Skip to content

Commit b014438

Browse files
paulbalandanpaulbalandan
committed
Merge branch 'develop' into 4.7
2 parents 4d912e3 + 9d032ef commit b014438

31 files changed

+326
-115
lines changed

‎.php-cs-fixer.tests.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@
3131
->notName('#Foobar.php$#');
3232

3333
$overrides = [
34-
'void_return' => true,
34+
'phpdoc_to_return_type' => true,
35+
'void_return' => true,
3536
];
3637

3738
return $config

‎admin/framework/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"php": "^8.1",
1414
"ext-intl": "*",
1515
"ext-mbstring": "*",
16-
"laminas/laminas-escaper": "^2.14",
16+
"laminas/laminas-escaper": "^2.17",
1717
"psr/log": "^3.0"
1818
},
1919
"require-dev": {

‎composer.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"php": "^8.1",
1414
"ext-intl": "*",
1515
"ext-mbstring": "*",
16-
"laminas/laminas-escaper": "^2.14",
16+
"laminas/laminas-escaper": "^2.17",
1717
"psr/log": "^3.0"
1818
},
1919
"require-dev": {
@@ -28,7 +28,7 @@
2828
"phpunit/phpcov": "^9.0.2 || ^10.0",
2929
"phpunit/phpunit": "^10.5.16 || ^11.2",
3030
"predis/predis": "^3.0",
31-
"rector/rector": "2.0.15",
31+
"rector/rector": "2.0.16",
3232
"shipmonk/phpstan-baseline-per-identifier": "^2.0"
3333
},
3434
"replace": {

‎phpstan-bootstrap.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22

3-
require __DIR__ . '/system/Test/bootstrap.php';
3+
require __DIR__ . '/system/util_bootstrap.php';
44

55
if (! defined('OCI_COMMIT_ON_SUCCESS')) {
66
define('OCI_COMMIT_ON_SUCCESS', 32);

‎psalm_autoload.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
declare(strict_types=1);
44

5-
require __DIR__ . '/system/Test/bootstrap.php';
5+
require __DIR__ . '/system/util_bootstrap.php';
66

77
$helperDirs = [
88
'system/Helpers',

‎rector.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@
7171
])
7272
// do you need to include constants, class aliases or custom autoloader? files listed will be executed
7373
->withBootstrapFiles([
74-
__DIR__ . '/system/Test/bootstrap.php',
74+
__DIR__ . '/system/util_bootstrap.php',
7575
])
7676
->withPHPStanConfigs([
7777
__DIR__ . '/phpstan.neon.dist',

‎system/Boot.php

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
use CodeIgniter\Cache\FactoriesCache;
1717
use CodeIgniter\CLI\Console;
1818
use CodeIgniter\Config\DotEnv;
19+
use Config\App;
1920
use Config\Autoload;
2021
use Config\Modules;
2122
use Config\Optimize;
@@ -75,6 +76,34 @@ public static function bootWeb(Paths $paths): int
7576
return EXIT_SUCCESS;
7677
}
7778

79+
/**
80+
* Used by command line scripts other than
81+
* * `spark`
82+
* * `php-cli`
83+
* * `phpunit`
84+
*
85+
* @used-by `system/util_bootstrap.php`
86+
*/
87+
public static function bootConsole(Paths $paths): void
88+
{
89+
static::definePathConstants($paths);
90+
static::loadConstants();
91+
static::checkMissingExtensions();
92+
93+
static::loadDotEnv($paths);
94+
static::loadEnvironmentBootstrap($paths);
95+
96+
static::loadCommonFunctions();
97+
static::loadAutoloader();
98+
static::setExceptionHandler();
99+
static::initializeKint();
100+
static::autoloadHelpers();
101+
102+
// We need to force the request to be a CLIRequest since we're in console
103+
Services::createRequest(new App(), true);
104+
service('routes')->loadRoutes();
105+
}
106+
78107
/**
79108
* Used by `spark`
80109
*

‎system/Config/AutoloadConfig.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
namespace CodeIgniter\Config;
1515

