Warning: file_get_contents(https://raw.githubusercontent.com/Den1xxx/Filemanager/master/languages/ru.json): failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found
in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 88
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 215
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 216
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 217
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 218
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 219
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 220
PK ! (
index.htmlnu [
403 Forbidden
Directory access is forbidden.
PK ! bL_* *
Loader.phpnu [ TRUE);
/**
* List of paths to load libraries from
*
* @var array
*/
protected $_ci_library_paths = array(APPPATH, BASEPATH);
/**
* List of paths to load models from
*
* @var array
*/
protected $_ci_model_paths = array(APPPATH);
/**
* List of paths to load helpers from
*
* @var array
*/
protected $_ci_helper_paths = array(APPPATH, BASEPATH);
/**
* List of cached variables
*
* @var array
*/
protected $_ci_cached_vars = array();
/**
* List of loaded classes
*
* @var array
*/
protected $_ci_classes = array();
/**
* List of loaded models
*
* @var array
*/
protected $_ci_models = array();
/**
* List of loaded helpers
*
* @var array
*/
protected $_ci_helpers = array();
/**
* List of class name mappings
*
* @var array
*/
protected $_ci_varmap = array(
'unit_test' => 'unit',
'user_agent' => 'agent'
);
// --------------------------------------------------------------------
/**
* Class constructor
*
* Sets component load paths, gets the initial output buffering level.
*
* @return void
*/
public function __construct()
{
$this->_ci_ob_level = ob_get_level();
$this->_ci_classes =& is_loaded();
log_message('info', 'Loader Class Initialized');
}
// --------------------------------------------------------------------
/**
* Initializer
*
* @todo Figure out a way to move this to the constructor
* without breaking *package_path*() methods.
* @uses CI_Loader::_ci_autoloader()
* @used-by CI_Controller::__construct()
* @return void
*/
public function initialize()
{
$this->_ci_autoloader();
}
// --------------------------------------------------------------------
/**
* Is Loaded
*
* A utility method to test if a class is in the self::$_ci_classes array.
*
* @used-by Mainly used by Form Helper function _get_validation_object().
*
* @param string $class Class name to check for
* @return string|bool Class object name if loaded or FALSE
*/
public function is_loaded($class)
{
return array_search(ucfirst($class), $this->_ci_classes, TRUE);
}
// --------------------------------------------------------------------
/**
* Library Loader
*
* Loads and instantiates libraries.
* Designed to be called from application controllers.
*
* @param string $library Library name
* @param array $params Optional parameters to pass to the library class constructor
* @param string $object_name An optional object name to assign to
* @return object
*/
public function library($library, $params = NULL, $object_name = NULL)
{
if (empty($library))
{
return $this;
}
elseif (is_array($library))
{
foreach ($library as $key => $value)
{
if (is_int($key))
{
$this->library($value, $params);
}
else
{
$this->library($key, $params, $value);
}
}
return $this;
}
if ($params !== NULL && ! is_array($params))
{
$params = NULL;
}
$this->_ci_load_library($library, $params, $object_name);
return $this;
}
// --------------------------------------------------------------------
/**
* Model Loader
*
* Loads and instantiates models.
*
* @param string $model Model name
* @param string $name An optional object name to assign to
* @param bool $db_conn An optional database connection configuration to initialize
* @return object
*/
public function model($model, $name = '', $db_conn = FALSE)
{
if (empty($model))
{
return $this;
}
elseif (is_array($model))
{
foreach ($model as $key => $value)
{
is_int($key) ? $this->model($value, '', $db_conn) : $this->model($key, $value, $db_conn);
}
return $this;
}
$path = '';
// Is the model in a sub-folder? If so, parse out the filename and path.
if (($last_slash = strrpos($model, '/')) !== FALSE)
{
// The path is in front of the last slash
$path = substr($model, 0, ++$last_slash);
// And the model name behind it
$model = substr($model, $last_slash);
}
if (empty($name))
{
$name = $model;
}
if (in_array($name, $this->_ci_models, TRUE))
{
return $this;
}
$CI =& get_instance();
if (isset($CI->$name))
{
throw new RuntimeException('The model name you are loading is the name of a resource that is already being used: '.$name);
}
if ($db_conn !== FALSE && ! class_exists('CI_DB', FALSE))
{
if ($db_conn === TRUE)
{
$db_conn = '';
}
$this->database($db_conn, FALSE, TRUE);
}
// Note: All of the code under this condition used to be just:
//
// load_class('Model', 'core');
//
// However, load_class() instantiates classes
// to cache them for later use and that prevents
// MY_Model from being an abstract class and is
// sub-optimal otherwise anyway.
if ( ! class_exists('CI_Model', FALSE))
{
$app_path = APPPATH.'core'.DIRECTORY_SEPARATOR;
if (file_exists($app_path.'Model.php'))
{
require_once($app_path.'Model.php');
if ( ! class_exists('CI_Model', FALSE))
{
throw new RuntimeException($app_path."Model.php exists, but doesn't declare class CI_Model");
}
}
elseif ( ! class_exists('CI_Model', FALSE))
{
require_once(BASEPATH.'core'.DIRECTORY_SEPARATOR.'Model.php');
}
$class = config_item('subclass_prefix').'Model';
if (file_exists($app_path.$class.'.php'))
{
require_once($app_path.$class.'.php');
if ( ! class_exists($class, FALSE))
{
throw new RuntimeException($app_path.$class.".php exists, but doesn't declare class ".$class);
}
}
}
$model = ucfirst($model);
if ( ! class_exists($model, FALSE))
{
foreach ($this->_ci_model_paths as $mod_path)
{
if ( ! file_exists($mod_path.'models/'.$path.$model.'.php'))
{
continue;
}
require_once($mod_path.'models/'.$path.$model.'.php');
if ( ! class_exists($model, FALSE))
{
throw new RuntimeException($mod_path."models/".$path.$model.".php exists, but doesn't declare class ".$model);
}
break;
}
if ( ! class_exists($model, FALSE))
{
throw new RuntimeException('Unable to locate the model you have specified: '.$model);
}
}
elseif ( ! is_subclass_of($model, 'CI_Model'))
{
throw new RuntimeException("Class ".$model." already exists and doesn't extend CI_Model");
}
$this->_ci_models[] = $name;
$CI->$name = new $model();
return $this;
}
// --------------------------------------------------------------------
/**
* Database Loader
*
* @param mixed $params Database configuration options
* @param bool $return Whether to return the database object
* @param bool $query_builder Whether to enable Query Builder
* (overrides the configuration setting)
*
* @return object|bool Database object if $return is set to TRUE,
* FALSE on failure, CI_Loader instance in any other case
*/
public function database($params = '', $return = FALSE, $query_builder = NULL)
{
// Grab the super object
$CI =& get_instance();
// Do we even need to load the database class?
