/system/core/Input.php
PHP | 838 lines | 408 code | 106 blank | 324 comment | 64 complexity | e705203c57bddac94aef5c8595e97345 MD5 | raw file
Possible License(s): CC-BY-SA-3.0
- <?php
- /**
- * CodeIgniter
- *
- * An open source application development framework for PHP 5.2.4 or newer
- *
- * NOTICE OF LICENSE
- *
- * Licensed under the Open Software License version 3.0
- *
- * This source file is subject to the Open Software License (OSL 3.0) that is
- * bundled with this package in the files license.txt / license.rst. It is
- * also available through the world wide web at this URL:
- * http://opensource.org/licenses/OSL-3.0
- * If you did not receive a copy of the license and are unable to obtain it
- * through the world wide web, please send an email to
- * licensing@ellislab.com so we can send you a copy immediately.
- *
- * @package CodeIgniter
- * @author EllisLab Dev Team
- * @copyright Copyright (c) 2008 - 2014, EllisLab, Inc. (http://ellislab.com/)
- * @license http://opensource.org/licenses/OSL-3.0 Open Software License (OSL 3.0)
- * @link http://codeigniter.com
- * @since Version 1.0
- * @filesource
- */
- defined('BASEPATH') OR exit('No direct script access allowed');
- /**
- * Input Class
- *
- * Pre-processes global input data for security
- *
- * @package CodeIgniter
- * @subpackage Libraries
- * @category Input
- * @author EllisLab Dev Team
- * @link http://codeigniter.com/user_guide/libraries/input.html
- */
- class CI_Input {
- /**
- * IP address of the current user
- *
- * @var string
- */
- public $ip_address = FALSE;
- /**
- * Allow GET array flag
- *
- * If set to FALSE, then $_GET will be set to an empty array.
- *
- * @var bool
- */
- protected $_allow_get_array = TRUE;
- /**
- * Standardize new lines flag
- *
- * If set to TRUE, then newlines are standardized.
- *
- * @var bool
- */
- protected $_standardize_newlines;
- /**
- * Enable XSS flag
- *
- * Determines whether the XSS filter is always active when
- * GET, POST or COOKIE data is encountered.
- * Set automatically based on config setting.
- *
- * @var bool
- */
- protected $_enable_xss = FALSE;
- /**
- * Enable CSRF flag
- *
- * Enables a CSRF cookie token to be set.
- * Set automatically based on config setting.
- *
- * @var bool
- */
- protected $_enable_csrf = FALSE;
- /**
- * List of all HTTP request headers
- *
- * @var array
- */
- protected $headers = array();
- /**
- * Input stream data
- *
- * Parsed from php://input at runtime
- *
- * @see CI_Input::input_stream()
- * @var array
- */
- protected $_input_stream = NULL;
- /**
- * Class constructor
- *
- * Determines whether to globally enable the XSS processing
- * and whether to allow the $_GET array.
- *
- * @return void
- */
- public function __construct()
- {
- log_message('debug', 'Input Class Initialized');
- $this->_allow_get_array = (config_item('allow_get_array') === TRUE);
- $this->_enable_xss = (config_item('global_xss_filtering') === TRUE);
- $this->_enable_csrf = (config_item('csrf_protection') === TRUE);
- $this->_standardize_newlines = (bool) config_item('standardize_newlines');
- $this->security =& load_class('Security', 'core');
- // Do we need the UTF-8 class?
- if (UTF8_ENABLED === TRUE)
- {
- $this->uni =& load_class('Utf8', 'core');
- }
- // Sanitize global arrays
- $this->_sanitize_globals();
- }
- // --------------------------------------------------------------------
- /**
- * Fetch from array
- *
- * Internal method used to retrieve values from global arrays.
- *
- * @param array &$array $_GET, $_POST, $_COOKIE, $_SERVER, etc.
