blob: 4a0caa5b565911f98ae38d872ad789d67cbce766 [file] [log] [blame]
Andrey Andreev64e98aa2012-01-07 20:29:10 +02001<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');
Derek Allard2067d1a2008-11-13 22:59:24 +00002/**
3 * CodeIgniter
4 *
Phil Sturgeon07c1ac82012-03-09 17:03:37 +00005 * An open source application development framework for PHP 5.2.4 or newer
Derek Allard2067d1a2008-11-13 22:59:24 +00006 *
Derek Jonesf4a4bd82011-10-20 12:18:42 -05007 * NOTICE OF LICENSE
Andrey Andreev64e98aa2012-01-07 20:29:10 +02008 *
Derek Jonesf4a4bd82011-10-20 12:18:42 -05009 * Licensed under the Open Software License version 3.0
Andrey Andreev64e98aa2012-01-07 20:29:10 +020010 *
Derek Jonesf4a4bd82011-10-20 12:18:42 -050011 * This source file is subject to the Open Software License (OSL 3.0) that is
12 * bundled with this package in the files license.txt / license.rst. It is
13 * also available through the world wide web at this URL:
14 * http://opensource.org/licenses/OSL-3.0
15 * If you did not receive a copy of the license and are unable to obtain it
16 * through the world wide web, please send an email to
17 * licensing@ellislab.com so we can send you a copy immediately.
18 *
Derek Allard2067d1a2008-11-13 22:59:24 +000019 * @package CodeIgniter
Derek Jonesf4a4bd82011-10-20 12:18:42 -050020 * @author EllisLab Dev Team
Greg Aker0defe5d2012-01-01 18:46:41 -060021 * @copyright Copyright (c) 2008 - 2012, EllisLab, Inc. (http://ellislab.com/)
Derek Jonesf4a4bd82011-10-20 12:18:42 -050022 * @license http://opensource.org/licenses/OSL-3.0 Open Software License (OSL 3.0)
Derek Allard2067d1a2008-11-13 22:59:24 +000023 * @link http://codeigniter.com
24 * @since Version 1.0
25 * @filesource
26 */
27
Derek Allard2067d1a2008-11-13 22:59:24 +000028/**
29 * Input Class
30 *
31 * Pre-processes global input data for security
32 *
33 * @package CodeIgniter
34 * @subpackage Libraries
35 * @category Input
Derek Jonesf4a4bd82011-10-20 12:18:42 -050036 * @author EllisLab Dev Team
Derek Allard2067d1a2008-11-13 22:59:24 +000037 * @link http://codeigniter.com/user_guide/libraries/input.html
38 */
39class CI_Input {
Derek Allard2067d1a2008-11-13 22:59:24 +000040
David Behler9b5df592011-08-14 21:04:17 +020041 /**
42 * IP address of the current user
43 *
44 * @var string
45 */
Timothy Warren48a7fbb2012-04-23 11:58:16 -040046 public $ip_address = FALSE;
Andrey Andreev92ebfb62012-05-17 12:49:24 +030047
David Behler9b5df592011-08-14 21:04:17 +020048 /**
49 * user agent (web browser) being used by the current user
50 *
51 * @var string
52 */
Timothy Warren48a7fbb2012-04-23 11:58:16 -040053 public $user_agent = FALSE;
Andrey Andreev92ebfb62012-05-17 12:49:24 +030054
David Behler9b5df592011-08-14 21:04:17 +020055 /**
56 * If FALSE, then $_GET will be set to an empty array
57 *
58 * @var bool
59 */
Timothy Warren48a7fbb2012-04-23 11:58:16 -040060 protected $_allow_get_array = TRUE;
Andrey Andreev92ebfb62012-05-17 12:49:24 +030061
David Behler9b5df592011-08-14 21:04:17 +020062 /**
63 * If TRUE, then newlines are standardized
64 *
65 * @var bool
66 */
Timothy Warren48a7fbb2012-04-23 11:58:16 -040067 protected $_standardize_newlines = TRUE;
Andrey Andreev92ebfb62012-05-17 12:49:24 +030068
David Behler9b5df592011-08-14 21:04:17 +020069 /**
70 * Determines whether the XSS filter is always active when GET, POST or COOKIE data is encountered
71 * Set automatically based on config setting
72 *
73 * @var bool
74 */
Timothy Warren48a7fbb2012-04-23 11:58:16 -040075 protected $_enable_xss = FALSE;
Andrey Andreev92ebfb62012-05-17 12:49:24 +030076
David Behler9b5df592011-08-14 21:04:17 +020077 /**
78 * Enables a CSRF cookie token to be set.