if ($return === FALSE && $query_builder === NULL && isset($CI->db) && is_object($CI->db) && ! empty($CI->db->conn_id))
{
return FALSE;
}
require_once(BASEPATH.'database/DB.php');
if ($return === TRUE)
{
return DB($params, $query_builder);
}
// Initialize the db variable. Needed to prevent
// reference errors with some configurations
$CI->db = '';
// Load the DB class
$CI->db =& DB($params, $query_builder);
return $this;
}
// --------------------------------------------------------------------
/**
* Load the Database Utilities Class
*
* @param object $db Database object
* @param bool $return Whether to return the DB Utilities class object or not
* @return object
*/
public function dbutil($db = NULL, $return = FALSE)
{
$CI =& get_instance();
if ( ! is_object($db) OR ! ($db instanceof CI_DB))
{
class_exists('CI_DB', FALSE) OR $this->database();
$db =& $CI->db;
}
require_once(BASEPATH.'database/DB_utility.php');
require_once(BASEPATH.'database/drivers/'.$db->dbdriver.'/'.$db->dbdriver.'_utility.php');
$class = 'CI_DB_'.$db->dbdriver.'_utility';
if ($return === TRUE)
{
return new $class($db);
}
$CI->dbutil = new $class($db);
return $this;
}
// --------------------------------------------------------------------
/**
* Load the Database Forge Class
*
* @param object $db Database object
* @param bool $return Whether to return the DB Forge class object or not
* @return object
*/
public function dbforge($db = NULL, $return = FALSE)
{
$CI =& get_instance();
if ( ! is_object($db) OR ! ($db instanceof CI_DB))
{
class_exists('CI_DB', FALSE) OR $this->database();
$db =& $CI->db;
}
require_once(BASEPATH.'database/DB_forge.php');
require_once(BASEPATH.'database/drivers/'.$db->dbdriver.'/'.$db->dbdriver.'_forge.php');
if ( ! empty($db->subdriver))
{
$driver_path = BASEPATH.'database/drivers/'.$db->dbdriver.'/subdrivers/'.$db->dbdriver.'_'.$db->subdriver.'_forge.php';
if (file_exists($driver_path))
{
require_once($driver_path);
$class = 'CI_DB_'.$db->dbdriver.'_'.$db->subdriver.'_forge';
}
}
else
{
$class = 'CI_DB_'.$db->dbdriver.'_forge';
}
if ($return === TRUE)
{
return new $class($db);
}
$CI->dbforge = new $class($db);
return $this;
}
// --------------------------------------------------------------------
/**
* View Loader
*
* Loads "view" files.
*
* @param string $view View name
* @param array $vars An associative array of data
* to be extracted for use in the view
* @param bool $return Whether to return the view output
* or leave it to the Output class
* @return object|string
*/
public function view($view, $vars = array(), $return = FALSE)
{
return $this->_ci_load(array('_ci_view' => $view, '_ci_vars' => $this->_ci_object_to_array($vars), '_ci_return' => $return));
}
// --------------------------------------------------------------------
/**
* Generic File Loader
*
* @param string $path File path
* @param bool $return Whether to return the file output
* @return object|string
*/
public function file($path, $return = FALSE)
{
return $this->_ci_load(array('_ci_path' => $path, '_ci_return' => $return));
}
// --------------------------------------------------------------------
/**
* Set Variables
*
* Once variables are set they become available within
* the controller class and its "view" files.
*
* @param array|object|string $vars
* An associative array or object containing values
* to be set, or a value's name if string
* @param string $val Value to set, only used if $vars is a string
* @return object
*/
public function vars($vars, $val = '')
{
if (is_string($vars))
{
$vars = array($vars => $val);
}
$vars = $this->_ci_object_to_array($vars);
if (is_array($vars) && count($vars) > 0)
{
foreach ($vars as $key => $val)
{
$this->_ci_cached_vars[$key] = $val;
}
}
return $this;
}
// --------------------------------------------------------------------
/**
* Clear Cached Variables
*
* Clears the cached variables.
*
* @return CI_Loader
*/
public function clear_vars()
{
$this->_ci_cached_vars = array();
return $this;
}
// --------------------------------------------------------------------
/**
* Get Variable
*
* Check if a variable is set and retrieve it.
*
* @param string $key Variable name
* @return mixed The variable or NULL if not found
*/
public function get_var($key)
{
return isset($this->_ci_cached_vars[$key]) ? $this->_ci_cached_vars[$key] : NULL;
}
// --------------------------------------------------------------------
/**
* Get Variables
*
* Retrieves all loaded variables.
*
* @return array
*/
public function get_vars()
{
return $this->_ci_cached_vars;
}
// --------------------------------------------------------------------
/**
* Helper Loader
*
* @param string|string[] $helpers Helper name(s)
* @return object
*/
public function helper($helpers = array())
{
foreach ($this->_ci_prep_filename($helpers, '_helper') as $helper)
{
if (isset($this->_ci_helpers[$helper]))
{
continue;
}
// Is this a helper extension request?
$ext_helper = config_item('subclass_prefix').$helper;
$ext_loaded = FALSE;
foreach ($this->_ci_helper_paths as $path)
{
if (file_exists($path.'helpers/'.$ext_helper.'.php'))
{
include_once($path.'helpers/'.$ext_helper.'.php');
$ext_loaded = TRUE;
}
}
// If we have loaded extensions - check if the base one is here
if ($ext_loaded === TRUE)
{
$base_helper = BASEPATH.'helpers/'.$helper.'.php';
if ( ! file_exists($base_helper))
{
show_error('Unable to load the requested file: helpers/'.$helper.'.php');
}
include_once($base_helper);
$this->_ci_helpers[$helper] = TRUE;
log_message('info', 'Helper loaded: '.$helper);
continue;
}
// No extensions found ... try loading regular helpers and/or overrides
foreach ($this->_ci_helper_paths as $path)
{
if (file_exists($path.'helpers/'.$helper.'.php'))
{
include_once($path.'helpers/'.$helper.'.php');
$this->_ci_helpers[$helper] = TRUE;
log_message('info', 'Helper loaded: '.$helper);
break;
}
}
// unable to load the helper
if ( ! isset($this->_ci_helpers[$helper]))
{
show_error('Unable to load the requested file: helpers/'.$helper.'.php');
}
}
return $this;
}
// --------------------------------------------------------------------
/**
* Load Helpers
*
* An alias for the helper() method in case the developer has
* written the plural form of it.
*
* @uses CI_Loader::helper()
* @param string|string[] $helpers Helper name(s)
* @return object
*/
public function helpers($helpers = array())
{
return $this->helper($helpers);
}
// --------------------------------------------------------------------
/**
* Language Loader
*
* Loads language files.
*
* @param string|string[] $files List of language file names to load
* @param string Language name
* @return object
*/
public function language($files, $lang = '')
{
get_instance()->lang->load($files, $lang);
return $this;
}
// --------------------------------------------------------------------
/**
* Config Loader
*
* Loads a config file (an alias for CI_Config::load()).
*
* @uses CI_Config::load()
* @param string $file Configuration file name
* @param bool $use_sections Whether configuration values should be loaded into their own section
* @param bool $fail_gracefully Whether to just return FALSE or display an error message
* @return bool TRUE if the file was loaded correctly or FALSE on failure
*/
public function config($file, $use_sections = FALSE, $fail_gracefully = FALSE)
{
return get_instance()->config->load($file, $use_sections, $fail_gracefully);
}
// --------------------------------------------------------------------
/**
* Driver Loader
*
* Loads a driver library.