1616
use Laminas\Escaper\Escaper;
17+
use Laminas\Escaper\EscaperInterface;
1718
use Laminas\Escaper\Exception\ExceptionInterface;
1819
use Laminas\Escaper\Exception\InvalidArgumentException as EscaperInvalidArgumentException;
1920
use Laminas\Escaper\Exception\RuntimeException;
@@ -119,6 +120,7 @@ class AutoloadConfig
119120
ExceptionInterface::class => SYSTEMPATH . 'ThirdParty/Escaper/Exception/ExceptionInterface.php',
120121
EscaperInvalidArgumentException::class => SYSTEMPATH . 'ThirdParty/Escaper/Exception/InvalidArgumentException.php',
121122
RuntimeException::class => SYSTEMPATH . 'ThirdParty/Escaper/Exception/RuntimeException.php',
123+
EscaperInterface::class => SYSTEMPATH . 'ThirdParty/Escaper/EscaperInterface.php',
122124
Escaper::class => SYSTEMPATH . 'ThirdParty/Escaper/Escaper.php',
123125
];
124126

‎system/Cookie/Cookie.php

Lines changed: 33 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,16 @@ class Cookie implements ArrayAccess, CloneableCookieInterface
9999
* Default attributes for a Cookie object. The keys here are the
100100
* lowercase attribute names. Do not camelCase!
101101
*
102-
* @var array<string, bool|int|string>
102+
* @var array{
103+
* prefix: string,
104+
* expires: int,
105+
* path: string,
106+
* domain: string,
107+
* secure: bool,
108+
* httponly: bool,
109+
* samesite: string,
110+
* raw: bool,
111+
* }
103112
*/
104113
private static array $defaults = [
105114
'prefix' => '',
@@ -127,9 +136,27 @@ class Cookie implements ArrayAccess, CloneableCookieInterface
127136
*
128137
* This method is called from Response::__construct().
129138
*
130-
* @param array<string, bool|int|string>|CookieConfig $config
139+
* @param array{
140+
* prefix?: string,
141+
* expires?: int,
142+
* path?: string,
143+
* domain?: string,
144+
* secure?: bool,
145+
* httponly?: bool,
146+
* samesite?: string,
147+
* raw?: bool,
148+
* }|CookieConfig $config
131149
*
132-
* @return array<string, mixed> The old defaults array. Useful for resetting.
150+
* @return array{
151+
* prefix: string,
152+
* expires: int,
153+
* path: string,
154+
* domain: string,
155+
* secure: bool,
156+
* httponly: bool,
157+
* samesite: string,
158+
* raw: bool,
159+
* } The old defaults array. Useful for resetting.
133160
*/
134161
public static function setDefaults($config = [])
135162
{
@@ -198,9 +225,9 @@ public static function fromHeaderString(string $cookie, bool $raw = false)
198225
/**
199226
* Construct a new Cookie instance.
200227
*
201-
* @param string $name The cookie's name
202-
* @param string $value The cookie's value
203-
* @param array<string, bool|int|string> $options The cookie's options
228+
* @param string $name The cookie's name
229+
* @param string $value The cookie's value
230+
* @param array{prefix?: string, max-age?: int|numeric-string, expires?: DateTimeInterface|int|string, path?: string, domain?: string, secure?: bool, httponly?: bool, samesite?: string, raw?: bool} $options The cookie's options
204231
*
205232
* @throws CookieException
206233
*/

‎system/Cookie/CookieInterface.php

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,14 @@ public function isRaw(): bool;
145145
* Gets the options that are passable to the `setcookie` variant
146146
* available on PHP 7.3+
147147
*
148-
* @return array<string, bool|int|string>
148+
* @return array{
149+
* expires: int,
150+
* path: string,
151+
* domain: string,
152+
* secure: bool,
153+
* httponly: bool,
154+
* samesite: string,
155+
* }
149156
*/
150157
public function getOptions(): array;
151158

@@ -164,7 +171,18 @@ public function __toString();
164171
/**
165172
* Returns the array representation of the Cookie object.
166173
*
167-
* @return array<string, bool|int|string>
174+
* @return array{
175+
* name: string,
176+
* value: string,
177+
* prefix: string,
178+
* raw: bool,
179+
* expires: int,
180+
* path: string,
181+
* domain: string,
182+
* secure: bool,
183+
* httponly: bool,
184+
* samesite: string,
185+
* }
168186
*/
169187
public function toArray(): array;
170188
}

