diff --git a/.gitattributes b/.gitattributes deleted file mode 100644 index a4296d591b8..00000000000 --- a/.gitattributes +++ /dev/null @@ -1,25 +0,0 @@ -# This file tells which files and directories should be ignored and -# NOT downloaded when using composer to pull down a project with -# the --prefer-dist option selected. Used to remove development -# specific files so user has a clean download. - -# git files -.gitattributes export-ignore -# .gitignore - -# helper config files -.travis.yml export-ignore -phpdoc.dist.xml export-ignore - -# Misc other files -readme.rst - -# They don't want all of our tests... -tests/codeigniter/ export-ignore -tests/travis/ export-ignore - -# User Guide Source Files -user_guide_src - -# User Guide Compiled Files -user_guide export-ignore diff --git a/.htaccess b/.htaccess new file mode 100644 index 00000000000..9e25198b5a4 --- /dev/null +++ b/.htaccess @@ -0,0 +1,4 @@ +RewriteEngine On +RewriteCond %{REQUEST_FILENAME} !-f +RewriteCond %{REQUEST_FILENAME} !-d +RewriteRule ^(.*)$ index.php/$1 [L] \ No newline at end of file diff --git a/.travis.yml b/.travis.yml deleted file mode 100644 index 8525d5f6cef..00000000000 --- a/.travis.yml +++ /dev/null @@ -1,63 +0,0 @@ -language: php -dist: trusty - -php: - - 5.4 - - 5.5 - - 5.6 - - 7.0 - - 7.1 - - 7.2 - - 7.3 - - 7.4snapshot - - nightly - - hhvm-3.30 - -env: - - DB=mysql - - DB=mysqli - - DB=pgsql - - DB=sqlite - - DB=pdo/mysql - - DB=pdo/pgsql - - DB=pdo/sqlite - -sudo: false - -before_script: - - sh -c "composer install --dev --no-progress" - - sh -c "if [ '$DB' = 'pgsql' ] || [ '$DB' = 'pdo/pgsql' ]; then psql -c 'DROP DATABASE IF EXISTS ci_test;' -U postgres; fi" - - sh -c "if [ '$DB' = 'pgsql' ] || [ '$DB' = 'pdo/pgsql' ]; then psql -c 'create database ci_test;' -U postgres; fi" - - sh -c "if [ '$DB' = 'mysql' ] || [ '$DB' = 'mysqli' ] || [ '$DB' = 'pdo/mysql' ]; then mysql -e 'create database IF NOT EXISTS ci_test;'; fi" - -script: php -d zend.enable_gc=0 -d date.timezone=UTC -d mbstring.func_overload=7 -d mbstring.internal_encoding=UTF-8 vendor/bin/phpunit --coverage-text --configuration tests/travis/$DB.phpunit.xml - -matrix: - allow_failures: - - php: 7.4snapshot - - php: nightly - - php: hhvm-3.30 - exclude: - - php: hhvm-3.30 - env: DB=pgsql - - php: hhvm-3.30 - env: DB=pdo/pgsql - - php: 7.0 - env: DB=mysql - - php: 7.1 - env: DB=mysql - - php: 7.2 - env: DB=mysql - - php: 7.3 - env: DB=mysql - - php: 7.4snapshot - env: DB=mysql - - php: nightly - env: DB=mysql - -branches: - only: - - develop - - 3.0-stable - - 3.1-stable - - /^feature\/.+$/ diff --git a/application/cache/index.html b/application/cache/index.html index bcb7cae3433..b702fbc3967 100644 --- a/application/cache/index.html +++ b/application/cache/index.html @@ -1,5 +1,5 @@ - +
User Not Found !