- * @param string $index Index for item to be fetched from $array
- * @param bool $xss_clean Whether to apply XSS filtering
- * @return mixed
- */
- protected function _fetch_from_array(&$array, $index = NULL, $xss_clean = NULL)
- {
- // If $index is NULL, it means that the whole $array is requested
- if ($index === NULL)
- {
- $output = array();
- foreach (array_keys($array) as $key)
- {
- $output[$key] = $this->_fetch_from_array($array, $key, $xss_clean);
- }
- return $output;
- }
- is_bool($xss_clean) OR $xss_clean = $this->_enable_xss;
- if (isset($array[$index]))
- {
- $value = $array[$index];
- }
- elseif (($count = preg_match_all('/(?:^[^\[]+)|\[[^]]*\]/', $index, $matches)) > 1) // Does the index contain array notation
- {
- $value = $array;
- for ($i = 0; $i < $count; $i++)
- {
- $key = trim($matches[0][$i], '[]');
- if ($key === '') // Empty notation will return the value as array
- {
- break;
- }
- if (isset($value[$key]))
- {
- $value = $value[$key];
- }
- else
- {
- return NULL;
- }
- }
- }
- else
- {
- return NULL;
- }
- return ($xss_clean === TRUE)
- ? $this->security->xss_clean($value)
- : $value;
- }
- // --------------------------------------------------------------------
- /**
- * Fetch an item from the GET array
- *
- * @param string $index Index for item to be fetched from $_GET
- * @param bool $xss_clean Whether to apply XSS filtering
- * @return mixed
- */
- public function get($index = NULL, $xss_clean = NULL)
- {
- return $this->_fetch_from_array($_GET, $index, $xss_clean);
- }
- // --------------------------------------------------------------------
- /**
- * Fetch an item from the POST array
- *
- * @param string $index Index for item to be fetched from $_POST
- * @param bool $xss_clean Whether to apply XSS filtering
- * @return mixed
- */
- public function post($index = NULL, $xss_clean = NULL)
- {
- return $this->_fetch_from_array($_POST, $index, $xss_clean);
- }
- // --------------------------------------------------------------------
- /**
- * Fetch an item from POST data with fallback to GET
- *
- * @param string $index Index for item to be fetched from $_POST or $_GET
- * @param bool $xss_clean Whether to apply XSS filtering
- * @return mixed
- */
- public function post_get($index, $xss_clean = NULL)
- {
- return isset($_POST[$index])
- ? $this->post($index, $xss_clean)
- : $this->get($index, $xss_clean);
- }
- // --------------------------------------------------------------------
- /**
- * Fetch an item from GET data with fallback to POST
- *
- * @param string $index Index for item to be fetched from $_GET or $_POST
- * @param bool $xss_clean Whether to apply XSS filtering
- * @return mixed
- */
- public function get_post($index, $xss_clean = NULL)
- {
- return isset($_GET[$index])
- ? $this->get($index, $xss_clean)
- : $this->post($index, $xss_clean);
- }
- // --------------------------------------------------------------------
- /**
- * Fetch an item from the COOKIE array
- *
- * @param string $index Index for item to be fetched from $_COOKIE
- * @param bool $xss_clean Whether to apply XSS filtering
- * @return mixed
- */
- public function cookie($index = NULL, $xss_clean = NULL)
- {
- return $this->_fetch_from_array($_COOKIE, $index, $xss_clean);
- }
- // --------------------------------------------------------------------
- /**
- * Fetch an item from the SERVER array
- *
- * @param string $index Index for item to be fetched from $_SERVER
- * @param bool $xss_clean Whether to apply XSS filtering
- * @return mixed
- */
- public function server($index, $xss_clean = NULL)
- {
- return $this->_fetch_from_array($_SERVER, $index, $xss_clean);
- }
- // ------------------------------------------------------------------------
- /**
- * Fetch an item from the php://input stream
- *
- * Useful when you need to access PUT, DELETE or PATCH request data.
- *
- * @param string $index Index for item to be fetched
- * @param bool $xss_clean Whether to apply XSS filtering
- * @return mixed
- */
- public function input_stream($index = NULL, $xss_clean = NULL)
- {
- // Prior to PHP 5.6, the input stream can only be read once,
- // so we'll need to check if we have already done that first.
- if ( ! is_array($this->_input_stream))
- {
- parse_str(file_get_contents('php://input'), $this->_input_stream);
- is_array($this->_input_stream) OR $this->_input_stream = array();
- }
- return $this->_fetch_from_array($this->_input_stream, $index, $xss_clean);
- }
- // ------------------------------------------------------------------------
- /**
- * Set cookie
- *
- * Accepts an arbitrary number of parameters (up to 7) or an associative
- * array in the first parameter containing all the values.