*
* @param string|string[] $library Driver name(s)
* @param array $params Optional parameters to pass to the driver
* @param string $object_name An optional object name to assign to
*
* @return object|bool Object or FALSE on failure if $library is a string
* and $object_name is set. CI_Loader instance otherwise.
*/
public function driver($library, $params = NULL, $object_name = NULL)
{
if (is_array($library))
{
foreach ($library as $key => $value)
{
if (is_int($key))
{
$this->driver($value, $params);
}
else
{
$this->driver($key, $params, $value);
}
}
return $this;
}
elseif (empty($library))
{
return FALSE;
}
if ( ! class_exists('CI_Driver_Library', FALSE))
{
// We aren't instantiating an object here, just making the base class available
require BASEPATH.'libraries/Driver.php';
}
// We can save the loader some time since Drivers will *always* be in a subfolder,
// and typically identically named to the library
if ( ! strpos($library, '/'))
{
$library = ucfirst($library).'/'.$library;
}
return $this->library($library, $params, $object_name);
}
// --------------------------------------------------------------------
/**
* Add Package Path
*
* Prepends a parent path to the library, model, helper and config
* path arrays.
*
* @see CI_Loader::$_ci_library_paths
* @see CI_Loader::$_ci_model_paths
* @see CI_Loader::$_ci_helper_paths
* @see CI_Config::$_config_paths
*
* @param string $path Path to add
* @param bool $view_cascade (default: TRUE)
* @return object
*/
public function add_package_path($path, $view_cascade = TRUE)
{
$path = rtrim($path, '/').'/';
array_unshift($this->_ci_library_paths, $path);
array_unshift($this->_ci_model_paths, $path);
array_unshift($this->_ci_helper_paths, $path);
$this->_ci_view_paths = array($path.'views/' => $view_cascade) + $this->_ci_view_paths;
// Add config file path
$config =& $this->_ci_get_component('config');
$config->_config_paths[] = $path;
return $this;
}
// --------------------------------------------------------------------
/**
* Get Package Paths
*
* Return a list of all package paths.
*
* @param bool $include_base Whether to include BASEPATH (default: FALSE)
* @return array
*/
public function get_package_paths($include_base = FALSE)
{
return ($include_base === TRUE) ? $this->_ci_library_paths : $this->_ci_model_paths;
}
// --------------------------------------------------------------------
/**
* Remove Package Path
*
* Remove a path from the library, model, helper and/or config
* path arrays if it exists. If no path is provided, the most recently
* added path will be removed removed.
*
* @param string $path Path to remove
* @return object
*/
public function remove_package_path($path = '')
{
$config =& $this->_ci_get_component('config');
if ($path === '')
{
array_shift($this->_ci_library_paths);
array_shift($this->_ci_model_paths);
array_shift($this->_ci_helper_paths);
array_shift($this->_ci_view_paths);
array_pop($config->_config_paths);
}
else
{
$path = rtrim($path, '/').'/';
foreach (array('_ci_library_paths', '_ci_model_paths', '_ci_helper_paths') as $var)
{
if (($key = array_search($path, $this->{$var})) !== FALSE)
{
unset($this->{$var}[$key]);
}
}
if (isset($this->_ci_view_paths[$path.'views/']))
{
unset($this->_ci_view_paths[$path.'views/']);
}
if (($key = array_search($path, $config->_config_paths)) !== FALSE)
{
unset($config->_config_paths[$key]);
}
}
// make sure the application default paths are still in the array
$this->_ci_library_paths = array_unique(array_merge($this->_ci_library_paths, array(APPPATH, BASEPATH)));
$this->_ci_helper_paths = array_unique(array_merge($this->_ci_helper_paths, array(APPPATH, BASEPATH)));
$this->_ci_model_paths = array_unique(array_merge($this->_ci_model_paths, array(APPPATH)));
$this->_ci_view_paths = array_merge($this->_ci_view_paths, array(APPPATH.'views/' => TRUE));
$config->_config_paths = array_unique(array_merge($config->_config_paths, array(APPPATH)));
return $this;
}
// --------------------------------------------------------------------
/**
* Internal CI Data Loader
*
* Used to load views and files.
*
* Variables are prefixed with _ci_ to avoid symbol collision with
* variables made available to view files.
*
* @used-by CI_Loader::view()
* @used-by CI_Loader::file()
* @param array $_ci_data Data to load
* @return object
*/
protected function _ci_load($_ci_data)
{
// Set the default data variables
foreach (array('_ci_view', '_ci_vars', '_ci_path', '_ci_return') as $_ci_val)
{
$$_ci_val = isset($_ci_data[$_ci_val]) ? $_ci_data[$_ci_val] : FALSE;
}
$file_exists = FALSE;
// Set the path to the requested file
if (is_string($_ci_path) && $_ci_path !== '')
{
$_ci_x = explode('/', $_ci_path);
$_ci_file = end($_ci_x);
}
else
{
$_ci_ext = pathinfo($_ci_view, PATHINFO_EXTENSION);
$_ci_file = ($_ci_ext === '') ? $_ci_view.'.php' : $_ci_view;
foreach ($this->_ci_view_paths as $_ci_view_file => $cascade)
{
if (file_exists($_ci_view_file.$_ci_file))
{
$_ci_path = $_ci_view_file.$_ci_file;
$file_exists = TRUE;
break;
}
if ( ! $cascade)
{
break;
}
}
}
if ( ! $file_exists && ! file_exists($_ci_path))
{
show_error('Unable to load the requested file: '.$_ci_file);
}
// This allows anything loaded using $this->load (views, files, etc.)
// to become accessible from within the Controller and Model functions.
$_ci_CI =& get_instance();
foreach (get_object_vars($_ci_CI) as $_ci_key => $_ci_var)
{
if ( ! isset($this->$_ci_key))
{
$this->$_ci_key =& $_ci_CI->$_ci_key;
}
}
/*
* Extract and cache variables
*
* You can either set variables using the dedicated $this->load->vars()
* function or via the second parameter of this function. We'll merge
* the two types and cache them so that views that are embedded within
* other views can have access to these variables.
*/
if (is_array($_ci_vars))
{
foreach (array_keys($_ci_vars) as $key)
{
if (strncmp($key, '_ci_', 4) === 0)
{
unset($_ci_vars[$key]);
}
}
$this->_ci_cached_vars = array_merge($this->_ci_cached_vars, $_ci_vars);
}
extract($this->_ci_cached_vars);
/*
* Buffer the output
*
* We buffer the output for two reasons:
* 1. Speed. You get a significant speed boost.
* 2. So that the final rendered template can be post-processed by
* the output class. Why do we need post processing? For one thing,
* in order to show the elapsed page load time. Unless we can
* intercept the content right before it's sent to the browser and
* then stop the timer it won't be accurate.
