Introducing compatibility layers
- Limited support for mbstring (mb_strlen(), mb_strpos(), mb_substr() only) via iconv.
Falls back to regular strlen(), strpos(), substr() if iconv is not available.
- Password hashing, dependant on CRYPT_BLOWFISH (2y version, available since PHP 5.3.7) availability.
diff --git a/system/core/CodeIgniter.php b/system/core/CodeIgniter.php
index 70d6ca5..270988a 100644
--- a/system/core/CodeIgniter.php
+++ b/system/core/CodeIgniter.php
@@ -184,6 +184,15 @@
/*
* ------------------------------------------------------
+ * Load compatibility features
+ * ------------------------------------------------------
+ */
+
+ require_once(BASEPATH.'core/compat/mbstring.php';
+ require_once(BASEPATH.'core/compat/password.php';
+
+/*
+ * ------------------------------------------------------
* Instantiate the UTF-8 class
* ------------------------------------------------------
*/
diff --git a/system/core/compat/mbstring.php b/system/core/compat/mbstring.php
new file mode 100644
index 0000000..91ea801
--- /dev/null
+++ b/system/core/compat/mbstring.php
@@ -0,0 +1,141 @@
+<?php
+/**
+ * CodeIgniter
+ *
+ * An open source application development framework for PHP 5.2.4 or newer
+ *
+ * NOTICE OF LICENSE
+ *
+ * Licensed under the Open Software License version 3.0
+ *
+ * This source file is subject to the Open Software License (OSL 3.0) that is
+ * bundled with this package in the files license.txt / license.rst. It is
+ * also available through the world wide web at this URL:
+ * http://opensource.org/licenses/OSL-3.0
+ * If you did not receive a copy of the license and are unable to obtain it
+ * through the world wide web, please send an email to
+ * licensing@ellislab.com so we can send you a copy immediately.
+ *
+ * @package CodeIgniter
+ * @author EllisLab Dev Team
+ * @copyright Copyright (c) 2008 - 2014, EllisLab, Inc. (http://ellislab.com/)
+ * @license http://opensource.org/licenses/OSL-3.0 Open Software License (OSL 3.0)
+ * @link http://codeigniter.com
+ * @since Version 3.0
+ * @filesource
+ */
+defined('BASEPATH') OR exit('No direct script access allowed');
+
+/**
+ * PHP ext/mbstring compatibility package
+ *
+ * @package CodeIgniter
+ * @subpackage CodeIgniter
+ * @category Compatibility
+ * @author Andrey Andreev
+ * @link http://codeigniter.com/user_guide/
+ * @link http://php.net/mbstring
+ */
+
+// ------------------------------------------------------------------------
+
+if (MB_ENABLED === TRUE)
+{
+ return;
+}
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('mb_strlen'))
+{
+ /**
+ * mb_strlen()
+ *
+ * WARNING: This function WILL fall-back to strlen()
+ * if iconv is not available!
+ *
+ * @link http://php.net/mb_strlen
+ * @param string $str
+ * @param string $encoding
+ * @return string
+ */
+ function mb_strlen($str, $encoding = NULL)
+ {
+ if (ICONV_ENABLED === TRUE)
+ {
+ return iconv_strlen($str, isset($charset) ? $charset : config_item('charset'));
+ }
+
+ log_message('debug', 'Compatibility (mbstring): iconv_strlen() is not available, falling back to strlen().');
+ return strlen($str);
+ }
+}
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('mb_strpos'))
+{
+ /**
+ * mb_strpos()
+ *
+ * WARNING: This function WILL fall-back to strpos()
+ * if iconv is not available!
+ *
+ * @link http://php.net/mb_strpos()
+ * @param string $haystack
+ * @param string $needle
+ * @param int $offset
+ * @param string $encoding
+ * @return mixed
+ */
+ function mb_strpos($haystack, $needle, $offset = 0, $encoding = NULL)
+ {
+ if (ICONV_ENABLED === TRUE)
+ {
+ return iconv_strpos($haystack, $needle, $offset, isset($encoding) ? $encoding : config_item('charset'));
+ }
+
+ log_message('debug', 'Compatibility (mbstring): iconv_strpos() is not available, falling back to strpos().');
+ return strpos($haystack, $needle, $offset);
+ }
+}
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('mb_substr'))
+{
+ /**
+ * mb_substr()
+ *
+ * WARNING: This function WILL fall-back to substr()
+ * if iconv is not available.
