CodeIgniter Forums

form_prep appears to be broken in 1.7.2 html entities are no longer protected. Or was it broken before?

2009-12-07T15:53:14-06:00

In 1.7.1 form_prep() would not try to convert html entities already existing in a string. This was good because when an html string containing html entities was stored in a DB and then retrived for editing in a form they would be protected from conversion and look correct in a form field, E.g. Bob's Name in the database is loaded into a form text field without conversion and is displayed in the form field as Bob’s Name.

In 1.7.2 form_prep() existing html entities are not protected and are parsed corrupting the data so that Bob's Name in the database becomes Bob&#39;s Name and when loaded into a text field is displayed as Bob's Name.

Unfortunately I am using form helper functions (which all use form_prep() as standard) like form_input() throughout my application .

For quick reference:
1.7.1 code looks like:

function form_prep($str = '')
    {
        // if the field name is an array we do this recursively
        if (is_array($str))
        {
            foreach ($str as $key => $val)
            {
                $str[$key] = form_prep($val);
            }

            return $str;
        }

        if ($str === '')
        {
            return '';
        }

        $temp = '__TEMP_AMPERSANDS__';

        // Replace entities to temporary markers so that 
        // htmlspecialchars won't mess them up
        $str = preg_replace("/&#(d+);/", "$temp\1;", $str);
        $str = preg_replace("/&(w+);/",  "$temp\1;", $str);

        $str = htmlspecialchars($str);

        // In case htmlspecialchars misses these.
        $str = str_replace(array("'", '"'), array("&#39;", "&quot;"), $str);

        // Decode the temp markers back to entities
        $str = preg_replace("/$temp(d+);/","&#\1;",$str);
        $str = preg_replace("/$temp(w+);/","&\1;",$str);

        return $str;
    } 

1.7.2 code looks like:

function form_prep($str = '', $field_name = '')
    {
        static $prepped_fields = array();
        
        // if the field name is an array we do this recursively
        if (is_array($str))
        {
            foreach ($str as $key => $val)
            {
                $str[$key] = form_prep($val);
            }

            return $str;
        }

        if ($str === '')
        {
            return '';
        }

        // we've already prepped a field with this name
        // @todo need to figure out a way to namespace this so
        // that we know the *exact* field and not just one with
        // the same name
        if (isset($prepped_fields[$field_name]))
        {
            return $str;
        }
        
        $str = htmlspecialchars($str);

        // In case htmlspecialchars misses these.
        $str = str_replace(array("'", '"'), array("&#39;", "&quot;"), $str);

        if ($field_name != '')
        {
            $prepped_fields[$field_name] = $str;
        }
        
        return $str;
    } 

Bug reporting and discussion. Where?

2010-03-20T04:26:52-06:00

Where should we report and discuss new bugs from now on, http://codeigniter.com/bug_tracker/ or http://bitbucket.org/ellislab/codeigniter/issues/?

The custom ExpressionEngine system seems to be the current official one according to http://codeigniter.com/bug_tracker/. But some people are starting to use the Bitbucket Issue tracker. And there is the Bug Reports forum too http://codeigniter.com/forums/viewforum/51/.

Is it really necessary to have three separated resources for bug tracking and discussions? I don’t think splitting resources and discussions helps anybody.

Setting the server path

2010-03-18T14:26:33-06:00

Hi Guys,

This isn’t really a bug but thought I might mention it.

In index.php when setting the $system_folder variable I noticed a slight problem. The realpath would not be determined if a relative address was given for the system folder. When entering ‘../system’ (a relative address) into the $system_folder variable caused the system to assume it was an absolute address.

Here is the code in question from index.php

/*
|---------------------------------------------------------------
| SET THE SERVER PATH
|---------------------------------------------------------------
|
| Let's attempt to determine the full-server path to the "system"
| folder in order to reduce the possibility of path problems.
| Note: We only attempt this if the user hasn't specified a 
| full server path.
|
*/
if (strpos($system_folder, '/') === FALSE)
{
    if (function_exists('realpath') AND @realpath(dirname(__FILE__)) !== FALSE)
    {
        $system_folder = realpath(dirname(__FILE__)).'/'.$system_folder;
    }
}
else
{
    // Swap directory separators to Unix style for consistency
    $system_folder = str_replace("\", "/", $system_folder); 
} 

Note how it says

Note: We only attempt this if the user hasn’t specified a
| full server path.

and it determines that through


if (strpos($system_folder, '/') === FALSE)

I suggest changing this to


if (strpos($system_folder, '/') !== 0)

This change makes the system only assume an absolute address if the first character is a forward slash. Eg. /apps/system = absolute, ../system = relative. Which is more correct in my opinion. Not many folks would have a problem with this but it caught me out today.