79 * Set automatically based on config setting
80 *
81 * @var bool
82 */
Timothy Warren48a7fbb2012-04-23 11:58:16 -040083 protected $_enable_csrf = FALSE;
Andrey Andreev92ebfb62012-05-17 12:49:24 +030084
David Behler9b5df592011-08-14 21:04:17 +020085 /**
86 * List of all HTTP request headers
87 *
88 * @var array
89 */
Timothy Warren48a7fbb2012-04-23 11:58:16 -040090 protected $headers = array();
David Behler9b5df592011-08-14 21:04:17 +020091
Derek Allard2067d1a2008-11-13 22:59:24 +000092 /**
Greg Akera9263282010-11-10 15:26:43 -060093 * Constructor
94 *
95 * Sets whether to globally enable the XSS processing
96 * and whether to allow the $_GET array
Andrey Andreev92ebfb62012-05-17 12:49:24 +030097 *
98 * @return void
Greg Akera9263282010-11-10 15:26:43 -060099 */
100 public function __construct()
Derek Allard2067d1a2008-11-13 22:59:24 +0000101 {
Andrey Andreev13774972012-01-08 04:30:33 +0200102 log_message('debug', 'Input Class Initialized');
Derek Allard2067d1a2008-11-13 22:59:24 +0000103
Phil Sturgeonc8089152010-12-27 19:06:28 +0000104 $this->_allow_get_array = (config_item('allow_get_array') === TRUE);
Andrey Andreev64e98aa2012-01-07 20:29:10 +0200105 $this->_enable_xss = (config_item('global_xss_filtering') === TRUE);
106 $this->_enable_csrf = (config_item('csrf_protection') === TRUE);
Derek Jones69fc4fc2010-03-02 13:36:31 -0600107
Pascal Kriete14a0ac62011-04-05 14:55:56 -0400108 global $SEC;
109 $this->security =& $SEC;
Derek Jones69fc4fc2010-03-02 13:36:31 -0600110
Pascal Krieteaaec1e42011-01-20 00:01:21 -0500111 // Do we need the UTF-8 class?
Derek Jones69fc4fc2010-03-02 13:36:31 -0600112 if (UTF8_ENABLED === TRUE)
113 {
114 global $UNI;
115 $this->uni =& $UNI;
116 }
117
118 // Sanitize global arrays
Derek Allard2067d1a2008-11-13 22:59:24 +0000119 $this->_sanitize_globals();
120 }
121
122 // --------------------------------------------------------------------
123
124 /**
Greg Akera9263282010-11-10 15:26:43 -0600125 * Fetch from array
126 *
127 * This is a helper function to retrieve values from global arrays
128 *
Greg Akera9263282010-11-10 15:26:43 -0600129 * @param array
130 * @param string
131 * @param bool
132 * @return string
133 */
Bo-Yi Wu47213792011-09-13 22:44:07 +0800134 protected function _fetch_from_array(&$array, $index = '', $xss_clean = FALSE)
Derek Allard2067d1a2008-11-13 22:59:24 +0000135 {
136 if ( ! isset($array[$index]))
137 {
Phil Sturgeon55a6ddb2012-05-23 18:37:24 +0100138 return NULL;
Derek Allard2067d1a2008-11-13 22:59:24 +0000139 }
140
141 if ($xss_clean === TRUE)
142 {
Pascal Kriete14a0ac62011-04-05 14:55:56 -0400143 return $this->security->xss_clean($array[$index]);
Derek Allard2067d1a2008-11-13 22:59:24 +0000144 }
145
146 return $array[$index];
147 }
148
149 // --------------------------------------------------------------------
150
151 /**
Timothy Warren40403d22012-04-19 16:38:50 -0400152 * Fetch an item from the GET array
153 *
154 * @param string
155 * @param bool
156 * @return string
157 */
Bo-Yi Wu4db872f2011-09-12 10:52:37 +0800158 public function get($index = NULL, $xss_clean = FALSE)
Derek Allard2067d1a2008-11-13 22:59:24 +0000159 {
Phil Sturgeon44f21052011-02-15 21:39:25 +0000160 // Check if a field has been provided
Andrey Andreev9448afb2012-02-08 19:49:19 +0200161 if ($index === NULL && ! empty($_GET))
vascopjff1cfa12011-02-13 21:30:19 +0000162 {
Phil Sturgeon44f21052011-02-15 21:39:25 +0000163 $get = array();
vascopjff1cfa12011-02-13 21:30:19 +0000164
165 // loop through the full _GET array
Phil Sturgeon44f21052011-02-15 21:39:25 +0000166 foreach (array_keys($_GET) as $key)
vascopjff1cfa12011-02-13 21:30:19 +0000167 {
Phil Sturgeon44f21052011-02-15 21:39:25 +0000168 $get[$key] = $this->_fetch_from_array($_GET, $key, $xss_clean);
vascopjff1cfa12011-02-13 21:30:19 +0000169 }
Phil Sturgeon44f21052011-02-15 21:39:25 +0000170 return $get;
vascopjff1cfa12011-02-13 21:30:19 +0000171 }
172
Derek Allard2067d1a2008-11-13 22:59:24 +0000173 return $this->_fetch_from_array($_GET, $index, $xss_clean);
174 }
175
176 // --------------------------------------------------------------------
177
178 /**
Timothy Warren40403d22012-04-19 16:38:50 -0400179 * Fetch an item from the POST array