‎system/Helpers/security_helper.php

Lines changed: 61 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,69 @@
1515

1616
if (! function_exists('sanitize_filename')) {
1717
/**
18-
* Sanitize a filename to use in a URI.
18+
* Sanitize Filename
19+
*
20+
* Tries to sanitize filenames in order to prevent directory traversal attempts
21+
* and other security threats, which is particularly useful for files that
22+
* were supplied via user input.
23+
*
24+
* If it is acceptable for the user input to include relative paths,
25+
* e.g. file/in/some/approved/folder.txt, you can set the second optional
26+
* parameter, $relativePath to TRUE.
27+
*
28+
* @param string $filename Input file name
29+
* @param bool $relativePath Whether to preserve paths
1930
*/
20-
function sanitize_filename(string $filename): string
31+
function sanitize_filename(string $filename, bool $relativePath = false): string
2132
{
22-
return service('security')->sanitizeFilename($filename);
33+
// List of sanitized filename strings
34+
$bad = [
35+
'../',
36+
'<!--',
37+
'-->',
38+
'<',
39+
'>',
40+
"'",
41+
'"',
42+
'&',
43+
'$',
44+
'#',
45+
'{',
46+
'}',
47+
'[',
48+
']',
49+
'=',
50+
';',
51+
'?',
52+
'%20',
53+
'%22',
54+
'%3c',
55+
'%253c',
56+
'%3e',
57+
'%0e',
58+
'%28',
59+
'%29',
60+
'%2528',
61+
'%26',
62+
'%24',
63+
'%3f',
64+
'%3b',
65+
'%3d',
66+
];
67+
68+
if (! $relativePath) {
69+
$bad[] = './';
70+
$bad[] = '/';
71+
}
72+
73+
$filename = remove_invisible_characters($filename, false);
74+
75+
do {
76+
$old = $filename;
77+
$filename = str_replace($bad, '', $filename);
78+
} while ($old !== $filename);
79+
80+
return stripslashes($filename);
2381
}
2482
}
2583

‎system/Security/Security.php

Lines changed: 4 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -427,59 +427,16 @@ public function shouldRedirect(): bool
427427
* e.g. file/in/some/approved/folder.txt, you can set the second optional
428428
* parameter, $relativePath to TRUE.
429429
*
430+
* @deprecated 4.6.2 Use `sanitize_filename()` instead
431+
*
430432
* @param string $str Input file name
431433
* @param bool $relativePath Whether to preserve paths
432434
*/
433435
public function sanitizeFilename(string $str, bool $relativePath = false): string
434436
{
435-
// List of sanitize filename strings
436-
$bad = [
437-
'../',
438-
'<!--',
439-
'-->',
440-
'<',
441-
'>',
442-
"'",
443-
'"',
444-
'&',
445-
'$',
446-
'#',
447-
'{',
448-
'}',
449-
'[',
450-
']',
451-
'=',
452-
';',
453-
'?',
454-
'%20',
455-
'%22',
456-
'%3c',
457-
'%253c',
458-
'%3e',
459-
'%0e',
460-
'%28',
461-
'%29',
462-
'%2528',
463-
'%26',
464-
'%24',
465-
'%3f',
466-
'%3b',
467-
'%3d',
468-
];
469-
470-
if (! $relativePath) {
471-
$bad[] = './';
472-
$bad[] = '/';
473-
}
474-
475-
$str = remove_invisible_characters($str, false);
476-
477-
do {
478-
$old = $str;
479-
$str = str_replace($bad, '', $str);
480-
} while ($old !== $str);
437+
helper('security');
481438

482-
return stripslashes($str);
439+
return sanitize_filename($str, $relativePath);
483440
}
484441

485442
/**

‎system/Security/SecurityInterface.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,8 @@ public function shouldRedirect(): bool;
6666
* e.g. file/in/some/approved/folder.txt, you can set the second optional
6767
* parameter, $relativePath to TRUE.
6868
*
69+
* @deprecated 4.6.2 Use `sanitize_filename()` instead
70+
*
6971
* @param string $str Input file name
7072
* @param bool $relativePath Whether to preserve paths
7173
*/

0 commit comments

Comments
 (0)