*/
ob_start();
// If the PHP installation does not support short tags we'll
// do a little string replacement, changing the short tags
// to standard PHP echo statements.
if ( ! is_php('5.4') && ! ini_get('short_open_tag') && config_item('rewrite_short_tags') === TRUE)
{
echo eval('?>'.preg_replace('/;*\s*\?>/', '; ?>', str_replace(' $this->_ci_ob_level + 1)
{
ob_end_flush();
}
else
{
$_ci_CI->output->append_output(ob_get_contents());
@ob_end_clean();
}
return $this;
}
// --------------------------------------------------------------------
/**
* Internal CI Library Loader
*
* @used-by CI_Loader::library()
* @uses CI_Loader::_ci_init_library()
*
* @param string $class Class name to load
* @param mixed $params Optional parameters to pass to the class constructor
* @param string $object_name Optional object name to assign to
* @return void
*/
protected function _ci_load_library($class, $params = NULL, $object_name = NULL)
{
// Get the class name, and while we're at it trim any slashes.
// The directory path can be included as part of the class name,
// but we don't want a leading slash
$class = str_replace('.php', '', trim($class, '/'));
// Was the path included with the class name?
// We look for a slash to determine this
if (($last_slash = strrpos($class, '/')) !== FALSE)
{
// Extract the path
$subdir = substr($class, 0, ++$last_slash);
// Get the filename from the path
$class = substr($class, $last_slash);
}
else
{
$subdir = '';
}
$class = ucfirst($class);
// Is this a stock library? There are a few special conditions if so ...
if (file_exists(BASEPATH.'libraries/'.$subdir.$class.'.php'))
{
return $this->_ci_load_stock_library($class, $subdir, $params, $object_name);
}
// Let's search for the requested library file and load it.
foreach ($this->_ci_library_paths as $path)
{
// BASEPATH has already been checked for
if ($path === BASEPATH)
{
continue;
}
$filepath = $path.'libraries/'.$subdir.$class.'.php';
// Safety: Was the class already loaded by a previous call?
if (class_exists($class, FALSE))
{
// Before we deem this to be a duplicate request, let's see
// if a custom object name is being supplied. If so, we'll
// return a new instance of the object
if ($object_name !== NULL)
{
$CI =& get_instance();
if ( ! isset($CI->$object_name))
{
return $this->_ci_init_library($class, '', $params, $object_name);
}
}
log_message('debug', $class.' class already loaded. Second attempt ignored.');
return;
}
// Does the file exist? No? Bummer...
elseif ( ! file_exists($filepath))
{
continue;
}
include_once($filepath);
return $this->_ci_init_library($class, '', $params, $object_name);
}
// One last attempt. Maybe the library is in a subdirectory, but it wasn't specified?
if ($subdir === '')
{
return $this->_ci_load_library($class.'/'.$class, $params, $object_name);
}
// If we got this far we were unable to find the requested class.
log_message('error', 'Unable to load the requested class: '.$class);
show_error('Unable to load the requested class: '.$class);
}
// --------------------------------------------------------------------
/**
* Internal CI Stock Library Loader
*
* @used-by CI_Loader::_ci_load_library()
* @uses CI_Loader::_ci_init_library()
*
* @param string $library_name Library name to load
* @param string $file_path Path to the library filename, relative to libraries/
* @param mixed $params Optional parameters to pass to the class constructor
* @param string $object_name Optional object name to assign to
* @return void
*/
protected function _ci_load_stock_library($library_name, $file_path, $params, $object_name)
{
$prefix = 'CI_';
if (class_exists($prefix.$library_name, FALSE))
{
if (class_exists(config_item('subclass_prefix').$library_name, FALSE))
{
$prefix = config_item('subclass_prefix');
}
// Before we deem this to be a duplicate request, let's see
// if a custom object name is being supplied. If so, we'll
// return a new instance of the object
if ($object_name !== NULL)
{
$CI =& get_instance();
if ( ! isset($CI->$object_name))
{
return $this->_ci_init_library($library_name, $prefix, $params, $object_name);
}
}
log_message('debug', $library_name.' class already loaded. Second attempt ignored.');
return;
}
$paths = $this->_ci_library_paths;
array_pop($paths); // BASEPATH
array_pop($paths); // APPPATH (needs to be the first path checked)
array_unshift($paths, APPPATH);
foreach ($paths as $path)
{
if (file_exists($path = $path.'libraries/'.$file_path.$library_name.'.php'))
{
// Override
include_once($path);
if (class_exists($prefix.$library_name, FALSE))
{
return $this->_ci_init_library($library_name, $prefix, $params, $object_name);
}
else
{
log_message('debug', $path.' exists, but does not declare '.$prefix.$library_name);
}
}
}
include_once(BASEPATH.'libraries/'.$file_path.$library_name.'.php');
// Check for extensions
$subclass = config_item('subclass_prefix').$library_name;
foreach ($paths as $path)
{
if (file_exists($path = $path.'libraries/'.$file_path.$subclass.'.php'))
{
include_once($path);
if (class_exists($subclass, FALSE))
{
$prefix = config_item('subclass_prefix');
break;
}
else
{
log_message('debug', $path.' exists, but does not declare '.$subclass);
}
}
}
return $this->_ci_init_library($library_name, $prefix, $params, $object_name);
}
// --------------------------------------------------------------------
/**
* Internal CI Library Instantiator
*
* @used-by CI_Loader::_ci_load_stock_library()
* @used-by CI_Loader::_ci_load_library()
*
* @param string $class Class name
* @param string $prefix Class name prefix
* @param array|null|bool $config Optional configuration to pass to the class constructor:
* FALSE to skip;
* NULL to search in config paths;
* array containing configuration data
* @param string $object_name Optional object name to assign to
* @return void
*/
protected function _ci_init_library($class, $prefix, $config = FALSE, $object_name = NULL)
{
// Is there an associated config file for this class? Note: these should always be lowercase
if ($config === NULL)
{
// Fetch the config paths containing any package paths
$config_component = $this->_ci_get_component('config');
if (is_array($config_component->_config_paths))
{
$found = FALSE;
foreach ($config_component->_config_paths as $path)
{
// We test for both uppercase and lowercase, for servers that
// are case-sensitive with regard to file names. Load global first,
// override with environment next
if (file_exists($path.'config/'.strtolower($class).'.php'))
{
include($path.'config/'.strtolower($class).'.php');
$found = TRUE;
}
elseif (file_exists($path.'config/'.ucfirst(strtolower($class)).'.php'))
{
include($path.'config/'.ucfirst(strtolower($class)).'.php');
$found = TRUE;
}
if (file_exists($path.'config/'.ENVIRONMENT.'/'.strtolower($class).'.php'))
{
include($path.'config/'.ENVIRONMENT.'/'.strtolower($class).'.php');
$found = TRUE;
}
elseif (file_exists($path.'config/'.ENVIRONMENT.'/'.ucfirst(strtolower($class)).'.php'))
{
include($path.'config/'.ENVIRONMENT.'/'.ucfirst(strtolower($class)).'.php');
$found = TRUE;
}
// Break on the first found configuration, thus package
// files are not overridden by default paths
if ($found === TRUE)
{
break;
}
}
}
}
$class_name = $prefix.$class;
// Is the class name valid?