180 *
181 * @param string
182 * @param bool
183 * @return string
184 */
Bo-Yi Wu4db872f2011-09-12 10:52:37 +0800185 public function post($index = NULL, $xss_clean = FALSE)
Derek Allard2067d1a2008-11-13 22:59:24 +0000186 {
Phil Sturgeon44f21052011-02-15 21:39:25 +0000187 // Check if a field has been provided
Andrey Andreev9448afb2012-02-08 19:49:19 +0200188 if ($index === NULL && ! empty($_POST))
vascopj0ba58b82011-02-06 14:20:21 +0000189 {
Phil Sturgeon44f21052011-02-15 21:39:25 +0000190 $post = array();
vascopj0ba58b82011-02-06 14:20:21 +0000191
Phil Sturgeon44f21052011-02-15 21:39:25 +0000192 // Loop through the full _POST array and return it
193 foreach (array_keys($_POST) as $key)
vascopj0ba58b82011-02-06 14:20:21 +0000194 {
Phil Sturgeon44f21052011-02-15 21:39:25 +0000195 $post[$key] = $this->_fetch_from_array($_POST, $key, $xss_clean);
vascopj0ba58b82011-02-06 14:20:21 +0000196 }
Phil Sturgeon44f21052011-02-15 21:39:25 +0000197 return $post;
vascopj0ba58b82011-02-06 14:20:21 +0000198 }
David Behler9b5df592011-08-14 21:04:17 +0200199
Derek Allard2067d1a2008-11-13 22:59:24 +0000200 return $this->_fetch_from_array($_POST, $index, $xss_clean);
201 }
202
Derek Jones69fc4fc2010-03-02 13:36:31 -0600203
Derek Allard2067d1a2008-11-13 22:59:24 +0000204 // --------------------------------------------------------------------
205
206 /**
Timothy Warren40403d22012-04-19 16:38:50 -0400207 * Fetch an item from either the GET array or the POST
208 *
209 * @param string The index key
210 * @param bool XSS cleaning
211 * @return string
212 */
Bo-Yi Wu4db872f2011-09-12 10:52:37 +0800213 public function get_post($index = '', $xss_clean = FALSE)
Derek Allard2067d1a2008-11-13 22:59:24 +0000214 {
Andrey Andreev9448afb2012-02-08 19:49:19 +0200215 return isset($_POST[$index])
216 ? $this->post($index, $xss_clean)
217 : $this->get($index, $xss_clean);
Derek Allard2067d1a2008-11-13 22:59:24 +0000218 }
219
220 // --------------------------------------------------------------------
221
222 /**
Timothy Warren40403d22012-04-19 16:38:50 -0400223 * Fetch an item from the COOKIE array
224 *
225 * @param string
226 * @param bool
227 * @return string
228 */
Bo-Yi Wu4db872f2011-09-12 10:52:37 +0800229 public function cookie($index = '', $xss_clean = FALSE)
Derek Allard2067d1a2008-11-13 22:59:24 +0000230 {
231 return $this->_fetch_from_array($_COOKIE, $index, $xss_clean);
232 }
233
Derek Jones69fc4fc2010-03-02 13:36:31 -0600234 // ------------------------------------------------------------------------
235
236 /**
Timothy Warren40403d22012-04-19 16:38:50 -0400237 * Set cookie
238 *
239 * Accepts seven parameters, or you can submit an associative
240 * array in the first parameter containing all the values.
241 *
242 * @param mixed
243 * @param string the value of the cookie
244 * @param string the number of seconds until expiration
245 * @param string the cookie domain. Usually: .yourdomain.com
246 * @param string the cookie path
247 * @param string the cookie prefix
248 * @param bool true makes the cookie secure
249 * @param bool true makes the cookie accessible via http(s) only (no javascript)
250 * @return void
251 */
freewil4ad0fd82012-03-13 22:37:42 -0400252 public function set_cookie($name = '', $value = '', $expire = '', $domain = '', $path = '/', $prefix = '', $secure = FALSE, $httponly = FALSE)
Derek Jones69fc4fc2010-03-02 13:36:31 -0600253 {
254 if (is_array($name))
255 {
tobiasbg9aa7dc92011-02-18 21:57:13 +0100256 // always leave 'name' in last place, as the loop will break otherwise, due to $$item
freewil4ad0fd82012-03-13 22:37:42 -0400257 foreach (array('value', 'expire', 'domain', 'path', 'prefix', 'secure', 'httponly', 'name') as $item)
Derek Jones69fc4fc2010-03-02 13:36:31 -0600258 {
259 if (isset($name[$item]))
260 {
261 $$item = $name[$item];
262 }
263 }
264 }
265
Alex Bilbieed944a32012-06-02 11:07:47 +0100266 if ($prefix === '' && config_item('cookie_prefix') !== '')
Derek Jones69fc4fc2010-03-02 13:36:31 -0600267 {
268 $prefix = config_item('cookie_prefix');
269 }
Andrey Andreev9ba661b2012-06-04 14:44:34 +0300270
271 if ($domain == '' && config_item('cookie_domain') != '')
Derek Jones69fc4fc2010-03-02 13:36:31 -0600272 {