+ *
+ * @link http://php.net/mb_substr
+ * @param string $str
+ * @param int $start
+ * @param int $length
+ * @param string $encoding
+ * @return string
+ */
+ function mb_substr($str, $start, $length = NULL, $encoding = NULL)
+ {
+ if (ICONV_ENABLED === TRUE)
+ {
+ isset($encoding) OR $encoding = config_item('charset');
+ return iconv_substr(
+ $str,
+ $start,
+ isset($length) ? $length : iconv_strlen($str, $encoding), // NULL doesn't work
+ $encoding
+ );
+ }
+
+ log_message('debug', 'Compatibility (mbstring): iconv_substr() is not available, falling back to substr().');
+ return isset($length)
+ ? substr($str, $start, $length)
+ : substr($str, $start);
+ }
+}
+
+/* End of file mbstring.php */
+/* Location: ./system/core/compat/mbstring.php */
\ No newline at end of file
diff --git a/system/core/compat/password.php b/system/core/compat/password.php
new file mode 100644
index 0000000..92fdedb
--- /dev/null
+++ b/system/core/compat/password.php
@@ -0,0 +1,216 @@
+<?php
+/**
+ * CodeIgniter
+ *
+ * An open source application development framework for PHP 5.2.4 or newer
+ *
+ * NOTICE OF LICENSE
+ *
+ * Licensed under the Open Software License version 3.0
+ *
+ * This source file is subject to the Open Software License (OSL 3.0) that is
+ * bundled with this package in the files license.txt / license.rst. It is
+ * also available through the world wide web at this URL:
+ * http://opensource.org/licenses/OSL-3.0
+ * If you did not receive a copy of the license and are unable to obtain it
+ * through the world wide web, please send an email to
+ * licensing@ellislab.com so we can send you a copy immediately.
+ *
+ * @package CodeIgniter
+ * @author EllisLab Dev Team
+ * @copyright Copyright (c) 2008 - 2014, EllisLab, Inc. (http://ellislab.com/)
+ * @license http://opensource.org/licenses/OSL-3.0 Open Software License (OSL 3.0)
+ * @link http://codeigniter.com
+ * @since Version 3.0
+ * @filesource
+ */
+defined('BASEPATH') OR exit('No direct script access allowed');
+
+/**
+ * PHP ext/standard/password compatibility package
+ *
+ * @package CodeIgniter
+ * @subpackage CodeIgniter
+ * @category Compatibility
+ * @author Andrey Andreev
+ * @link http://codeigniter.com/user_guide/
+ * @link http://php.net/password
+ */
+
+// ------------------------------------------------------------------------
+
+if (is_php('5.5') OR ! is_php('5.3.7') OR ! defined('CRYPT_BLOWFISH') OR CRYPT_BLOWFISH !== 1)
+{
+ return;
+}
+
+// ------------------------------------------------------------------------
+
+defined('PASSWORD_BCRYPT') OR define('PASSWORD_BCRYPT', 1);
+defined('PASSWORD_DEFAULT') OR define('PASSWORD_DEFAULT', PASSWORD_BCRYPT);
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('password_get_info'))
+{
+ /**
+ * password_get_info()
+ *
+ * @link http://php.net/password_get_info
+ * @param string $hash
+ * @return array
+ */
+ function password_get_info($hash)
+ {
+ return (strlen($hash) < 60 OR sscanf($hash, '$2y$%d', $hash) !== 1)
+ ? array('algo' => 0, 'algoName' => 'unknown', 'options' => array())
+ : array('algo' => 1, 'algoName' => 'bcrypt', 'options' => array('cost' => $hash));
+ }
+}
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('password_hash'))
+{
+ /**
+ * password_hash()
+ *
+ * @link http://php.net/password_hash
+ * @param string $password
+ * @param int $algo
+ * @param array $options
+ * @return mixed
+ */
+ function password_hash($password, $algo, array $options = array())
+ {
+ if ($algo !== 1)
+ {
+ trigger_error('password_hash(): Unknown hashing algorithm: '.(int) $algo, E_USER_WARNING);
+ return NULL;
+ }
+
+ if (isset($options['cost']) && ($options['cost'] < 4 OR $options['cost'] > 31))
+ {
+ trigger_error('password_hash(): Invalid bcrypt cost parameter specified: '.(int) $options['cost'], E_USER_WARNING);
+ return NULL;
+ }
+
+ if (isset($options['salt']) && strlen($options['salt']) < 22)
+ {