if ( ! class_exists($class_name, FALSE))
{
log_message('error', 'Non-existent class: '.$class_name);
show_error('Non-existent class: '.$class_name);
}
// Set the variable name we will assign the class to
// Was a custom class name supplied? If so we'll use it
if (empty($object_name))
{
$object_name = strtolower($class);
if (isset($this->_ci_varmap[$object_name]))
{
$object_name = $this->_ci_varmap[$object_name];
}
}
// Don't overwrite existing properties
$CI =& get_instance();
if (isset($CI->$object_name))
{
if ($CI->$object_name instanceof $class_name)
{
log_message('debug', $class_name." has already been instantiated as '".$object_name."'. Second attempt aborted.");
return;
}
show_error("Resource '".$object_name."' already exists and is not a ".$class_name." instance.");
}
// Save the class name and object name
$this->_ci_classes[$object_name] = $class;
// Instantiate the class
$CI->$object_name = isset($config)
? new $class_name($config)
: new $class_name();
}
// --------------------------------------------------------------------
/**
* CI Autoloader
*
* Loads component listed in the config/autoload.php file.
*
* @used-by CI_Loader::initialize()
* @return void
*/
protected function _ci_autoloader()
{
if (file_exists(APPPATH.'config/autoload.php'))
{
include(APPPATH.'config/autoload.php');
}
if (file_exists(APPPATH.'config/'.ENVIRONMENT.'/autoload.php'))
{
include(APPPATH.'config/'.ENVIRONMENT.'/autoload.php');
}
if ( ! isset($autoload))
{
return;
}
// Autoload packages
if (isset($autoload['packages']))
{
foreach ($autoload['packages'] as $package_path)
{
$this->add_package_path($package_path);
}
}
// Load any custom config file
if (count($autoload['config']) > 0)
{
foreach ($autoload['config'] as $val)
{
$this->config($val);
}
}
// Autoload helpers and languages
foreach (array('helper', 'language') as $type)
{
if (isset($autoload[$type]) && count($autoload[$type]) > 0)
{
$this->$type($autoload[$type]);
}
}
// Autoload drivers
if (isset($autoload['drivers']))
{
$this->driver($autoload['drivers']);
}
// Load libraries
if (isset($autoload['libraries']) && count($autoload['libraries']) > 0)
{
// Load the database driver.
if (in_array('database', $autoload['libraries']))
{
$this->database();
$autoload['libraries'] = array_diff($autoload['libraries'], array('database'));
}
// Load all other libraries
$this->library($autoload['libraries']);
}
// Autoload models
if (isset($autoload['model']))
{
$this->model($autoload['model']);
}
}
// --------------------------------------------------------------------
/**
* CI Object to Array translator
*
* Takes an object as input and converts the class variables to
* an associative array with key/value pairs.
*
* @param object $object Object data to translate
* @return array
*/
protected function _ci_object_to_array($object)
{
return is_object($object) ? get_object_vars($object) : $object;
}
// --------------------------------------------------------------------
/**
* CI Component getter
*
* Get a reference to a specific library or model.
*
* @param string $component Component name
* @return bool
*/
protected function &_ci_get_component($component)
{
$CI =& get_instance();
return $CI->$component;
}
// --------------------------------------------------------------------
/**
* Prep filename
*
* This function prepares filenames of various items to
* make their loading more reliable.
*
* @param string|string[] $filename Filename(s)
* @param string $extension Filename extension
* @return array
*/
protected function _ci_prep_filename($filename, $extension)
{
if ( ! is_array($filename))
{
return array(strtolower(str_replace(array($extension, '.php'), '', $filename).$extension));
}
else
{
foreach ($filename as $key => $val)
{
$filename[$key] = strtolower(str_replace(array($extension, '.php'), '', $val).$extension);
}
return $filename;
}
}
}
PK ! S S Controller.phpnu [ $class)
{
$this->$var =& load_class($class);
}
$this->load =& load_class('Loader', 'core');
$this->load->initialize();
log_message('info', 'Controller Class Initialized');
}
// --------------------------------------------------------------------
/**
* Get the CI singleton
*
* @static
* @return object
*/
public static function &get_instance()
{
return self::$instance;
}
}
PK ! s~ ~ Log.phpnu [ 1, 'DEBUG' => 2, 'INFO' => 3, 'ALL' => 4);
/**
* mbstring.func_override flag
*
* @var bool
*/
protected static $func_override;
// --------------------------------------------------------------------
/**
* Class constructor
*
* @return void
*/
public function __construct()
{
$config =& get_config();
isset(self::$func_override) OR self::$func_override = (extension_loaded('mbstring') && ini_get('mbstring.func_override'));
$this->_log_path = ($config['log_path'] !== '') ? $config['log_path'] : APPPATH.'logs/';
$this->_file_ext = (isset($config['log_file_extension']) && $config['log_file_extension'] !== '')
? ltrim($config['log_file_extension'], '.') : 'php';
file_exists($this->_log_path) OR mkdir($this->_log_path, 0755, TRUE);
if ( ! is_dir($this->_log_path) OR ! is_really_writable($this->_log_path))
{
$this->_enabled = FALSE;
}
if (is_numeric($config['log_threshold']))
{
$this->_threshold = (int) $config['log_threshold'];
}
elseif (is_array($config['log_threshold']))
{
$this->_threshold = 0;
$this->_threshold_array = array_flip($config['log_threshold']);
}
if ( ! empty($config['log_date_format']))
{
$this->_date_fmt = $config['log_date_format'];
}
if ( ! empty($config['log_file_permissions']) && is_int($config['log_file_permissions']))
{
$this->_file_permissions = $config['log_file_permissions'];
}
}
// --------------------------------------------------------------------
/**
* Write Log File
*
* Generally this function will be called using the global log_message() function
*
* @param string $level The error level: 'error', 'debug' or 'info'
* @param string $msg The error message
* @return bool
*/
public function write_log($level, $msg)
{
if ($this->_enabled === FALSE)
{
return FALSE;
}
$level = strtoupper($level);
if (( ! isset($this->_levels[$level]) OR ($this->_levels[$level] > $this->_threshold))
&& ! isset($this->_threshold_array[$this->_levels[$level]]))
{
return FALSE;
}
$filepath = $this->_log_path.'log-'.date('Y-m-d').'.'.$this->_file_ext;
$message = '';
if ( ! file_exists($filepath))
{
$newfile = TRUE;
// Only add protection to php files
if ($this->_file_ext === 'php')
{
$message .= "\n\n";
}
}
if ( ! $fp = @fopen($filepath, 'ab'))
{
return FALSE;
}
flock($fp, LOCK_EX);
// Instantiating DateTime with microseconds appended to initial date is needed for proper support of this format
if (strpos($this->_date_fmt, 'u') !== FALSE)
{
$microtime_full = microtime(TRUE);
$microtime_short = sprintf("%06d", ($microtime_full - floor($microtime_full)) * 1000000);
$date = new DateTime(date('Y-m-d H:i:s.'.$microtime_short, $microtime_full));
$date = $date->format($this->_date_fmt);
}
else
{
$date = date($this->_date_fmt);
}
$message .= $this->_format_line($level, $date, $msg);
for ($written = 0, $length = self::strlen($message); $written < $length; $written += $result)
{
if (($result = fwrite($fp, self::substr($message, $written))) === FALSE)
{
break;
}
}
flock($fp, LOCK_UN);
fclose($fp);
if (isset($newfile) && $newfile === TRUE)
{
chmod($filepath, $this->_file_permissions);
}
return is_int($result);
}
// --------------------------------------------------------------------
/**
* Format the log line.