273 $domain = config_item('cookie_domain');
274 }
Andrey Andreev9ba661b2012-06-04 14:44:34 +0300275
Alex Bilbieed944a32012-06-02 11:07:47 +0100276 if ($path === '/' && config_item('cookie_path') !== '/')
Derek Jones69fc4fc2010-03-02 13:36:31 -0600277 {
278 $path = config_item('cookie_path');
279 }
Andrey Andreev9ba661b2012-06-04 14:44:34 +0300280
Alex Bilbieed944a32012-06-02 11:07:47 +0100281 if ($secure === FALSE && config_item('cookie_secure') !== FALSE)
tobiasbg9aa7dc92011-02-18 21:57:13 +0100282 {
283 $secure = config_item('cookie_secure');
284 }
Andrey Andreev9ba661b2012-06-04 14:44:34 +0300285
Alex Bilbieed944a32012-06-02 11:07:47 +0100286 if ($httponly === FALSE && config_item('cookie_httponly') !== FALSE)
freewil4ad0fd82012-03-13 22:37:42 -0400287 {
288 $httponly = config_item('cookie_httponly');
289 }
Derek Jones69fc4fc2010-03-02 13:36:31 -0600290
291 if ( ! is_numeric($expire))
292 {
293 $expire = time() - 86500;
294 }
295 else
296 {
Phil Sturgeonc8089152010-12-27 19:06:28 +0000297 $expire = ($expire > 0) ? time() + $expire : 0;
Derek Jones69fc4fc2010-03-02 13:36:31 -0600298 }
299
freewil4ad0fd82012-03-13 22:37:42 -0400300 setcookie($prefix.$name, $value, $expire, $path, $domain, $secure, $httponly);
Derek Jones69fc4fc2010-03-02 13:36:31 -0600301 }
302
Derek Allard2067d1a2008-11-13 22:59:24 +0000303 // --------------------------------------------------------------------
304
305 /**
Timothy Warren40403d22012-04-19 16:38:50 -0400306 * Fetch an item from the SERVER array
307 *
308 * @param string
309 * @param bool
310 * @return string
311 */
Bo-Yi Wu4db872f2011-09-12 10:52:37 +0800312 public function server($index = '', $xss_clean = FALSE)
Derek Allard2067d1a2008-11-13 22:59:24 +0000313 {
314 return $this->_fetch_from_array($_SERVER, $index, $xss_clean);
315 }
316
317 // --------------------------------------------------------------------
318
319 /**
Timothy Warren40403d22012-04-19 16:38:50 -0400320 * Fetch the IP Address
321 *
322 * @return string
323 */
Bo-Yi Wu4db872f2011-09-12 10:52:37 +0800324 public function ip_address()
Derek Allard2067d1a2008-11-13 22:59:24 +0000325 {
326 if ($this->ip_address !== FALSE)
327 {
328 return $this->ip_address;
329 }
Barry Mienydd671972010-10-04 16:33:58 +0200330
Andrey Andreev9ac557f2012-10-06 20:27:57 +0300331 $proxy_ips = config_item('proxy_ips');
332 if (empty($proxy_ips))
Derek Jonesc5972282009-02-04 21:40:20 +0000333 {
Andrey Andreev9ac557f2012-10-06 20:27:57 +0300334 $proxy_ips = FALSE;
335 }
336 elseif ( ! is_array($proxy_ips))
337 {
338 $proxy_ips = explode(',', str_replace(' ', '', $proxy_ips));
339 }
Andrey Andreev5b92ae12012-10-04 13:05:03 +0300340
Andrey Andreev9ac557f2012-10-06 20:27:57 +0300341 $this->ip_address = $this->server('REMOTE_ADDR');
342
343 if ($proxy_ips)
344 {
345 foreach (array('HTTP_X_FORWARDED_FOR', 'HTTP_CLIENT_IP', 'HTTP_X_CLIENT_IP', 'HTTP_X_CLUSTER_CLIENT_IP') as $header)
Jordan Pittman8960acf2012-07-23 09:05:49 -0300346 {
Andrey Andreev9ac557f2012-10-06 20:27:57 +0300347 if (($spoof = $this->server($header)) !== NULL)
Jordan Pittman8960acf2012-07-23 09:05:49 -0300348 {
Andrey Andreev9ac557f2012-10-06 20:27:57 +0300349 // Some proxies typically list the whole chain of IP
350 // addresses through which the client has reached us.
351 // e.g. client_ip, proxy_ip1, proxy_ip2, etc.
352 if (strpos($spoof, ',') !== FALSE)
Jordan Pittman8960acf2012-07-23 09:05:49 -0300353 {
Andrey Andreev9ac557f2012-10-06 20:27:57 +0300354 $spoof = explode(',', $spoof, 2);
355 $spoof = $spoof[0];
356 }
357
358 if ( ! $this->valid_ip($spoof))
359 {
360 $spoof = NULL;
361 }
362 else
363 {
Jordan Pittmana5a71352012-07-20 19:36:43 -0300364 break;
365 }
366 }
Andrey Andreev5b92ae12012-10-04 13:05:03 +0300367 }
Andrey Andreev9ac557f2012-10-06 20:27:57 +0300368
369 if ($spoof !== NULL)
Andrey Andreev5b92ae12012-10-04 13:05:03 +0300370 {
Andrey Andreev9ac557f2012-10-06 20:27:57 +0300371 for ($i = 0, $c = count($proxy_ips), $separator = (strlen($ip) === 32 ? '.' : ':'); $i < $c; $i++)
372 {
373 // Check if we have an IP address or a subnet
374 if (strpos($proxy_ips[$i], '/') === FALSE)
375 {
376 // An IP address (and not a subnet) is specified.
377 // We can compare right away.