DB Active Record MAX, MIN, etc. fix - I think…

2010-03-11T01:05:22-06:00

I was modifying the PyroCMS today to add a feature to the installer. The feature I was adding was related to the table prefix in the Database Active Record, this wasn’t thought of apparently before hand (silly Phil).

Anyways, I implemented the feature but then the queries stopped working. After some debugging I found that this query was causing the error:

$this->db->select('comments.*');
        $this->db->select('IF(comments.user_id > 0, IF(u.last_name = "", u.first_name, CONCAT(u.first_name, " ", u.last_name)), comments.name) as name');
        $this->db->select('IF(comments.user_id > 0, u.email, comments.email) as email');
        $this->db->join('users u', 'comments.user_id = u.id', 'left'); 

So I did more debugging in CI’s DB Driver to find the cause and fixed it. In the DB Driver file (on line 1253 maybe?), it just returns the $item.$alias if the $item contains the ‘(’ character. (look for a comment by Rick if that helps)

Here is what I did to get it to work:

*begin edit*
Change this line of code:

if (strpos($item, '(') !== FALSE)
{
    return $item.$alias;
} 

To be this instead:

if (strpos($item, '(') !== FALSE && strpos($item, '.') === FALSE)
{
    return $item.$alias;
} 

*end edit*

Then a few lines below you should see this:

if (strpos($item, '.') !== FALSE)
        {
            $parts    = explode('.', $item);
   // etc... 

Change it to be:

if (strpos($item, '.') !== FALSE)
        {
            $parts    = explode('.', $item);
            
            // check for the MAX, MIN, etc.
            if (strpos($parts[0], '(') !== FALSE)
            {
                $action = substr($parts[0], 0, strpos($parts[0], '(') + 1);
                $parts[0] = substr($parts[0], strpos($parts[0], '(') + 1);
            }
            else 
            {
                $action = '';
            } 

Then finally, after these lines of code (about ~60 lines down):

if ($protect_identifiers === TRUE)
            {
                $item = $this->_escape_identifiers($item);
            }
                        return $item.$alias; 

Change it be this instead:

if ($protect_identifiers === TRUE)
            {
                $item = $this->_escape_identifiers($item);
            }
                        return $action.$item.$alias; 

I appreciate any feedback on this. I am only going to be debugging from what I work with on PyroCMS (for the moment). I hope it helps someone else out there.

Uncaught exception ‘Doctrine_Connection_Exception’

2010-03-16T02:01:24-06:00

Hello!

In fact, I test a code that I pick up in the net
In my PC with WAMP 2.0, it works but in my laptop with WAMP 1.7, I got this page:

Fatal error: Uncaught exception ‘Doctrine_Connection_Exception’ with message ‘Couldn’t locate driver named mysql’ in C:wampwwwDEBTOMsystemdatabasedoctrineDoctrineConnection.php:465 Stack trace: #0 C:wampwwwEDBM08-IsystemdatabasedoctrineDoctrineConnection.php(969): Doctrine_Connection->connect() #1 C:wampwwwEDBM08-IsystemdatabasedoctrineDoctrineQueryAbstract.php(914): Doctrine_Connection->execute(‘SELECT t.idibme…’, Array) #2 C:wampwwwEDBM08-IsystemdatabasedoctrineDoctrine

Sincerely, I don’t know what this folder doctrine is? So, I’m searching but if you can help, you’re welcome !!!

XSS filtering and the manual..