- *
- * @param string|mixed[] $name Cookie name or an array containing parameters
- * @param string $value Cookie value
- * @param int $expire Cookie expiration time in seconds
- * @param string $domain Cookie domain (e.g.: '.yourdomain.com')
- * @param string $path Cookie path (default: '/')
- * @param string $prefix Cookie name prefix
- * @param bool $secure Whether to only transfer cookies via SSL
- * @param bool $httponly Whether to only makes the cookie accessible via HTTP (no javascript)
- * @return void
- */
- public function set_cookie($name, $value = '', $expire = '', $domain = '', $path = '/', $prefix = '', $secure = FALSE, $httponly = FALSE)
- {
- if (is_array($name))
- {
- // always leave 'name' in last place, as the loop will break otherwise, due to $$item
- foreach (array('value', 'expire', 'domain', 'path', 'prefix', 'secure', 'httponly', 'name') as $item)
- {
- if (isset($name[$item]))
- {
- $$item = $name[$item];
- }
- }
- }
- if ($prefix === '' && config_item('cookie_prefix') !== '')
- {
- $prefix = config_item('cookie_prefix');
- }
- if ($domain == '' && config_item('cookie_domain') != '')
- {
- $domain = config_item('cookie_domain');
- }
- if ($path === '/' && config_item('cookie_path') !== '/')
- {
- $path = config_item('cookie_path');
- }
- if ($secure === FALSE && config_item('cookie_secure') !== FALSE)
- {
- $secure = config_item('cookie_secure');
- }
- if ($httponly === FALSE && config_item('cookie_httponly') !== FALSE)
- {
- $httponly = config_item('cookie_httponly');
- }
- if ( ! is_numeric($expire))
- {
- $expire = time() - 86500;
- }
- else
- {
- $expire = ($expire > 0) ? time() + $expire : 0;
- }
- setcookie($prefix.$name, $value, $expire, $path, $domain, $secure, $httponly);
- }
- // --------------------------------------------------------------------
- /**
- * Fetch the IP Address
- *
- * Determines and validates the visitor's IP address.
- *
- * @return string IP address
- */
- public function ip_address()
- {
- if ($this->ip_address !== FALSE)
- {
- return $this->ip_address;
- }
- $proxy_ips = config_item('proxy_ips');
- if ( ! empty($proxy_ips) && ! is_array($proxy_ips))
- {
- $proxy_ips = explode(',', str_replace(' ', '', $proxy_ips));
- }
- $this->ip_address = $this->server('REMOTE_ADDR');
- if ($proxy_ips)
- {
- foreach (array('HTTP_X_FORWARDED_FOR', 'HTTP_CLIENT_IP', 'HTTP_X_CLIENT_IP', 'HTTP_X_CLUSTER_CLIENT_IP') as $header)
- {
- if (($spoof = $this->server($header)) !== NULL)
- {
- // Some proxies typically list the whole chain of IP
- // addresses through which the client has reached us.
- // e.g. client_ip, proxy_ip1, proxy_ip2, etc.
- sscanf($spoof, '%[^,]', $spoof);
- if ( ! $this->valid_ip($spoof))
- {
- $spoof = NULL;
- }
- else
- {
- break;
- }
- }
- }
- if ($spoof)
- {
- for ($i = 0, $c = count($proxy_ips); $i < $c; $i++)
- {
- // Check if we have an IP address or a subnet
- if (strpos($proxy_ips[$i], '/') === FALSE)
- {
- // An IP address (and not a subnet) is specified.
- // We can compare right away.
- if ($proxy_ips[$i] === $this->ip_address)
- {
- $this->ip_address = $spoof;
- break;
- }
- continue;
- }
- // We have a subnet ... now the heavy lifting begins
- isset($separator) OR $separator = $this->valid_ip($this->ip_address, 'ipv6') ? ':' : '.';
- // If the proxy entry doesn't match the IP protocol - skip it
- if (strpos($proxy_ips[$i], $separator) === FALSE)
- {
- continue;
- }
- // Convert the REMOTE_ADDR IP address to binary, if needed
- if ( ! isset($ip, $sprintf))
- {
- if ($separator === ':')
- {
- // Make sure we're have the "full" IPv6 format
- $ip = explode(':',
- str_replace('::',
- str_repeat(':', 9 - substr_count($this->ip_address, ':')),
- $this->ip_address
- )
- );
- for ($i = 0; $i < 8; $i++)
- {
- $ip[$i] = intval($ip[$i], 16);
- }
- $sprintf = '%016b%016b%016b%016b%016b%016b%016b%016b';
- }
- else
- {
- $ip = explode('.', $this->ip_address);
- $sprintf = '%08b%08b%08b%08b';
- }
- $ip = vsprintf($sprintf, $ip);
- }
- // Split the netmask length off the network address
- sscanf($proxy_ips[$i], '%[^/]/%d', $netaddr, $masklen);