378 if ($proxy_ips[$i] === $this->ip_address)
379 {
380 $this->ip_address = $spoof;
381 break;
382 }
Derek Allard2067d1a2008-11-13 22:59:24 +0000383
Andrey Andreev9ac557f2012-10-06 20:27:57 +0300384 continue;
385 }
386
387 // We have a subnet ... now the heavy lifting begins
388 isset($separator) OR $separator = $this->valid_ip($this->ip_address, 'ipv6') ? ':' : '.';
389
390 // If the proxy entry doesn't match the IP protocol - skip it
391 if (strpos($proxy_ips[$i], $separator) === FALSE)
392 {
393 continue;
394 }
395
396 // Convert the REMOTE_ADDR IP address to binary, if needed
397 if ( ! isset($ip, $convert_func))
398 {
399 if ($separator === ':')
400 {
401 // Make sure we're have the "full" IPv6 format
402 $ip = str_replace('::', str_repeat(':', 9 - substr_count($this->ip_address, ':')), $this->ip_address);
403 $convert_func = is_php('5.3')
404 ? function ($value)
405 {
406 return str_pad(base_convert($value, 16, 2), 16, '0', STR_PAD_LEFT);
407 }
408 : create_function('$value', 'return str_pad(base_convert($value, 16, 2), 16, "0", STR_PAD_LEFT);');
409 }
410 else
411 {
412 $ip = $this->ip_address;
413 $convert_func = is_php('5.3')
414 ? function ($value)
415 {
416 return str_pad(decbin($value), 8, '0', STR_PAD_LEFT);
417 }
418 : create_function('$value', 'return str_pad(decbin($value), 8, "0", STR_PAD_LEFT);');
419 }
420
421 $ip = implode(array_map($convert_func, explode($separator, $ip)));
422 }
423
424 // Split the netmask length off the network address
425 list($netaddr, $masklen) = explode('/', $proxy_ips[$i], 2);
426
427 // Again, an IPv6 address is most likely in a compressed form
428 if ($separator === ':')
429 {
430 $netaddr = str_replace('::', str_repeat(':', 9 - substr_count($netaddr, ':')), $netaddr);
431 }
432
433 // Convert to a binary form and finally compare
434 $netaddr = implode(array_map($convert_func, explode($separator, $netaddr)));
435 if (strncmp($ip, $netaddr, $masklen) === 0)
436 {
437 $this->ip_address = $spoof;
438 break;
439 }
440 }
441 }
Derek Allard2067d1a2008-11-13 22:59:24 +0000442 }
443
Robin Sowell76b369e2010-03-19 11:15:28 -0400444 if (strpos($this->ip_address, ',') !== FALSE)
Derek Allard2067d1a2008-11-13 22:59:24 +0000445 {
446 $x = explode(',', $this->ip_address);
Adam McCann14c93312012-09-20 01:16:43 +0100447 $this->ip_address = trim($x[0]);
Derek Allard2067d1a2008-11-13 22:59:24 +0000448 }
449
450 if ( ! $this->valid_ip($this->ip_address))
451 {
Andrey Andreev64e98aa2012-01-07 20:29:10 +0200452 return $this->ip_address = '0.0.0.0';
Derek Allard2067d1a2008-11-13 22:59:24 +0000453 }
454
455 return $this->ip_address;
456 }
457
458 // --------------------------------------------------------------------
459
460 /**
Timothy Warren40403d22012-04-19 16:38:50 -0400461 * Validate IP Address
462 *
Timothy Warren40403d22012-04-19 16:38:50 -0400463 * @param string
Andrey Andreev5a257182012-06-10 06:18:14 +0300464 * @param string 'ipv4' or 'ipv6'
Timothy Warren40403d22012-04-19 16:38:50 -0400465 * @return bool
466 */
Andrey Andreev5a257182012-06-10 06:18:14 +0300467 public function valid_ip($ip, $which = '')
Derek Allard2067d1a2008-11-13 22:59:24 +0000468 {
Andrey Andreev5a257182012-06-10 06:18:14 +0300469 switch (strtolower($which))
470 {
471 case 'ipv4':
472 $which = FILTER_FLAG_IPV4;
473 break;
474 case 'ipv6':
475 $which = FILTER_FLAG_IPV6;
476 break;
477 default:
478 $which = NULL;
479 break;
480 }
481
482 return (bool) filter_var($ip, FILTER_VALIDATE_IP, $which);
Derek Allard2067d1a2008-11-13 22:59:24 +0000483 }
484
485 // --------------------------------------------------------------------
486
487 /**
Timothy Warren40403d22012-04-19 16:38:50 -0400488 * User Agent
489 *
490 * @return string
491 */
Bo-Yi Wu4db872f2011-09-12 10:52:37 +0800492 public function user_agent()
Derek Allard2067d1a2008-11-13 22:59:24 +0000493 {
494 if ($this->user_agent !== FALSE)
495 {
496 return $this->user_agent;
497 }
498
Andrey Andreev9448afb2012-02-08 19:49:19 +0200499 return $this->user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : FALSE;
Derek Allard2067d1a2008-11-13 22:59:24 +0000500 }
501
502 // --------------------------------------------------------------------
503
504 /**
Timothy Warren40403d22012-04-19 16:38:50 -0400505 * Sanitize Globals
506 *
507 * This function does the following:
508 *
509 * - Unsets $_GET data (if query strings are not enabled)
510 * - Unsets all globals if register_globals is enabled
511 * - Standardizes newline characters to \n
512 *
513 * @return void
514 */
Andrey Andreev90cfe142012-01-08 04:46:42 +0200515 protected function _sanitize_globals()
Derek Allard2067d1a2008-11-13 22:59:24 +0000516 {
Derek Jones69fc4fc2010-03-02 13:36:31 -0600517 // It would be "wrong" to unset any of these GLOBALS.
Timothy Warren40403d22012-04-19 16:38:50 -0400518 $protected = array(
519 '_SERVER',
520 '_GET',
521 '_POST',
522 '_FILES',
523 '_REQUEST',
524 '_SESSION',
525 '_ENV',
526 'GLOBALS',
527 'HTTP_RAW_POST_DATA',
528 'system_folder',
529 'application_folder',
530 'BM',
531 'EXT',
532 'CFG',
533 'URI',
534 'RTR',
Timothy Warren67cb3ee2012-04-19 16:41:52 -0400535 'OUT',
Timothy Warren40403d22012-04-19 16:38:50 -0400536 'IN'
537 );
Derek Allard2067d1a2008-11-13 22:59:24 +0000538
Barry Mienydd671972010-10-04 16:33:58 +0200539 // Unset globals for securiy.