'); + redirect('Login'); + } + } + } +} + +/* End of file Login.php */ +/* Location: ./application/controllers/Login.php */ \ No newline at end of file diff --git a/application/controllers/User.php b/application/controllers/User.php new file mode 100644 index 00000000000..3a27d230fb3 --- /dev/null +++ b/application/controllers/User.php @@ -0,0 +1,72 @@ +load->model('userM'); + } + public function index() + { + $data['feed'] = $this->userM->getPost(); + $this->load->view('feed',$data); + } + public function profile() + { + $data['user'] = $this->userM->getUser(1)->row(); + $this->load->view('profile', $data); + } + public function editProfile() + { + $this->form_validation->set_rules('username', 'Username', 'trim|required'); + $data['user'] = $this->userM->getUser(1)->row(); + $this->load->view('edit-profile', $data); + } + public function editProfileAction() + { + $user['name'] = $this->input->post('full-name'); + $user['username'] = $this->input->post('username'); + $user['website'] = $this->input->post('website'); + $user['bio'] = $this->input->post('bio'); + $user['email'] = $this->input->post('email'); + $user['phone_number'] = $this->input->post('phone'); + $user['gender'] = $this->input->post('gender'); + $this->userM->updateUser(1,$user); + $this->session->set_flashdata('success', 'Profile Updated !'); + redirect('user/editProfile'); + } + public function addPhoto() + { + $this->load->view('add-photo'); + } + public function addPhotoAction() + { + + $config['upload_path'] = './uploads/'; + $config['allowed_types'] = 'gif|jpg|png'; + $config['max_size'] = '100'; + $config['max_width'] = '1024'; + $config['max_height'] = '768'; + + $this->load->library('upload', $config); + + if ( ! $this->upload->do_upload('file')){ + $error = array('error' => $this->upload->display_errors()); + print_r($error); + } + else{ + $data = array('upload_data' => $this->upload->data()); + $poto['caption'] = $this->input->post('caption'); + $poto['url'] = 'uploads/'.$data['upload_data']['file_name']; + $this->userM->uploadPhoto($poto); + $this->session->set_flashdata('success', 'upload success !'); + redirect('user/addPhoto'); + } + } + +} + +/* End of file User.php */ +/* Location: ./application/controllers/User.php */ \ No newline at end of file diff --git a/application/controllers/index.html b/application/controllers/index.html index bcb7cae3433..b702fbc3967 100644 --- a/application/controllers/index.html +++ b/application/controllers/index.html @@ -1,5 +1,5 @@ - +'.$raw_data.''); } @@ -2407,6 +2477,9 @@ protected static function substr($str, $start, $length = NULL) { if (self::$func_overload) { + // mb_substr($str, $start, null, '8bit') returns an empty + // string on PHP 5.3 + isset($length) OR $length = ($start >= 0 ? self::strlen($str) - $start : -$start); return mb_substr($str, $start, $length, '8bit'); } diff --git a/system/libraries/Encryption.php b/system/libraries/Encryption.php index fd858cb297b..4c1973fee55 100644 --- a/system/libraries/Encryption.php +++ b/system/libraries/Encryption.php @@ -482,7 +482,7 @@ protected function _openssl_encrypt($data, $params) $data, $params['handle'], $params['key'], - OPENSSL_RAW_DATA, + 1, // DO NOT TOUCH! $iv ); @@ -641,7 +641,7 @@ protected function _openssl_decrypt($data, $params) $data, $params['handle'], $params['key'], - OPENSSL_RAW_DATA, + 1, // DO NOT TOUCH! $iv ); } @@ -928,6 +928,9 @@ protected static function substr($str, $start, $length = NULL) { if (self::$func_overload) { + // mb_substr($str, $start, null, '8bit') returns an empty + // string on PHP 5.3 + isset($length) OR $length = ($start >= 0 ? self::strlen($str) - $start : -$start); return mb_substr($str, $start, $length, '8bit'); } diff --git a/system/libraries/Form_validation.php b/system/libraries/Form_validation.php index de59ef9f736..fdf2020101c 100644 --- a/system/libraries/Form_validation.php +++ b/system/libraries/Form_validation.php @@ -104,6 +104,13 @@ class CI_Form_validation { */ protected $error_string = ''; + /** + * Whether the form data has been validated as