Skip to content

Commit 0abc55a

Browse files
narfbgnarfbg
committed
[ci skip] Update changelog, version & upgrade instructions
1 parent f8deea5 commit 0abc55a

File tree

5 files changed

+96
-6
lines changed

5 files changed

+96
-6
lines changed

‎system/core/CodeIgniter.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@
5555
* @var string
5656
*
5757
*/
58-
define('CI_VERSION', '3.0.3-dev');
58+
define('CI_VERSION', '3.0.3');
5959

6060
/*
6161
* ------------------------------------------------------

‎user_guide_src/source/changelog.rst

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,13 @@ Change Log
55
Version 3.0.3
66
=============
77

8-
Release Date: Not Released
8+
Release Date: October 31, 2015
9+
10+
- **Security**
11+
12+
- Fixed an XSS attack vector in :doc:`Security Library <libraries/security>` method ``xss_clean()``.
13+
- Changed :doc:`Config Library <libraries/config>` method ``base_url()`` to fallback to ``$_SERVER['SERVER_ADDR']`` when ``$config['base_url']`` is empty in order to avoid *Host* header injections.
14+
- Changed :doc:`CAPTCHA Helper <helpers/captcha_helper>` to use the operating system's PRNG when possible.
915

1016
- Database
1117

‎user_guide_src/source/conf.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,9 @@
4848
# built documents.
4949
#
5050
# The short X.Y version.
51-
version = '3.0.3-dev'
51+
version = '3.0.3'
5252
# The full version, including alpha/beta/rc tags.
53-
release = '3.0.3-dev'
53+
release = '3.0.3'
5454

5555
# The language for content autogenerated by Sphinx. Refer to documentation
5656
# for a list of supported languages.

‎user_guide_src/source/installation/upgrade_300.rst

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -464,8 +464,51 @@ files and error messages format:
464464
Therefore you're encouraged to update its usage sooner rather than
465465
later.
466466

467+
************************************************************
468+
Step 19: Make sure your 'base_url' config value is not empty
469+
************************************************************
470+
471+
When ``$config['base_url']`` is not set, CodeIgniter tries to automatically
472+
detect what your website's base URL is. This is done purely for convenience
473+
when you are starting development of a new application.
474+
475+
Auto-detection is never reliable and also has security implications, which
476+
is why you should **always** have it manually configured!
477+
478+
One of the changes in CodeIgniter 3.0.3 is how this auto-detection works,
479+
and more specifically it now falls back to the server's IP address instead
480+
of the hostname requested by the client. Therefore, if you've ever relied
481+
on auto-detection, it will change how your website works now.
482+
483+
In case you need to allow e.g. multiple domains, or both http:// and
484+
https:// prefixes to be dynamically used depending on the request,
485+
remember that *application/config/config.php* is still a PHP script, in
486+
which you can create this logic with a few lines of code. For example::
487+
488+
$allowed_domains = array('domain1.tld', 'domain2.tld');
489+
$default_domain = 'domain1.tld';
490+
491+
if (in_array($_SERVER['HTTP_HOST'], $allowed_domains, TRUE))
492+
{
493+
$domain = $_SERVER['HTTP_HOST'];
494+
}
495+
else
496+
{
497+
$domain = $default_domain;
498+
}
499+
500+
if ( ! empty($_SERVER['HTTPS']))
501+
{
502+
$config['base_url'] = 'https://'.$domain;
503+
}
504+
else
505+
{
506+
$config['base_url'] = 'http://'.$domain;
507+
}
508+
509+
467510
****************************************************************
468-
Step 19: Remove usage of (previously) deprecated functionalities
511+
Step 20: Remove usage of (previously) deprecated functionalities
469512
****************************************************************
470513

471514
In addition to the ``$autoload['core']`` configuration setting, there's a

‎user_guide_src/source/installation/upgrade_303.rst

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,4 +11,45 @@ Step 1: Update your CodeIgniter files
1111
Replace all files and directories in your *system/* directory.
1212

1313
.. note:: If you have any custom developed files in these directories,
14-
please make copies of them first.
14+
please make copies of them first.
15+
16+
Step 2: Make sure your 'base_url' config value is not empty
17+
===========================================================
18+
19+
When ``$config['base_url']`` is not set, CodeIgniter tries to automatically
20+
detect what your website's base URL is. This is done purely for convenience
21+
when you are starting development of a new application.
22+
23+
Auto-detection is never reliable and also has security implications, which
24+
is why you should **always** have it manually configured!
25+
26+
One of the changes in CodeIgniter 3.0.3 is how this auto-detection works,
27+
and more specifically it now falls back to the server's IP address instead
28+
of the hostname requested by the client. Therefore, if you've ever relied
29+
on auto-detection, it will change how your website works now.
30+
31+
In case you need to allow e.g. multiple domains, or both http:// and
32+
https:// prefixes to be dynamically used depending on the request,
33+
remember that *application/config/config.php* is still a PHP script, in
34+
which you can create this logic with a few lines of code. For example::
35+
36+
$allowed_domains = array('domain1.tld', 'domain2.tld');
37+
$default_domain = 'domain1.tld';
38+
39+
if (in_array($_SERVER['HTTP_HOST'], $allowed_domains, TRUE))
40+
{
41+
$domain = $_SERVER['HTTP_HOST'];
42+
}
43+
else
44+
{
45+
$domain = $default_domain;
46+
}
47+
48+
if ( ! empty($_SERVER['HTTPS']))
49+
{
50+
$config['base_url'] = 'https://'.$domain;
51+
}
52+
else
53+
{
54+
$config['base_url'] = 'http://'.$domain;
55+
}

0 commit comments

Comments
 (0)