Derek Jones69fc4fc2010-03-02 13:36:31 -0600540 // This is effectively the same as register_globals = off
541 foreach (array($_GET, $_POST, $_COOKIE) as $global)
Derek Allard2067d1a2008-11-13 22:59:24 +0000542 {
Andrey Andreev92ebfb62012-05-17 12:49:24 +0300543 if (is_array($global))
Derek Jones69fc4fc2010-03-02 13:36:31 -0600544 {
545 foreach ($global as $key => $val)
546 {
547 if ( ! in_array($key, $protected))
548 {
549 global $$key;
550 $$key = NULL;
551 }
552 }
553 }
Andrey Andreev92ebfb62012-05-17 12:49:24 +0300554 elseif ( ! in_array($global, $protected))
555 {
556 global $$global;
557 $$global = NULL;
558 }
Derek Allard2067d1a2008-11-13 22:59:24 +0000559 }
560
Derek Jones69fc4fc2010-03-02 13:36:31 -0600561 // Is $_GET data allowed? If not we'll set the $_GET to an empty array
Alex Bilbieed944a32012-06-02 11:07:47 +0100562 if ($this->_allow_get_array === FALSE)
Derek Allard2067d1a2008-11-13 22:59:24 +0000563 {
Derek Jones69fc4fc2010-03-02 13:36:31 -0600564 $_GET = array();
Derek Allard2067d1a2008-11-13 22:59:24 +0000565 }
Andrey Andreev9448afb2012-02-08 19:49:19 +0200566 elseif (is_array($_GET) && count($_GET) > 0)
Derek Allard2067d1a2008-11-13 22:59:24 +0000567 {
Andrey Andreev9448afb2012-02-08 19:49:19 +0200568 foreach ($_GET as $key => $val)
Derek Allard2067d1a2008-11-13 22:59:24 +0000569 {
Andrey Andreev9448afb2012-02-08 19:49:19 +0200570 $_GET[$this->_clean_input_keys($key)] = $this->_clean_input_data($val);
Derek Allard2067d1a2008-11-13 22:59:24 +0000571 }
572 }
573
Derek Jones69fc4fc2010-03-02 13:36:31 -0600574 // Clean $_POST Data
Andrey Andreev9448afb2012-02-08 19:49:19 +0200575 if (is_array($_POST) && count($_POST) > 0)
Derek Allard2067d1a2008-11-13 22:59:24 +0000576 {
Pascal Kriete5d5895f2011-02-14 13:27:07 -0500577 foreach ($_POST as $key => $val)
Derek Jones69fc4fc2010-03-02 13:36:31 -0600578 {
579 $_POST[$this->_clean_input_keys($key)] = $this->_clean_input_data($val);
580 }
Derek Allard2067d1a2008-11-13 22:59:24 +0000581 }
582
Derek Jones69fc4fc2010-03-02 13:36:31 -0600583 // Clean $_COOKIE Data
Andrey Andreev9448afb2012-02-08 19:49:19 +0200584 if (is_array($_COOKIE) && count($_COOKIE) > 0)
Derek Allard2067d1a2008-11-13 22:59:24 +0000585 {
Derek Jones69fc4fc2010-03-02 13:36:31 -0600586 // Also get rid of specially treated cookies that might be set by a server
587 // or silly application, that are of no use to a CI application anyway
588 // but that when present will trip our 'Disallowed Key Characters' alarm
589 // http://www.ietf.org/rfc/rfc2109.txt
590 // note that the key names below are single quoted strings, and are not PHP variables
591 unset($_COOKIE['$Version']);
592 unset($_COOKIE['$Path']);
593 unset($_COOKIE['$Domain']);
594
Pascal Kriete5d5895f2011-02-14 13:27:07 -0500595 foreach ($_COOKIE as $key => $val)
Derek Jones69fc4fc2010-03-02 13:36:31 -0600596 {
597 $_COOKIE[$this->_clean_input_keys($key)] = $this->_clean_input_data($val);
598 }
Derek Allard2067d1a2008-11-13 22:59:24 +0000599 }
600
Derek Jones69fc4fc2010-03-02 13:36:31 -0600601 // Sanitize PHP_SELF
602 $_SERVER['PHP_SELF'] = strip_tags($_SERVER['PHP_SELF']);
603
Derek Jones69fc4fc2010-03-02 13:36:31 -0600604 // CSRF Protection check
Alex Bilbieed944a32012-06-02 11:07:47 +0100605 if ($this->_enable_csrf === TRUE)
Derek Allard2067d1a2008-11-13 22:59:24 +0000606 {
Derek Jones69fc4fc2010-03-02 13:36:31 -0600607 $this->security->csrf_verify();
Derek Allard2067d1a2008-11-13 22:59:24 +0000608 }
Derek Allard2067d1a2008-11-13 22:59:24 +0000609
Andrey Andreev90cfe142012-01-08 04:46:42 +0200610 log_message('debug', 'Global POST and COOKIE data sanitized');
Derek Allard2067d1a2008-11-13 22:59:24 +0000611 }
612
613 // --------------------------------------------------------------------
614
615 /**
Timothy Warren40403d22012-04-19 16:38:50 -0400616 * Clean Input Data
617 *
618 * This is a helper function. It escapes data and
619 * standardizes newline characters to \n
620 *
621 * @param string
622 * @return string
623 */
Andrey Andreev90cfe142012-01-08 04:46:42 +0200624 protected function _clean_input_data($str)
Derek Allard2067d1a2008-11-13 22:59:24 +0000625 {
Derek Jones69fc4fc2010-03-02 13:36:31 -0600626 if (is_array($str))
Derek Allard2067d1a2008-11-13 22:59:24 +0000627 {
Derek Jones69fc4fc2010-03-02 13:36:31 -0600628 $new_array = array();
629 foreach ($str as $key => $val)
630 {
631 $new_array[$this->_clean_input_keys($key)] = $this->_clean_input_data($val);
632 }
633 return $new_array;
Derek Allard2067d1a2008-11-13 22:59:24 +0000634 }
635
Andrey Andreevaf728622011-10-20 10:11:59 +0300636 /* We strip slashes if magic quotes is on to keep things consistent
637
638 NOTE: In PHP 5.4 get_magic_quotes_gpc() will always return 0 and
639 it will probably not exist in future versions at all.