*
* This is for extensibility of log formatting
* If you want to change the log format, extend the CI_Log class and override this method
*
* @param string $level The error level
* @param string $date Formatted date string
* @param string $message The log message
* @return string Formatted log line with a new line character '\n' at the end
*/
protected function _format_line($level, $date, $message)
{
return $level.' - '.$date.' --> '.$message."\n";
}
// --------------------------------------------------------------------
/**
* Byte-safe strlen()
*
* @param string $str
* @return int
*/
protected static function strlen($str)
{
return (self::$func_override)
? mb_strlen($str, '8bit')
: strlen($str);
}
// --------------------------------------------------------------------
/**
* Byte-safe substr()
*
* @param string $str
* @param int $start
* @param int $length
* @return string
*/
protected static function substr($str, $start, $length = NULL)
{
if (self::$func_override)
{
// mb_substr($str, $start, null, '8bit') returns an empty
// string on PHP 5.3
isset($length) OR $length = ($start >= 0 ? self::strlen($str) - $start : -$start);
return mb_substr($str, $start, $length, '8bit');
}
return isset($length)
? substr($str, $start, $length)
: substr($str, $start);
}
}
PK ! UX_3 _3
Router.phpnu [ config =& load_class('Config', 'core');
$this->uri =& load_class('URI', 'core');
$this->enable_query_strings = ( ! is_cli() && $this->config->item('enable_query_strings') === TRUE);
// If a directory override is configured, it has to be set before any dynamic routing logic
is_array($routing) && isset($routing['directory']) && $this->set_directory($routing['directory']);
$this->_set_routing();
// Set any routing overrides that may exist in the main index file
if (is_array($routing))
{
empty($routing['controller']) OR $this->set_class($routing['controller']);
empty($routing['function']) OR $this->set_method($routing['function']);
}
log_message('info', 'Router Class Initialized');
}
// --------------------------------------------------------------------
/**
* Set route mapping
*
* Determines what should be served based on the URI request,
* as well as any "routes" that have been set in the routing config file.
*
* @return void
*/
protected function _set_routing()
{
// Load the routes.php file. It would be great if we could
// skip this for enable_query_strings = TRUE, but then
// default_controller would be empty ...
if (file_exists(APPPATH.'config/routes.php'))
{
include(APPPATH.'config/routes.php');
}
if (file_exists(APPPATH.'config/'.ENVIRONMENT.'/routes.php'))
{
include(APPPATH.'config/'.ENVIRONMENT.'/routes.php');
}
// Validate & get reserved routes
if (isset($route) && is_array($route))
{
isset($route['default_controller']) && $this->default_controller = $route['default_controller'];
isset($route['translate_uri_dashes']) && $this->translate_uri_dashes = $route['translate_uri_dashes'];
unset($route['default_controller'], $route['translate_uri_dashes']);
$this->routes = $route;
}
// Are query strings enabled in the config file? Normally CI doesn't utilize query strings
// since URI segments are more search-engine friendly, but they can optionally be used.
// If this feature is enabled, we will gather the directory/class/method a little differently
if ($this->enable_query_strings)
{
// If the directory is set at this time, it means an override exists, so skip the checks
if ( ! isset($this->directory))
{
$_d = $this->config->item('directory_trigger');
$_d = isset($_GET[$_d]) ? trim($_GET[$_d], " \t\n\r\0\x0B/") : '';
if ($_d !== '')
{
$this->uri->filter_uri($_d);
$this->set_directory($_d);
}
}
$_c = trim($this->config->item('controller_trigger'));
if ( ! empty($_GET[$_c]))
{
$this->uri->filter_uri($_GET[$_c]);
$this->set_class($_GET[$_c]);
$_f = trim($this->config->item('function_trigger'));
if ( ! empty($_GET[$_f]))
{
$this->uri->filter_uri($_GET[$_f]);
$this->set_method($_GET[$_f]);
}
$this->uri->rsegments = array(
1 => $this->class,
2 => $this->method
);
}
else
{
$this->_set_default_controller();
}
// Routing rules don't apply to query strings and we don't need to detect
// directories, so we're done here
return;
}
// Is there anything to parse?
if ($this->uri->uri_string !== '')
{
$this->_parse_routes();
}
else
{
$this->_set_default_controller();
}
}
// --------------------------------------------------------------------
/**
* Set request route
*
* Takes an array of URI segments as input and sets the class/method
* to be called.
*
* @used-by CI_Router::_parse_routes()
* @param array $segments URI segments
* @return void
*/
protected function _set_request($segments = array())
{
$segments = $this->_validate_request($segments);
// If we don't have any segments left - try the default controller;
// WARNING: Directories get shifted out of the segments array!
if (empty($segments))
{
$this->_set_default_controller();
return;
}
if ($this->translate_uri_dashes === TRUE)
{
$segments[0] = str_replace('-', '_', $segments[0]);
if (isset($segments[1]))
{
$segments[1] = str_replace('-', '_', $segments[1]);
}
}
$this->set_class($segments[0]);
if (isset($segments[1]))
{
$this->set_method($segments[1]);
}
else
{
$segments[1] = 'index';
}
array_unshift($segments, NULL);
unset($segments[0]);
$this->uri->rsegments = $segments;
}
// --------------------------------------------------------------------
/**
* Set default controller
*
* @return void
*/
protected function _set_default_controller()
{
if (empty($this->default_controller))
{
show_error('Unable to determine what should be displayed. A default route has not been specified in the routing file.');
}
// Is the method being specified?
if (sscanf($this->default_controller, '%[^/]/%s', $class, $method) !== 2)
{
$method = 'index';
}
if ( ! file_exists(APPPATH.'controllers/'.$this->directory.ucfirst($class).'.php'))
{
// This will trigger 404 later
return;
}
$this->set_class($class);
$this->set_method($method);
// Assign routed segments, index starting from 1
$this->uri->rsegments = array(
1 => $class,
2 => $method
);
log_message('debug', 'No URI present. Default controller set.');
}
// --------------------------------------------------------------------
/**
* Validate request
*
* Attempts validate the URI request and determine the controller path.