+ trigger_error('password_hash(): Provided salt is too short: '.strlen($options['salt']).' expecting 22', E_USER_WARNING);
+ return NULL;
+ }
+ elseif ( ! isset($options['salt']))
+ {
+ if (defined('MCRYPT_DEV_URANDOM'))
+ {
+ $options['salt'] = mcrypt_create_iv(16, MCRYPT_DEV_URANDOM);
+ }
+ elseif (function_exists('openssl_random_pseudo_bytes'))
+ {
+ $options['salt'] = openssl_random_pseudo_bytes(16);
+ }
+ elseif (DIRECTORY_SEPARATOR === '/' && (is_readable($dev = '/dev/arandom') OR is_readable($dev = '/dev/urandom')))
+ {
+ if (($fp = fopen($dev, 'rb')) === FALSE)
+ {
+ log_message('error', 'compat/password: Unable to open '.$dev.' for reading.');
+ return FALSE;
+ }
+
+ $options['salt'] = '';
+ for ($read = 0; $read < 16; $read = strlen($options['salt']))
+ {
+ if (($read = fread($fp, 16 - $read)) === FALSE)
+ {
+ log_message('error', 'compat/password: Error while reading from '.$dev.'.');
+ return FALSE;
+ }
+ $options['salt'] .= $read;
+ }
+
+ fclose($fp);
+ }
+ else
+ {
+ log_message('error', 'compat/password: No CSPRNG available.');
+ return FALSE;
+ }
+
+ $options['salt'] = str_replace('+', '.', rtrim(base64_encode($options['salt']), '='));
+ }
+ elseif ( ! preg_match('#^[a-zA-Z0-9./]+$#D', $options['salt']))
+ {
+ $options['salt'] = str_replace('+', '.', rtrim(base64_encode($options['salt']), '='));
+ }
+
+ isset($options['cost']) OR $options['cost'] = 10;
+ return crypt($password, sprintf('$2y$%02d$%s', $options['cost'], $options['salt']));
+ }
+}
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('password_needs_rehash'))
+{
+ /**
+ * password_needs_rehash()
+ *
+ * @link http://php.net/password_needs_rehash
+ * @param string $hash
+ * @param int $algo
+ * @param array $options
+ * @return bool
+ */
+ function password_needs_rehash($hash, $algo, array $options = array())
+ {
+ $info = password_get_info($hash);
+
+ if ($algo !== $info['algo'])
+ {
+ return TRUE;
+ }
+ elseif ($algo === 1)
+ {
+ $options['cost'] = isset($options['cost']) ? (int) $options['cost'] : 10;
+ return ($info['options']['cost'] !== $options['cost']);
+ }
+
+ // Odd at first glance, but according to a comment in PHP's own unit tests,
+ // because it is an unknown algorithm - it's valid and therefore doesn't
+ // need rehashing.
+ return FALSE;
+ }
+}
+
+// ------------------------------------------------------------------------
+
+if ( ! function_exists('password_verify'))
+{
+ /**
+ * password_verify()
+ *
+ * @link http://php.net/password_verify
+ * @param string $password
+ * @param string $hash
+ * @return bool
+ */
+ function password_verify($password, $hash)
+ {
+ if (strlen($hash) !== 60 OR strlen($password = crypt($password, $hash)) !== 60)
+ {
+ return FALSE;
+ }
+
+ $compare = 0;
+ for ($i = 0; $i < 60; $i++)
+ {
+ $compare |= (ord($password[$i]) ^ ord($hash[$i]));
+ }
+
+ return ($compare === 0);
+ }
+}
+
+/* End of file password.php */
+/* Location: ./system/core/compat/password.php */
\ No newline at end of file
diff --git a/tests/Bootstrap.php b/tests/Bootstrap.php
index 7f10ea1..439c7fd 100644
--- a/tests/Bootstrap.php
+++ b/tests/Bootstrap.php
@@ -63,6 +63,9 @@
defined('ICONV_ENABLED') OR define('ICONV_ENABLED', FALSE);
}
+include_once SYSTEM_PATH.'core/compat/mbstring.php';
+include_once SYSTEM_PATH.'core/compat/password.php';
+
include_once $dir.'/mocks/autoloader.php';
spl_autoload_register('autoload');
diff --git a/tests/codeigniter/core/compat/mbstring_test.php b/tests/codeigniter/core/compat/mbstring_test.php
new file mode 100644
index 0000000..4152224
--- /dev/null
+++ b/tests/codeigniter/core/compat/mbstring_test.php
@@ -0,0 +1,54 @@
+<?php
+
+class mbstring_test extends CI_TestCase {
+
+ public function test_bootstrap()
+ {
+ if (MB_ENABLED)
+ {
+ return $this->markTestSkipped('ext/mbstring is loaded');
+ }
+
+ $this->assertTrue(function_exists('mb_strlen'));
+ $this->assertTrue(function_exists('mb_substr'));
+ }
+
+ // ------------------------------------------------------------------------