640 */
641 if ( ! is_php('5.4') && get_magic_quotes_gpc())
Derek Allard2067d1a2008-11-13 22:59:24 +0000642 {
Derek Jones69fc4fc2010-03-02 13:36:31 -0600643 $str = stripslashes($str);
644 }
645
646 // Clean UTF-8 if supported
647 if (UTF8_ENABLED === TRUE)
648 {
649 $str = $this->uni->clean_string($str);
650 }
David Behler9b5df592011-08-14 21:04:17 +0200651
Pascal Kriete14a0ac62011-04-05 14:55:56 -0400652 // Remove control characters
653 $str = remove_invisible_characters($str);
Derek Jones69fc4fc2010-03-02 13:36:31 -0600654
655 // Should we filter the input data?
656 if ($this->_enable_xss === TRUE)
657 {
658 $str = $this->security->xss_clean($str);
659 }
660
661 // Standardize newlines if needed
Alex Bilbieed944a32012-06-02 11:07:47 +0100662 if ($this->_standardize_newlines === TRUE && strpos($str, "\r") !== FALSE)
Derek Jones69fc4fc2010-03-02 13:36:31 -0600663 {
Andrey Andreev64e98aa2012-01-07 20:29:10 +0200664 return str_replace(array("\r\n", "\r", "\r\n\n"), PHP_EOL, $str);
Derek Allard2067d1a2008-11-13 22:59:24 +0000665 }
666
667 return $str;
668 }
669
670 // --------------------------------------------------------------------
671
672 /**
Timothy Warren40403d22012-04-19 16:38:50 -0400673 * Clean Keys
674 *
675 * This is a helper function. To prevent malicious users
676 * from trying to exploit keys we make sure that keys are
677 * only named with alpha-numeric text and a few other items.
678 *
679 * @param string
680 * @return string
681 */
Andrey Andreev90cfe142012-01-08 04:46:42 +0200682 protected function _clean_input_keys($str)
Derek Allard2067d1a2008-11-13 22:59:24 +0000683 {
Andrey Andreev64e98aa2012-01-07 20:29:10 +0200684 if ( ! preg_match('/^[a-z0-9:_\/-]+$/i', $str))
Derek Allard2067d1a2008-11-13 22:59:24 +0000685 {
Kevin Cuppd63e4012012-02-05 14:14:32 -0500686 set_status_header(503);
Derek Jones69fc4fc2010-03-02 13:36:31 -0600687 exit('Disallowed Key Characters.');
Derek Allard2067d1a2008-11-13 22:59:24 +0000688 }
689
Derek Jones69fc4fc2010-03-02 13:36:31 -0600690 // Clean UTF-8 if supported
691 if (UTF8_ENABLED === TRUE)
692 {
Andrey Andreev64e98aa2012-01-07 20:29:10 +0200693 return $this->uni->clean_string($str);
Derek Jones69fc4fc2010-03-02 13:36:31 -0600694 }
Derek Allard2067d1a2008-11-13 22:59:24 +0000695
Derek Jones69fc4fc2010-03-02 13:36:31 -0600696 return $str;
697 }
Derek Allard2067d1a2008-11-13 22:59:24 +0000698
Greg Akerec2f5712010-11-15 16:22:12 -0600699 // --------------------------------------------------------------------
700
701 /**
702 * Request Headers
703 *
David Behler9b5df592011-08-14 21:04:17 +0200704 * In Apache, you can simply call apache_request_headers(), however for
Greg Akerec2f5712010-11-15 16:22:12 -0600705 * people running other webservers the function is undefined.
706 *
Andrey Andreev92ebfb62012-05-17 12:49:24 +0300707 * @param bool XSS cleaning
Andrey Andreev64e98aa2012-01-07 20:29:10 +0200708 * @return array
Greg Akerec2f5712010-11-15 16:22:12 -0600709 */
710 public function request_headers($xss_clean = FALSE)
711 {
712 // Look at Apache go!
713 if (function_exists('apache_request_headers'))
714 {
715 $headers = apache_request_headers();
716 }
717 else
718 {
Andrey Andreev9448afb2012-02-08 19:49:19 +0200719 $headers['Content-Type'] = isset($_SERVER['CONTENT_TYPE']) ? $_SERVER['CONTENT_TYPE'] : @getenv('CONTENT_TYPE');
Greg Akerec2f5712010-11-15 16:22:12 -0600720
721 foreach ($_SERVER as $key => $val)
722 {
Andrey Andreev64e98aa2012-01-07 20:29:10 +0200723 if (strpos($key, 'HTTP_') === 0)
Greg Akerec2f5712010-11-15 16:22:12 -0600724 {
725 $headers[substr($key, 5)] = $this->_fetch_from_array($_SERVER, $key, $xss_clean);
726 }
727 }
728 }
729
730 // take SOME_HEADER and turn it into Some-Header
731 foreach ($headers as $key => $val)
732 {
733 $key = str_replace('_', ' ', strtolower($key));
734 $key = str_replace(' ', '-', ucwords($key));
David Behler9b5df592011-08-14 21:04:17 +0200735
Greg Akerec2f5712010-11-15 16:22:12 -0600736 $this->headers[$key] = $val;
737 }
David Behler9b5df592011-08-14 21:04:17 +0200738
Greg Akerec2f5712010-11-15 16:22:12 -0600739 return $this->headers;
740 }
741
742 // --------------------------------------------------------------------
743
744 /**
745 * Get Request Header
746 *
747 * Returns the value of a single member of the headers class member
748 *
Andrey Andreev773e1172012-02-08 23:02:19 +0200749 * @param string array key for $this->headers
Andrey Andreev9448afb2012-02-08 19:49:19 +0200750 * @param bool XSS Clean or not
Andrey Andreev773e1172012-02-08 23:02:19 +0200751 * @return mixed FALSE on failure, string on success
Greg Akerec2f5712010-11-15 16:22:12 -0600752 */
753 public function get_request_header($index, $xss_clean = FALSE)
754 {
755 if (empty($this->headers))
756 {
757 $this->request_headers();
758 }
David Behler9b5df592011-08-14 21:04:17 +0200759
Greg Akerec2f5712010-11-15 16:22:12 -0600760 if ( ! isset($this->headers[$index]))
761 {
Phil Sturgeon55a6ddb2012-05-23 18:37:24 +0100762 return NULL;
Greg Akerec2f5712010-11-15 16:22:12 -0600763 }
764
Andrey Andreev9448afb2012-02-08 19:49:19 +0200765 return ($xss_clean === TRUE)
766 ? $this->security->xss_clean($this->headers[$index])
767 : $this->headers[$index];
Greg Akerec2f5712010-11-15 16:22:12 -0600768 }
769
Greg Aker081ac9d2010-11-22 14:42:53 -0600770 // --------------------------------------------------------------------
Phil Sturgeonc3828712011-01-19 12:31:47 +0000771
Greg Aker081ac9d2010-11-22 14:42:53 -0600772 /**
773 * Is ajax Request?
774 *
775 * Test to see if a request contains the HTTP_X_REQUESTED_WITH header
776 *
Andrey Andreev9448afb2012-02-08 19:49:19 +0200777 * @return bool
Greg Aker081ac9d2010-11-22 14:42:53 -0600778 */
779 public function is_ajax_request()
780 {
Andrey Andreev9448afb2012-02-08 19:49:19 +0200781 return ( ! empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) === 'xmlhttprequest');
Greg Aker081ac9d2010-11-22 14:42:53 -0600782 }
783
Phil Sturgeonc3828712011-01-19 12:31:47 +0000784 // --------------------------------------------------------------------
785
786 /**
787 * Is cli Request?
788 *
789 * Test to see if a request was made from the command line
790 *
Andrey Andreev9448afb2012-02-08 19:49:19 +0200791 * @return bool
Phil Sturgeonc3828712011-01-19 12:31:47 +0000792 */
793 public function is_cli_request()
794 {
Andrey Andreev9448afb2012-02-08 19:49:19 +0200795 return (php_sapi_name() === 'cli' OR defined('STDIN'));
Phil Sturgeonc3828712011-01-19 12:31:47 +0000796 }
797
Michiel Vugteveenbe0ca262012-03-07 19:09:51 +0100798 // --------------------------------------------------------------------
799
800 /**
801 * Get Request Method
802 *
Michiel Vugteveendc900df2012-03-07 20:41:37 +0100803 * Return the Request Method
Michiel Vugteveenbe0ca262012-03-07 19:09:51 +0100804 *
Michiel Vugteveendc900df2012-03-07 20:41:37 +0100805 * @param bool uppercase or lowercase
Michiel Vugteveen7c8841f2012-03-07 20:49:06 +0100806 * @return bool
Michiel Vugteveenbe0ca262012-03-07 19:09:51 +0100807 */
Michiel Vugteveen704fb162012-03-07 20:42:33 +0100808 public function method($upper = FALSE)
Michiel Vugteveenbe0ca262012-03-07 19:09:51 +0100809 {
Michiel Vugteveendc900df2012-03-07 20:41:37 +0100810 return ($upper)
811 ? strtoupper($this->server('REQUEST_METHOD'))
812 : strtolower($this->server('REQUEST_METHOD'));
Michiel Vugteveenbe0ca262012-03-07 19:09:51 +0100813 }
814
Derek Allard2067d1a2008-11-13 22:59:24 +0000815}
Derek Allard2067d1a2008-11-13 22:59:24 +0000816
817/* End of file Input.php */
Timothy Warren40403d22012-04-19 16:38:50 -0400818/* Location: ./system/core/Input.php */