*
* @used-by CI_Router::_set_request()
* @param array $segments URI segments
* @return mixed URI segments
*/
protected function _validate_request($segments)
{
$c = count($segments);
$directory_override = isset($this->directory);
// Loop through our segments and return as soon as a controller
// is found or when such a directory doesn't exist
while ($c-- > 0)
{
$test = $this->directory
.ucfirst($this->translate_uri_dashes === TRUE ? str_replace('-', '_', $segments[0]) : $segments[0]);
if ( ! file_exists(APPPATH.'controllers/'.$test.'.php')
&& $directory_override === FALSE
&& is_dir(APPPATH.'controllers/'.$this->directory.$segments[0])
)
{
$this->set_directory(array_shift($segments), TRUE);
continue;
}
return $segments;
}
// This means that all segments were actually directories
return $segments;
}
// --------------------------------------------------------------------
/**
* Parse Routes
*
* Matches any routes that may exist in the config/routes.php file
* against the URI to determine if the class/method need to be remapped.
*
* @return void
*/
protected function _parse_routes()
{
// Turn the segment array into a URI string
$uri = implode('/', $this->uri->segments);
// Get HTTP verb
$http_verb = isset($_SERVER['REQUEST_METHOD']) ? strtolower($_SERVER['REQUEST_METHOD']) : 'cli';
// Loop through the route array looking for wildcards
foreach ($this->routes as $key => $val)
{
// Check if route format is using HTTP verbs
if (is_array($val))
{
$val = array_change_key_case($val, CASE_LOWER);
if (isset($val[$http_verb]))
{
$val = $val[$http_verb];
}
else
{
continue;
}
}
// Convert wildcards to RegEx
$key = str_replace(array(':any', ':num'), array('[^/]+', '[0-9]+'), $key);
// Does the RegEx match?
if (preg_match('#^'.$key.'$#', $uri, $matches))
{
// Are we using callbacks to process back-references?
if ( ! is_string($val) && is_callable($val))
{
// Remove the original string from the matches array.
array_shift($matches);
// Execute the callback using the values in matches as its parameters.
$val = call_user_func_array($val, $matches);
}
// Are we using the default routing method for back-references?
elseif (strpos($val, '$') !== FALSE && strpos($key, '(') !== FALSE)
{
$val = preg_replace('#^'.$key.'$#', $val, $uri);
}
$this->_set_request(explode('/', $val));
return;
}
}
// If we got this far it means we didn't encounter a
// matching route so we'll set the site default route
$this->_set_request(array_values($this->uri->segments));
}
// --------------------------------------------------------------------
/**
* Set class name
*
* @param string $class Class name
* @return void
*/
public function set_class($class)
{
$this->class = str_replace(array('/', '.'), '', $class);
}
// --------------------------------------------------------------------
/**
* Fetch the current class
*
* @deprecated 3.0.0 Read the 'class' property instead
* @return string
*/
public function fetch_class()
{
return $this->class;
}
// --------------------------------------------------------------------
/**
* Set method name
*
* @param string $method Method name
* @return void
*/
public function set_method($method)
{
$this->method = $method;
}
// --------------------------------------------------------------------
/**
* Fetch the current method
*
* @deprecated 3.0.0 Read the 'method' property instead
* @return string
*/
public function fetch_method()
{
return $this->method;
}
// --------------------------------------------------------------------
/**
* Set directory name
*
* @param string $dir Directory name
* @param bool $append Whether we're appending rather than setting the full value
* @return void
*/
public function set_directory($dir, $append = FALSE)
{
if ($append !== TRUE OR empty($this->directory))
{
$this->directory = str_replace('.', '', trim($dir, '/')).'/';
}
else
{
$this->directory .= str_replace('.', '', trim($dir, '/')).'/';
}
}
// --------------------------------------------------------------------
/**
* Fetch directory
*
* Feches the sub-directory (if any) that contains the requested
* controller class.
*
* @deprecated 3.0.0 Read the 'directory' property instead
* @return string
*/
public function fetch_directory()
{
return $this->directory;
}
}
PK ! o o Security.phpnu [ ', '<', '>',
"'", '"', '&', '$', '#',
'{', '}', '[', ']', '=',
';', '?', '%20', '%22',
'%3c', // <
'%253c', // <
'%3e', // >
'%0e', // >
'%28', // (
'%29', // )
'%2528', // (
'%26', // &
'%24', // $
'%3f', // ?
'%3b', // ;
'%3d' // =
);
/**
* Character set
*
* Will be overridden by the constructor.
*
* @var string
*/
public $charset = 'UTF-8';
/**
* XSS Hash
*
* Random Hash for protecting URLs.
*
* @var string
*/
protected $_xss_hash;
/**
* CSRF Hash
*
* Random hash for Cross Site Request Forgery protection cookie
*
* @var string
*/
protected $_csrf_hash;
/**
* CSRF Expire time
*
* Expiration time for Cross Site Request Forgery protection cookie.
* Defaults to two hours (in seconds).
*
* @var int
*/
protected $_csrf_expire = 7200;
/**
* CSRF Token name
*
* Token name for Cross Site Request Forgery protection cookie.
*
* @var string
*/
protected $_csrf_token_name = 'ci_csrf_token';
/**
* CSRF Cookie name
*
* Cookie name for Cross Site Request Forgery protection cookie.
*
* @var string
*/
protected $_csrf_cookie_name = 'ci_csrf_token';
/**
* List of never allowed strings
*
* @var array
*/
protected $_never_allowed_str = array(
'document.cookie' => '[removed]',
'document.write' => '[removed]',
'.parentNode' => '[removed]',
'.innerHTML' => '[removed]',
'-moz-binding' => '[removed]',
'' => '-->',
' '<![CDATA[',
'' => '<comment>',
'<%' => '<%'
);
/**
* List of never allowed regex replacements
*
* @var array
*/
protected $_never_allowed_regex = array(
'javascript\s*:',
'(document|(document\.)?window)\.(location|on\w*)',
'expression\s*(\(|&\#40;)', // CSS and IE
'vbscript\s*:', // IE, surprise!
'wscript\s*:', // IE
'jscript\s*:', // IE
'vbs\s*:', // IE
'Redirect\s+30\d',
"([\"'])?data\s*:[^\\1]*?base64[^\\1]*?,[^\\1]*?\\1?"
);
/**
* Class constructor
*
* @return void
*/
public function __construct()
{
// Is CSRF protection enabled?
if (config_item('csrf_protection'))
{
// CSRF config
foreach (array('csrf_expire', 'csrf_token_name', 'csrf_cookie_name') as $key)
{
if (NULL !== ($val = config_item($key)))
{
$this->{'_'.$key} = $val;
}
}
// Append application specific cookie prefix
if ($cookie_prefix = config_item('cookie_prefix'))
{
$this->_csrf_cookie_name = $cookie_prefix.$this->_csrf_cookie_name;
}
// Set the CSRF hash
$this->_csrf_set_hash();
}
$this->charset = strtoupper(config_item('charset'));
log_message('info', 'Security Class Initialized');
}
// --------------------------------------------------------------------
/**
* CSRF Verify
*
* @return CI_Security
*/
public function csrf_verify()
{
// If it's not a POST request we will set the CSRF cookie
if (strtoupper($_SERVER['REQUEST_METHOD']) !== 'POST')
{
return $this->csrf_set_cookie();
}
// Check if URI has been whitelisted from CSRF checks
if ($exclude_uris = config_item('csrf_exclude_uris'))
{
$uri = load_class('URI', 'core');
foreach ($exclude_uris as $excluded)
{
if (preg_match('#^'.$excluded.'$#i'.(UTF8_ENABLED ? 'u' : ''), $uri->uri_string()))
{
return $this;
}
}
}
// Do the tokens exist in both the _POST and _COOKIE arrays?
if ( ! isset($_POST[$this->_csrf_token_name], $_COOKIE[$this->_csrf_cookie_name])
OR $_POST[$this->_csrf_token_name] !== $_COOKIE[$this->_csrf_cookie_name]) // Do the tokens match?