safe + * + * @var bool + */ + protected $_safe_form_data = FALSE; + /** * Custom data to validate * @@ -157,7 +164,7 @@ public function __construct($rules = array()) * @param array $errors * @return CI_Form_validation */ - public function set_rules($field, $label = null, $rules = null, $errors = array()) + public function set_rules($field, $label = '', $rules = array(), $errors = array()) { // No reason to set rules if we have no POST data // or a validation array has not been specified @@ -190,22 +197,18 @@ public function set_rules($field, $label = null, $rules = null, $errors = array( return $this; } - elseif ( ! isset($rules)) - { - throw new BadMethodCallException('Form_validation: set_rules() called without a $rules parameter'); - } // No fields or no rules? Nothing to do... if ( ! is_string($field) OR $field === '' OR empty($rules)) { - throw new RuntimeException('Form_validation: set_rules() called with an empty $rules parameter'); + return $this; } elseif ( ! is_array($rules)) { // BC: Convert pipe-separated rules string to an array if ( ! is_string($rules)) { - throw new InvalidArgumentException('Form_validation: set_rules() expect $rules to be string or array; '.gettype($rules).' given'); + return $this; } $rules = preg_split('/\|(?![^\[]*\])/', $rules); @@ -407,11 +410,10 @@ public function error_string($prefix = '', $suffix = '') * * This function does all the work. * - * @param string $config - * @param array $data + * @param string $group * @return bool */ - public function run($config = NULL, &$data = NULL) + public function run($group = '') { $validation_array = empty($this->validation_data) ? $_POST @@ -422,19 +424,19 @@ public function run($config = NULL, &$data = NULL) if (count($this->_field_data) === 0) { // No validation rules? We're done... - if (empty($this->_config_rules)) + if (count($this->_config_rules) === 0) { return FALSE; } - if (empty($config)) + if (empty($group)) { // Is there a validation rule for the particular URI being accessed? - $config = trim($this->CI->uri->ruri_string(), '/'); - isset($this->_config_rules[$config]) OR $config = $this->CI->router->class.'/'.$this->CI->router->method; + $group = trim($this->CI->uri->ruri_string(), '/'); + isset($this->_config_rules[$group]) OR $group = $this->CI->router->class.'/'.$this->CI->router->method; } - $this->set_rules(isset($this->_config_rules[$config]) ? $this->_config_rules[$config] : $this->_config_rules); + $this->set_rules(isset($this->_config_rules[$group]) ? $this->_config_rules[$group] : $this->_config_rules); // Were we able to set the rules correctly? if (count($this->_field_data) === 0) @@ -476,22 +478,17 @@ public function run($config = NULL, &$data = NULL) $this->_execute($row, $row['rules'], $row['postdata']); } - if ( ! empty($this->_error_array)) + // Did we end up with any errors? + $total_errors = count($this->_error_array); + if ($total_errors > 0) { - return FALSE; + $this->_safe_form_data = TRUE; } - // Fill $data if requested, otherwise modify $_POST, as long as - // set_data() wasn't used (yea, I know it sounds confusing) - if (func_num_args() >= 2) - { - $data = empty($this->validation_data) ? $_POST : $this->validation_data; - $this->_reset_data_array($data); - return TRUE; - } + // Now we need to re-set the POST data with the new, processed data + empty($this->validation_data) && $this->_reset_post_array(); - empty($this->validation_data) && $this->_reset_data_array($_POST); - return TRUE; + return ($total_errors === 0); } // -------------------------------------------------------------------- @@ -579,7 +576,7 @@ protected function _reduce_array($array, $keys, $i = 0) * * @return void */ - protected function _reset_data_array(&$data) + protected function _reset_post_array() { foreach ($this->_field_data as $field => $row) { @@ -587,26 +584,27 @@ protected function _reset_data_array(&$data) { if ($row['is_array'] === FALSE) { - isset($data[$field]) && $data[$field] = is_array($row['postdata']) ? NULL : $row['postdata']; + isset($_POST[$field]) && $_POST[$field] = is_array($row['postdata']) ? NULL : $row['postdata']; } else { - $data_ref =& $data; + // start with a reference + $post_ref =& $_POST; // before we assign values, make a reference to the right POST key if (count($row['keys']) === 1) { - $data_ref =& $data[current($row['keys'])]; + $post_ref =& $post_ref[current($row['keys'])]; } else { foreach ($row['keys'] as $val) { - $data_ref =& $data_ref[$val]; + $post_ref =& $post_ref[$val]; } } - $data_ref = $row['postdata']; + $post_ref = $row['postdata']; } } } @@ -625,13 +623,11 @@ protected function _reset_data_array(&$data) */ protected function _execute($row, $rules, $postdata = NULL, $cycles = 0) { - $allow_arrays = in_array('is_array', $rules, TRUE); - // If the $_POST data is an array we will run a recursive call // // Note: We MUST check if the array is empty or not! // Otherwise empty arrays will always pass validation. - if ($allow_arrays === FALSE && is_array($postdata) && ! empty($postdata)) + if (is_array($postdata) && ! empty($postdata)) { foreach ($postdata as $key => $val) { @@ -660,16 +656,14 @@ protected function _execute($row, $rules, $postdata = NULL, $cycles = 0) $postdata = $this->_field_data[$row['field']]['postdata'][$cycles]; $_in_array = TRUE; } - // If we get an array field, but it's not expected - then it is most likely - // somebody messing with the form on the client side, so we'll just consider - // it an empty field - elseif ($allow_arrays === FALSE && is_array($this->_field_data[$row['field']]['postdata'])) - { - $postdata = NULL; - } else { - $postdata = $this->_field_data[$row['field']]['postdata']; + // If we get an array field, but it's not expected - then it is most likely + // somebody messing with the form on the client side, so we'll just consider + // it an empty field + $postdata = is_array($this->_field_data[$row['field']]['postdata']) + ? NULL + : $this->_field_data[$row['field']]['postdata']; } // Is the rule a callback? @@ -704,7 +698,7 @@ protected function _execute($row, $rules, $postdata = NULL, $cycles = 0) // Ignore empty, non-required inputs with a few exceptions ... if ( - ($postdata === NULL OR ($allow_arrays === FALSE && $postdata === '')) + ($postdata === NULL OR $postdata === '') && $callback === FALSE && $callable === FALSE && ! in_array($rule, array('required', 'isset', 'matches'), TRUE) @@ -1299,31 +1293,6 @@ public function valid_ip($ip, $which = '') // -------------------------------------------------------------------- - /** - * Validate MAC address - * - * @param string $mac - * @return bool - */ - public function valid_mac($mac) - { - if ( ! is_php('5.5')) - { - // Most common format, with either dash or colon delimiters - if (preg_match('#\A[0-9a-f]{2}(?
Directory access is forbidden.
+ + + diff --git a/system/libraries/Pagination.php b/system/libraries/Pagination.php index 11d63fe50b9..5d501a966ba 100644 --- a/system/libraries/Pagination.php +++ b/system/libraries/Pagination.php @@ -686,7 +686,7 @@ protected function _parse_attributes($attributes) /** * Add "rel" attribute * - * @link https://www.w3.org/TR/html5/links.html#linkTypes + * @link http://www.w3.org/TR/html5/links.html#linkTypes * @param string $type * @return string */ diff --git a/system/libraries/Session/Session.php b/system/libraries/Session/Session.php index dfd0f432e87..9b834f86ae8 100644 --- a/system/libraries/Session/Session.php +++ b/system/libraries/Session/Session.php @@ -105,7 +105,23 @@ public function __construct(array $params = array()) $class = new $class($this->_config); if ($class instanceof SessionHandlerInterface) { - session_set_save_handler($class, TRUE); + if (is_php('5.4')) + { + session_set_save_handler($class, TRUE); + } + else + { + session_set_save_handler( + array($class, 'open'), + array($class, 'close'), + array($class, 'read'), + array($class, 'write'), + array($class, 'destroy'), + array($class, 'gc') + ); + + register_shutdown_function('session_write_close'); + } } else { @@ -174,6 +190,9 @@ public function __construct(array $params = array()) */ protected function _ci_load_classes($driver) { + // PHP 5.4 compatibility + interface_exists('SessionHandlerInterface', FALSE) OR require_once(BASEPATH.'libraries/Session/SessionHandlerInterface.php'); + $prefix = config_item('subclass_prefix'); if ( ! class_exists('CI_Session_driver', FALSE)) diff --git a/system/libraries/Session/SessionHandlerInterface.php b/system/libraries/Session/SessionHandlerInterface.php new file mode 100644 index 00000000000..240c5f54e88 --- /dev/null +++ b/system/libraries/Session/SessionHandlerInterface.php @@ -0,0 +1,59 @@ +\?.