+
+ /**
+ * @depends test_bootstrap
+ */
+ public function test_mb_strlen()
+ {
+ $this->assertEquals(ICONV_ENABLED ? 4 : 8, mb_strlen('тест'));
+ $this->assertEquals(ICONV_ENABLED ? 4 : 8, mb_strlen('тест', 'UTF-8'));
+ }
+
+ // ------------------------------------------------------------------------
+
+ /**
+ * @depends test_boostrap
+ */
+ public function test_mb_strpos()
+ {
+ $this->assertEquals(ICONV_ENABLED ? 3 : 6, mb_strpos('тест', 'с'));
+ $this->assertFalse(mb_strpos('тест', 'с', 3));
+ $this->assertEquals(ICONV_ENABLED ? 3 : 6, mb_strpos('тест', 'с', 1, 'UTF-8'));
+ }
+
+ // ------------------------------------------------------------------------
+
+ /**
+ * @depends test_boostrap
+ */
+ public function test_mb_substr()
+ {
+ $this->assertEquals(ICONV_ENABLED ? 'стинг' : 'естинг', mb_substr('тестинг', 2));
+ $this->assertEquals(ICONV_ENABLED ? 'нг' : 'г', mb_substr('тестинг', -2));
+ $this->assertEquals(ICONV_ENABLED ? 'ст' : 'е', mb_substr('тестинг', 2, 2));
+ $this->assertEquals(ICONV_ENABLED ? 'стинг' : 'естинг', mb_substr('тестинг', 2, 'UTF-8'));
+ $this->assertEquals(ICONV_ENABLED ? 'нг' : 'г', mb_substr('тестинг', -2, 'UTF-8'));
+ $this->assertEquals(ICONV_ENABLED ? 'ст' : 'е', mb_substr('тестинг', 2, 2, 'UTF-8'));
+ }
+
+}
\ No newline at end of file
diff --git a/tests/codeigniter/core/compat/password_test.php b/tests/codeigniter/core/compat/password_test.php
new file mode 100644
index 0000000..4014e74
--- /dev/null
+++ b/tests/codeigniter/core/compat/password_test.php
@@ -0,0 +1,158 @@
+<?php
+
+class password_test extends CI_TestCase {
+
+ public function test_bootstrap()
+ {
+ if (is_php('5.5'))
+ {
+ return $this->markTestSkipped('ext/standard/password is available on PHP 5.5');
+ }
+ elseif ( ! is_php('5.3.7'))
+ {
+ $this->assertFalse(defined('PASSWORD_BCRYPT'));
+ return $this->markTestSkipped("PHP versions prior to 5.3.7 don't have the '2y' Blowfish version");
+ }
+ elseif ( ! defined('CRYPT_BLOWFISH') OR CRYPT_BLOWFISH !== 1)
+ {
+ $this->assertFalse(defined('PASSWORD_BCRYPT'));
+ return $this->markTestSkipped('CRYPT_BLOWFISH is not available');
+ }
+
+ $this->assertTrue(defined('PASSWORD_BCRYPT'));
+ $this->assertTrue(defined('PASSWORD_DEFAULT'));
+ $this->assertEquals(1, PASSWORD_BCRYPT);
+ $this->assertEquals(PASSWORD_BCRYPT, PASSWORD_DEFAULT);
+ $this->assertTrue(function_exists('password_get_info'));
+ $this->assertTrue(function_exists('password_hash'));
+ $this->assertTrue(function_exists('password_needs_rehash'));
+ $this->assertTrue(function_exists('password_verify'));
+ }
+
+ // ------------------------------------------------------------------------
+
+ /**
+ * password_get_info() test
+ *
+ * Borrowed from PHP's own tests
+ *
+ * @depends test_bootstrap
+ */
+ public function test_password_get_info()
+ {
+ $expected = array(
+ 'algo' => 1,
+ 'algoName' => 'bcrypt',
+ 'options' => array('cost' => 10)
+ );
+
+ // default
+ $this->assertEquals($expected, password_get_info('$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y'));
+
+ $expected['options']['cost'] = 11;
+
+ // cost
+ $this->assertEquals($expected, password_get_info('$2y$11$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y'));
+
+ $expected = array(
+ 'algo' => 0,
+ 'algoName' => 'unknown',
+ 'options' => array()
+ );
+
+ // invalid length
+ $this->assertEquals($expected, password_get_info('$2y$11$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100'));
+
+ // non-bcrypt
+ $this->assertEquals($expected, password_get_info('$1$rasmusle$rISCgZzpwk3UhDidwXvin0'));
+ }
+
+ // ------------------------------------------------------------------------
+
+ /**
+ * password_hash() test
+ *
+ * Borrowed from PHP's own tests
+ *
+ * @depends test_bootstrap
+ */
+ public function test_password_hash()
+ {
+ // FALSE is returned if no CSPRNG source is available
+ if ( ! defined('MCRYPT_DEV_URANDOM') && ! function_exists('openssl_random_pseudo_bytes')