{
$this->csrf_show_error();
}
// We kill this since we're done and we don't want to pollute the _POST array
unset($_POST[$this->_csrf_token_name]);
// Regenerate on every submission?
if (config_item('csrf_regenerate'))
{
// Nothing should last forever
unset($_COOKIE[$this->_csrf_cookie_name]);
$this->_csrf_hash = NULL;
}
$this->_csrf_set_hash();
$this->csrf_set_cookie();
log_message('info', 'CSRF token verified');
return $this;
}
// --------------------------------------------------------------------
/**
* CSRF Set Cookie
*
* @codeCoverageIgnore
* @return CI_Security
*/
public function csrf_set_cookie()
{
$expire = time() + $this->_csrf_expire;
$secure_cookie = (bool) config_item('cookie_secure');
if ($secure_cookie && ! is_https())
{
return FALSE;
}
setcookie(
$this->_csrf_cookie_name,
$this->_csrf_hash,
$expire,
config_item('cookie_path'),
config_item('cookie_domain'),
$secure_cookie,
config_item('cookie_httponly')
);
log_message('info', 'CSRF cookie sent');
return $this;
}
// --------------------------------------------------------------------
/**
* Show CSRF Error
*
* @return void
*/
public function csrf_show_error()
{
show_error('The action you have requested is not allowed.', 403);
}
// --------------------------------------------------------------------
/**
* Get CSRF Hash
*
* @see CI_Security::$_csrf_hash
* @return string CSRF hash
*/
public function get_csrf_hash()
{
return $this->_csrf_hash;
}
// --------------------------------------------------------------------
/**
* Get CSRF Token Name
*
* @see CI_Security::$_csrf_token_name
* @return string CSRF token name
*/
public function get_csrf_token_name()
{
return $this->_csrf_token_name;
}
// --------------------------------------------------------------------
/**
* XSS Clean
*
* Sanitizes data so that Cross Site Scripting Hacks can be
* prevented. This method does a fair amount of work but
* it is extremely thorough, designed to prevent even the
* most obscure XSS attempts. Nothing is ever 100% foolproof,
* of course, but I haven't been able to get anything passed
* the filter.
*
* Note: Should only be used to deal with data upon submission.
* It's not something that should be used for general
* runtime processing.
*
* @link http://channel.bitflux.ch/wiki/XSS_Prevention
* Based in part on some code and ideas from Bitflux.
*
* @link http://ha.ckers.org/xss.html
* To help develop this script I used this great list of
* vulnerabilities along with a few other hacks I've
* harvested from examining vulnerabilities in other programs.
*
* @param string|string[] $str Input data
* @param bool $is_image Whether the input is an image
* @return string
*/
public function xss_clean($str, $is_image = FALSE)
{
// Is the string an array?
if (is_array($str))
{
while (list($key) = each($str))
{
$str[$key] = $this->xss_clean($str[$key]);
}
return $str;
}
// Remove Invisible Characters
$str = remove_invisible_characters($str);
/*
* URL Decode
*
* Just in case stuff like this is submitted:
*
* Google
*
* Note: Use rawurldecode() so it does not remove plus signs
*/
if (stripos($str, '%') !== false)
{
do
{
$oldstr = $str;
$str = rawurldecode($str);
$str = preg_replace_callback('#%(?:\s*[0-9a-f]){2,}#i', array($this, '_urldecodespaces'), $str);
}
while ($oldstr !== $str);
unset($oldstr);
}
/*
* Convert character entities to ASCII
*
* This permits our tests below to work reliably.
* We only convert entities that are within tags since
* these are the ones that will pose security problems.
*/
$str = preg_replace_callback("/[^a-z0-9>]+[a-z0-9]+=([\'\"]).*?\\1/si", array($this, '_convert_attribute'), $str);
$str = preg_replace_callback('/<\w+.*/si', array($this, '_decode_entity'), $str);
// Remove Invisible Characters Again!
$str = remove_invisible_characters($str);
/*
* Convert all tabs to spaces
*
* This prevents strings like this: ja vascript
* NOTE: we deal with spaces between characters later.
* NOTE: preg_replace was found to be amazingly slow here on
* large blocks of data, so we use str_replace.
*/
$str = str_replace("\t", ' ', $str);
// Capture converted string for later comparison
$converted_string = $str;
// Remove Strings that are never allowed
$str = $this->_do_never_allowed($str);
/*
* Makes PHP tags safe
*
* Note: XML tags are inadvertently replaced too:
*
* '), array('<?', '?>'), $str);
}
/*
* Compact any exploded words
*
* This corrects words like: j a v a s c r i p t
* These words are compacted back to their correct state.
*/
$words = array(
'javascript', 'expression', 'vbscript', 'jscript', 'wscript',
'vbs', 'script', 'base64', 'applet', 'alert', 'document',
'write', 'cookie', 'window', 'confirm', 'prompt', 'eval'
);
foreach ($words as $word)
{
$word = implode('\s*', str_split($word)).'\s*';
// We only want to do this when it is followed by a non-word character
// That way valid stuff like "dealer to" does not become "dealerto"
$str = preg_replace_callback('#('.substr($word, 0, -3).')(\W)#is', array($this, '_compact_exploded_words'), $str);
}
/*
* Remove disallowed Javascript in links or img tags
* We used to do some version comparisons and use of stripos(),
* but it is dog slow compared to these simplified non-capturing
* preg_match(), especially if the pattern exists in the string
*
* Note: It was reported that not only space characters, but all in
* the following pattern can be parsed as separators between a tag name
* and its attributes: [\d\s"\'`;,\/\=\(\x00\x0B\x09\x0C]
* ... however, remove_invisible_characters() above already strips the
* hex-encoded ones, so we'll skip them below.
*/
do
{
$original = $str;
if (preg_match('/]+([^>]*?)(?:>|$)#si', array($this, '_js_link_removal'), $str);
}
if (preg_match('/![]()
]*?)(?:\s?/?>|$)#si', array($this, '_js_img_removal'), $str);
}
if (preg_match('/script|xss/i', $str))
{
$str = preg_replace('##si', '[removed]', $str);
}
}
while ($original !== $str);
unset($original);
/*
* Sanitize naughty HTML elements
*
* If a tag containing any of the words in the list
* below is found, the tag gets converted to entities.
*
* So this: