') diff --git a/system/libraries/Form_validation.php b/system/libraries/Form_validation.php index 73f607be8..c396580be 100644 --- a/system/libraries/Form_validation.php +++ b/system/libraries/Form_validation.php @@ -448,7 +448,7 @@ class CI_Form_validation { { $this->_field_data[$field]['postdata'] = $this->_reduce_array($validation_array, $row['keys']); } - elseif (isset($validation_array[$field])) + elseif (isset($validation_array[$field]) && $validation_array[$field] !== '') { $this->_field_data[$field]['postdata'] = $validation_array[$field]; } -- cgit v1.2.3-24-g4f1b