+ && (DIRECTORY_SEPARATOR !== '/' OR ! is_readable('/dev/arandom') OR ! is_readable('/dev/urandom'))
+ )
+ {
+ $this->assertFalse(password_hash('foo', PASSWORD_BCRYPT));
+ }
+ else
+ {
+ $this->assertEquals(60, strlen(password_hash('foo', PASSWORD_BCRYPT)));
+ $this->assertTrue(($hash = password_hash('foo', PASSWORD_BCRYPT)) === crypt('foo', $hash));
+ }
+
+ $this->assertEquals(
+ '$2y$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi',
+ password_hash('rasmuslerdorf', PASSWORD_BCRYPT, array('cost' => 7, 'salt' => 'usesomesillystringforsalt'))
+ );
+
+ $this->assertEquals(
+ '$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y',
+ password_hash('test', PASSWORD_BCRYPT, array('salt' => '123456789012345678901'.chr(0)))
+ );
+ }
+
+ // ------------------------------------------------------------------------
+
+ /**
+ * password_needs_rehash() test
+ *
+ * Borrowed from PHP's own tests
+ *
+ * @depends test_password_get_info
+ */
+ public function test_password_needs_rehash()
+ {
+ // invalid hash: always rehash
+ $this->assertTrue(password_needs_rehash('', PASSWORD_BCRYPT));
+
+ // valid, because it's an unknown algorithm
+ $this->assertFalse(password_needs_rehash('', 0));
+
+ // valid with same cost
+ $this->assertFalse(password_needs_rehash('$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y', PASSWORD_BCRYPT, array('cost' => 10)));
+
+ // valid with same cost and additional parameters
+ $this->assertFalse(password_needs_rehash('$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y', PASSWORD_BCRYPT, array('cost' => 10, 'foo' => 3)));
+
+ // invalid: different (lower) cost
+ $this->assertTrue(password_needs_rehash('$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y', PASSWORD_BCRYPT, array('cost' => 09)));
+
+ // invalid: different (higher) cost
+ $this->assertTrue(password_needs_rehash('$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y', PASSWORD_BCRYPT, array('cost' => 11)));
+
+ // valid with default cost
+ $this->assertFalse(password_needs_rehash('$2y$'.str_pad(10, 2, '0', STR_PAD_LEFT).'$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y', PASSWORD_BCRYPT));
+
+ // invalid: 'foo' is cast to 0
+ $this->assertTrue(password_needs_rehash('$2y$10$MTIzNDU2Nzg5MDEyMzQ1Nej0NmcAWSLR.oP7XOR9HD/vjUuOj100y', PASSWORD_BCRYPT, array('cost' => 'foo')));
+ }
+
+ // ------------------------------------------------------------------------
+
+ /**
+ * password_verify() test
+ *
+ * Borrowed from PHP's own tests
+ *
+ * @depends test_bootstrap
+ */
+ public function test_password_verify()
+ {
+ $this->assertFalse(password_verify(123, 123));
+ $this->assertFalse(password_verify('foo', '$2a$07$usesomesillystringforsalt$'));
+ $this->assertFalse(password_verify('rasmusler', '$2a$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi'));
+ $this->assertTrue(password_verify('rasmuslerdorf', '$2a$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi'));
+ }
+
+}
\ No newline at end of file
diff --git a/user_guide_src/source/changelog.rst b/user_guide_src/source/changelog.rst
index b5b31dc..ce84b7f 100644
--- a/user_guide_src/source/changelog.rst
+++ b/user_guide_src/source/changelog.rst
@@ -499,6 +499,7 @@
- ``UTF8_ENABLED`` now requires only one of `Multibyte String <http://php.net/mbstring>`_ or `iconv <http://php.net/iconv>`_ to be available instead of both.
- Changed method ``clean_string()`` to utilize ``mb_convert_encoding()`` if it is available but ``iconv()`` is not.
+ - Added compatibility layers for PHP's `Multibyte string <http://php.net/mbstring>`_ (limited support) and `Password Hashing <http://php.net/password>` extensions.
- Removed ``CI_CORE`` boolean constant from *CodeIgniter.php* (no longer Reactor and Core versions).
- Log Library will now try to create the **log_path** directory if it doesn't exist.
- Added support for HTTP-Only cookies with new config option *cookie_httponly* (default FALSE).