2010-03-14T23:06:09-06:00

CodeIgniter comes with a Cross Site Scripting Hack prevention filter which can either run automatically to filter all POST and COOKIE data that is encountered, or you can run it on a per item basis. By default it does not run globally since it requires a bit of processing overhead, and since you may not need it in all cases.

i wasted more than two hours of my life trying to figure out the problem with my jQuery code, because i believed the manual and didn’t even bother to look into the config file.. please fix this .. XSS filtering DOES RUN globally by default .

strange injection in index.php

2010-03-13T16:21:53-06:00

Hi,

yesterday one of my clients site was hacked, i didn’t develop the site itself and i don’t have lots of experience working with codeigniter, but the issue was solved and i need any valuable information to prevent this behaviour in the future.
As i said, i haven’t worked much with codeigniter, so i will be thankfull for any help you could provide.

The problem was that the main page loaded blank, the hoster said, there was an error in the main index.php file, once i opened it i saw this code (at the bottom of the file):

http://pastebin.com/9mvk6PzL

What is it? a cookie hijacker, a redirect or what? As i see it is some sort of hash, is there anyway to decipher it?

P.S. codeigniters version on host is : 1.7.1

Thanks in advance.

Insert into database doesn’t work with redirect

2010-03-13T05:07:40-06:00

Hi!

My controller code is the following :

function addtoDB()
    {
        $this->load->helper(array('form', 'date'));
        $this->load->library('form_validation');

        $this->form_validation->set_rules('day', 'day', 'required|numeric');
        
        if ($this->form_validation->run() == FALSE)
        {
            $this->load->view('header_view');
            $this->load->view('member_view');
            $this->load->view('footer_view');
        }
        else
        {
            $this->load->database();
            $data = array(
                ...
                        );

            if ($this->db->insert('rappels', $data))
            {
                $this->session->set_flashdata('message', 'okdb');
            }
            else
            {
                $this->session->set_flashdata('message', 'errdb');
            }
            sleep(2);
            redirect('member');
        }
    } 

Inserting into the database doesn’t work. But, if I comment redirect(‘member’), then the data is correctly inserted into the database…

Strange, isn’t it?

I found a workaround by placing…


sleep(2);

just before the redirect, but I believe there must be a better solution.

I’m using ODBC and MS Access database.

I’ve had quite a few bugs in the past that I’ve been able to solve thanks to this forum, but I seem to be the first one experiencing this bug.

Any help is welcome, thanks in advance!

CI2 - convert_accented_characters() gives bad codes

2010-03-12T05:29:52-06:00

Using the new convert_accented_characters() function in text_helper.php I am getting failed conversions of characters.

The following characters should be supported:

'232'    =>    "e",  // è
                            '233'    =>    "e",  // é
                            '234'    =>    "e",  // ê                                  
                            '235'    =>    "e",  // ë 

The numbers on the left are the character codes. However when I try this:


echo convert_accented_characters('ë');

I get � returned here, so I have put a debug step into the function here:


return $ord = ord($match['1']);

The codes I get for these four characters are:

è - 168
é - 169
ê - 170
ë - 171

These numbers are not in the config file at all, as it only starts from 223.

I am using Mac OSX, PHP 5.2.11. Charset is UTF-8 and the browser is FF 3.6.

Not sure if I should simply add these missing characters into the config file or what?

Anybody else getting this? I have submitted it to the bug tracker too.

P.S ü - 188 >.<

CI tries to save even complete new custom fields into the session table…

2010-03-11T23:41:43-06:00

Like you might guess what’s this all about.. “CI tries to save even complete new custom fields into the session table…”, i have no idea what is going on here.

I just followed an great videocast (http://vimeo.com/7529193) regarding sessions and logging in using the database.

After completing this tour, i was disappointed. When i want to login, i get the following error:

Error Number: 1054

Unknown column ‘userEmail’ in ‘field list’

UPDATE `sessions` SET `userEmail` = ‘test@test.com’, `userPassword` = ‘a1066faa4563cbdda18901e8d749f63c’, `last_activity` = 1268368650, `user_data` = ‘a:2:{s:9:“userEmail”;s:16:“test@test.com”;s:6:“userId”;s:13:“1”;}’ WHERE `session_id` = ‘308a6a5ddaed9c9d90e55f829ab2d817’

I have never ever said that i wanted to save these “userEmail” and “userPassword” fields into a own table column…

Does anyone have an idea about how this come ?

Thank you