- // Again, an IPv6 address is most likely in a compressed form
- if ($separator === ':')
- {
- $netaddr = explode(':', str_replace('::', str_repeat(':', 9 - substr_count($netaddr, ':')), $netaddr));
- for ($i = 0; $i < 8; $i++)
- {
- $netaddr[$i] = intval($netaddr[$i], 16);
- }
- }
- else
- {
- $netaddr = explode('.', $netaddr);
- }
- // Convert to binary and finally compare
- if (strncmp($ip, vsprintf($sprintf, $netaddr), $masklen) === 0)
- {
- $this->ip_address = $spoof;
- break;
- }
- }
- }
- }
- if ( ! $this->valid_ip($this->ip_address))
- {
- return $this->ip_address = '0.0.0.0';
- }
- return $this->ip_address;
- }
- // --------------------------------------------------------------------
- /**
- * Validate IP Address
- *
- * @param string $ip IP address
- * @param string $which IP protocol: 'ipv4' or 'ipv6'
- * @return bool
- */
- public function valid_ip($ip, $which = '')
- {
- switch (strtolower($which))
- {
- case 'ipv4':
- $which = FILTER_FLAG_IPV4;
- break;
- case 'ipv6':
- $which = FILTER_FLAG_IPV6;
- break;
- default:
- $which = NULL;
- break;
- }
- return (bool) filter_var($ip, FILTER_VALIDATE_IP, $which);
- }
- // --------------------------------------------------------------------
- /**
- * Fetch User Agent string
- *
- * @return string|null User Agent string or NULL if it doesn't exist
- */
- public function user_agent($xss_clean = NULL)
- {
- return $this->_fetch_from_array($_SERVER, 'HTTP_USER_AGENT', $xss_clean);
- }
- // --------------------------------------------------------------------
- /**
- * Sanitize Globals
- *
- * Internal method serving for the following purposes:
- *
- * - Unsets $_GET data, if query strings are not enabled
- * - Cleans POST, COOKIE and SERVER data
- * - Standardizes newline characters to PHP_EOL
- *
- * @return void
- */
- protected function _sanitize_globals()
- {
- // Is $_GET data allowed? If not we'll set the $_GET to an empty array
- if ($this->_allow_get_array === FALSE)
- {
- $_GET = array();
- }
- elseif (is_array($_GET) && count($_GET) > 0)
- {
- foreach ($_GET as $key => $val)
- {
- $_GET[$this->_clean_input_keys($key)] = $this->_clean_input_data($val);
- }
- }
- // Clean $_POST Data
- if (is_array($_POST) && count($_POST) > 0)
- {
- foreach ($_POST as $key => $val)
- {
- $_POST[$this->_clean_input_keys($key)] = $this->_clean_input_data($val);
- }
- }
- // Clean $_COOKIE Data
- if (is_array($_COOKIE) && count($_COOKIE) > 0)
- {
- // Also get rid of specially treated cookies that might be set by a server
- // or silly application, that are of no use to a CI application anyway
- // but that when present will trip our 'Disallowed Key Characters' alarm
- // http://www.ietf.org/rfc/rfc2109.txt
- // note that the key names below are single quoted strings, and are not PHP variables
- unset(
- $_COOKIE['$Version'],
- $_COOKIE['$Path'],
- $_COOKIE['$Domain']
- );
- foreach ($_COOKIE as $key => $val)
- {
- if (($cookie_key = $this->_clean_input_keys($key)) !== FALSE)
- {
- $_COOKIE[$cookie_key] = $this->_clean_input_data($val);
- }
- else
- {
- unset($_COOKIE[$key]);
- }
- }
- }
- // Sanitize PHP_SELF
- $_SERVER['PHP_SELF'] = strip_tags($_SERVER['PHP_SELF']);
- // CSRF Protection check
- if ($this->_enable_csrf === TRUE && ! is_cli())
- {
- $this->security->csrf_verify();
- }
- log_message('debug', 'Global POST, GET and COOKIE data sanitized');
- }
- // --------------------------------------------------------------------
- /**
- * Clean Input Data
- *
- * Internal method that aids in escaping data and
- * standardizing newline characters to PHP_EOL.
- *
- * @param string|string[] $str Input string(s)
- * @return string
- */
- protected function _clean_input_data($str)
- {
- if (is_array($str))
- {
- $new_array = array();
- foreach (array_keys($str) as $key)
- {
- $new_array[$this->_clean_input_keys($key)] = $this->_clean_input_data($str[$key]);
- }
- return $new_array;
- }
- /* We strip slashes if magic quotes is on to keep things consistent
- NOTE: In PHP 5.4 get_magic_quotes_gpc() will always return 0 and
- it will probably not exist in future versions at all.