+)?$#', $this->_config['save_path'], $matches)) + elseif (preg_match('#(?:tcp://)?([^:?]+)(?:\:(\d+))?(\?.+)?#', $this->_config['save_path'], $matches)) { - $save_path = array('path' => $matches[1]); - } - elseif (preg_match('#(?:tcp://)?([^:?]+)(?:\:(\d+))?(?', $close = '
') * Prevents possible script execution from Apache's handling * of files' multiple extensions. * - * @link https://httpd.apache.org/docs/1.3/mod/mod_mime.html#multipleext + * @link http://httpd.apache.org/docs/1.3/mod/mod_mime.html#multipleext * * @param string $filename * @return string @@ -1257,7 +1257,9 @@ protected function _file_mime_type($file) */ if (DIRECTORY_SEPARATOR !== '\\') { - $cmd = 'file --brief --mime '.escapeshellarg($file['tmp_name']).' 2>&1'; + $cmd = function_exists('escapeshellarg') + ? 'file --brief --mime '.escapeshellarg($file['tmp_name']).' 2>&1' + : 'file --brief --mime '.$file['tmp_name'].' 2>&1'; if (function_usable('exec')) { @@ -1274,7 +1276,7 @@ protected function _file_mime_type($file) } } - if (function_usable('shell_exec')) + if ( ! ini_get('safe_mode') && function_usable('shell_exec')) { $mime = @shell_exec($cmd); if (strlen($mime) > 0) diff --git a/system/libraries/Xmlrpc.php b/system/libraries/Xmlrpc.php index 4e8c303c7d2..690b245be98 100644 --- a/system/libraries/Xmlrpc.php +++ b/system/libraries/Xmlrpc.php @@ -743,7 +743,7 @@ public function sendPayload($msg) { break; } - // See https://bugs.php.net/bug.php?id=39598 and https://secure.php.net/manual/en/function.fwrite.php#96951 + // See https://bugs.php.net/bug.php?id=39598 and http://php.net/manual/en/function.fwrite.php#96951 elseif ($result === 0) { if ($timestamp === 0) @@ -836,7 +836,9 @@ public function __construct($val, $code = 0, $fstr = '') { // error $this->errno = $code; - $this->errstr = htmlspecialchars($fstr, ENT_XML1 | ENT_NOQUOTES, 'UTF-8'); + $this->errstr = htmlspecialchars($fstr, + (is_php('5.4') ? ENT_XML1 | ENT_NOQUOTES : ENT_NOQUOTES), + 'UTF-8'); } elseif ( ! is_object($val)) { diff --git a/system/libraries/Zip.php b/system/libraries/Zip.php index 4579e8c2b71..52fac2f8a34 100644 --- a/system/libraries/Zip.php +++ b/system/libraries/Zip.php @@ -41,7 +41,7 @@ * Zip Compression Class * * This class is based on a library I found at Zend: - * https://www.zend.com/codex.php?id=696&single=1 + * http://www.zend.com/codex.php?id=696&single=1 * * The original library is a little rough around the edges so I * refactored it and added several additional methods -- Rick Ellis @@ -366,7 +366,7 @@ public function read_dir($path, $preserve_filepath = TRUE, $root_path = NULL) while (FALSE !== ($file = readdir($fp))) { - if ($file === '.' OR $file === '..') + if ($file[0] === '.') { continue; } @@ -520,6 +520,9 @@ protected static function substr($str, $start, $length = NULL) { if (self::$func_overload) { + // mb_substr($str, $start, null, '8bit') returns an empty + // string on PHP 5.3 + isset($length) OR $length = ($start >= 0 ? self::strlen($str) - $start : -$start); return mb_substr($str, $start, $length, '8bit'); } diff --git a/system/libraries/index.html b/system/libraries/index.html index bcb7cae3433..b702fbc3967 100644 --- a/system/libraries/index.html +++ b/system/libraries/index.html @@ -1,5 +1,5 @@ - +
';
-
- $xss_clean_return = $this->security->xss_clean($harm_string, TRUE);
-
-// $this->assertTrue($xss_clean_return);
- }
-
- // --------------------------------------------------------------------
-
- public function test_xss_clean_image_invalid()
- {
- $harm_string = '