- */
- if ( ! is_php('5.4') && get_magic_quotes_gpc())
- {
- $str = stripslashes($str);
- }
- // Clean UTF-8 if supported
- if (UTF8_ENABLED === TRUE)
- {
- $str = $this->uni->clean_string($str);
- }
- // Remove control characters
- $str = remove_invisible_characters($str, FALSE);
- // Standardize newlines if needed
- if ($this->_standardize_newlines === TRUE)
- {
- return preg_replace('/(?:\r\n|[\r\n])/', PHP_EOL, $str);
- }
- return $str;
- }
- // --------------------------------------------------------------------
- /**
- * Clean Keys
- *
- * Internal method that helps to prevent malicious users
- * from trying to exploit keys we make sure that keys are
- * only named with alpha-numeric text and a few other items.
- *
- * @param string $str Input string
- * @param string $fatal Whether to terminate script exection
- * or to return FALSE if an invalid
- * key is encountered
- * @return string|bool
- */
- protected function _clean_input_keys($str, $fatal = TRUE)
- {
- if ( ! preg_match('/^[a-z0-9:_\/|-]+$/i', $str))
- {
- if ($fatal === TRUE)
- {
- return FALSE;
- }
- else
- {
- set_status_header(503);
- echo 'Disallowed Key Characters.';
- exit(7); // EXIT_USER_INPUT
- }
- }
- // Clean UTF-8 if supported
- if (UTF8_ENABLED === TRUE)
- {
- return $this->uni->clean_string($str);
- }
- return $str;
- }
- // --------------------------------------------------------------------
- /**
- * Request Headers
- *
- * @param bool $xss_clean Whether to apply XSS filtering
- * @return array
- */
- public function request_headers($xss_clean = FALSE)
- {
- // If header is already defined, return it immediately
- if ( ! empty($this->headers))
- {
- return $this->headers;
- }
- // In Apache, you can simply call apache_request_headers()
- if (function_exists('apache_request_headers'))
- {
- return $this->headers = apache_request_headers();
- }
- $this->headers['Content-Type'] = isset($_SERVER['CONTENT_TYPE']) ? $_SERVER['CONTENT_TYPE'] : @getenv('CONTENT_TYPE');
- foreach ($_SERVER as $key => $val)
- {
- if (sscanf($key, 'HTTP_%s', $header) === 1)
- {
- // take SOME_HEADER and turn it into Some-Header
- $header = str_replace('_', ' ', strtolower($header));
- $header = str_replace(' ', '-', ucwords($header));
- $this->headers[$header] = $this->_fetch_from_array($_SERVER, $key, $xss_clean);
- }
- }
- return $this->headers;
- }
- // --------------------------------------------------------------------
- /**
- * Get Request Header
- *
- * Returns the value of a single member of the headers class member
- *
- * @param string $index Header name
- * @param bool $xss_clean Whether to apply XSS filtering
- * @return string|bool The requested header on success or FALSE on failure
- */
- public function get_request_header($index, $xss_clean = FALSE)
- {
- if (empty($this->headers))
- {
- $this->request_headers();
- }
- if ( ! isset($this->headers[$index]))
- {
- return NULL;
- }
- return ($xss_clean === TRUE)
- ? $this->security->xss_clean($this->headers[$index])
- : $this->headers[$index];
- }
- // --------------------------------------------------------------------
- /**
- * Is AJAX request?
- *
- * Test to see if a request contains the HTTP_X_REQUESTED_WITH header.
- *
- * @return bool
- */
- public function is_ajax_request()
- {
- return ( ! empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest');
- }
- // --------------------------------------------------------------------
- /**
- * Is CLI request?
- *
- * Test to see if a request was made from the command line.
- *
- * @deprecated 3.0.0 Use is_cli() instead
- * @return bool
- */
- public function is_cli_request()
- {
- return is_cli();
- }
- // --------------------------------------------------------------------
- /**
- * Get Request Method
- *
- * Return the request method
- *
- * @param bool $upper Whether to return in upper or lower case
- * (default: FALSE)
- * @return string
- */
- public function method($upper = FALSE)
- {
- return ($upper)
- ? strtoupper($this->server('REQUEST_METHOD'))
- : strtolower($this->server('REQUEST_METHOD'));
- }
- }
- /* End of file Input.php */
- /* Location: ./system/core/Input.php */