Skip to content

Commit b2fef14

Browse files
narfbgnarfbg
committed
Backport CAPTCHA changes, update version numbers
1 parent 8868baa commit b2fef14

File tree

152 files changed

+264
-160
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

152 files changed

+264
-160
lines changed

‎system/core/CodeIgniter.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
* @var string
3535
*
3636
*/
37-
define('CI_VERSION', '2.2.5');
37+
define('CI_VERSION', '2.2.6');
3838

3939
/**
4040
* CodeIgniter Branch (Core = TRUE, Reactor = FALSE)

‎system/helpers/captcha_helper.php

Lines changed: 96 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -107,18 +107,93 @@ function create_captcha($data = '', $img_path = '', $img_url = '', $font_path =
107107
// Do we have a "word" yet?
108108
// -----------------------------------
109109

110-
if ($word == '')
111-
{
110+
// -----------------------------------
111+
// Do we have a "word" yet?
112+
// -----------------------------------
113+
114+
if (empty($word))
115+
{
116+
$word = '';
112117
$pool = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
118+
$pool_length = strlen($pool);
119+
$rand_max = $pool_length - 1;
113120

114-
$str = '';
115-
for ($i = 0; $i < 8; $i++)
121+
// PHP7 or a suitable polyfill
122+
if (function_exists('random_int'))
116123
{
117-
$str .= substr($pool, mt_rand(0, strlen($pool) -1), 1);
124+
try
125+
{
126+
for ($i = 0; $i < $word_length; $i++)
127+
{
128+
$word .= $pool[random_int(0, $rand_max)];
129+
}
130+
}
131+
catch (Exception $e)
132+
{
133+
// This means fallback to the next possible
134+
// alternative to random_int()
135+
$word = '';
136+
}
118137
}
138+
}
119139

120-
$word = $str;
121-
}
140+
if (empty($word))
141+
{
142+
// To avoid numerous get_random_bytes() calls, we'll
143+
// just try fetching as much bytes as we need at once.
144+
if (($bytes = _ci_captcha_get_random_bytes($pool_length)) !== FALSE)
145+
{
146+
$byte_index = $word_index = 0;
147+
while ($word_index < $word_length)
148+
{
149+
if (($rand_index = unpack('C', $bytes[$byte_index++])) > $rand_max)
150+
{
151+
// Was this the last byte we have?
152+
// If so, try to fetch more.
153+
if ($byte_index === $pool_length)
154+
{
155+
// No failures should be possible if
156+
// the first get_random_bytes() call
157+
// didn't return FALSE, but still ...
158+
for ($i = 0; $i < 5; $i++)
159+
{
160+
if (($bytes = _ci_captcha_get_random_bytes($pool_length)) === FALSE)
161+
{
162+
continue;
163+
}
164+
165+
$byte_index = 0;
166+
break;
167+
}
168+
169+
if ($bytes === FALSE)
170+
{
171+
// Sadly, this means fallback to mt_rand()
172+
$word = '';
173+
break;
174+
}
175+
}
176+
177+
continue;
178+
}
179+
180+
$word .= $pool[$rand_index];
181+
$word_index++;
182+
}
183+
}
184+
}
185+
186+
if (empty($word))
187+
{
188+
for ($i = 0; $i < $word_length; $i++)
189+
{
190+
$word .= $pool[mt_rand(0, $rand_max)];
191+
}
192+
}
193+
elseif ( ! is_string($word))
194+
{
195+
$word = (string) $word;
196+
}
122197

123198
// -----------------------------------
124199
// Determine angle and position
@@ -239,6 +314,20 @@ function create_captcha($data = '', $img_path = '', $img_url = '', $font_path =
239314

240315
return array('word' => $word, 'time' => $now, 'image' => $img);
241316
}
317+
318+
function _ci_captcha_get_random_bytes($length)
319+
{
320+
if (defined('MCRYPT_DEV_URANDOM'))
321+
{
322+
return mcrypt_create_iv($length, MCRYPT_DEV_URANDOM);
323+
}
324+
elseif (function_exists('openssl_random_pseudo_bytes'))
325+
{
326+
return openssl_random_pseudo_bytes($length);
327+
}
328+
329+
return FALSE;
330+
}
242331
}
243332

244333
// ------------------------------------------------------------------------

‎user_guide/changelog.html

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
<div id="masthead">
2929
<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
3030
<tr>
31-
<td><h1>CodeIgniter User Guide Version 2.2.5</h1></td>
31+
<td><h1>CodeIgniter User Guide Version 2.2.6</h1></td>
3232
<td id="breadcrumb_right"><a href="./toc.html">Table of Contents Page</a></td>
3333
</tr>
3434
</table>
@@ -57,13 +57,27 @@
5757

5858
<h1>Change Log</h1>
5959

60+
61+
<h2>Version 2.2.6</h2>
62+
<p>Release Date: October 31, 2015</p>
63+
64+
<ul>
65+
<li><b>Security</b>
66+
<ul>
67+
<li>Fixed an XSS attack vector in <a href="libraries/security.html">Security Library</a> method <samp>xss_clean()</samp>.</li>
68+
<li>Changed <a href="libraries/config.html">Config Library</a> method <samp>base_url()</samp> to fallback to ``$_SERVER['SERVER_ADDR']`` in order to avoid Host header injections.</li>
69+
<li>Changed <a href="helpers/captcha_helper.html">CAPTCHA Helper</a> to try to use the operating system's PRNG first.</a>
70+
</ul>
71+
</li>
72+
</ul>
73+
6074
<h2>Version 2.2.5</h2>
6175
<p>Release Date: October 8, 2015</p>
6276

6377
<ul>
6478
<li><b>Security</b>
6579
<ul>
66-
<li>Fixed a number of XSS attack vectors in <a href="libraries/security.html">Security Library</a> method <samp>xss_clean</samp> (thanks to Frans Rosén from <a href="https://detectify.com/">Detectify</a>).
80+
<li>Fixed a number of XSS attack vectors in <a href="libraries/security.html">Security Library</a> method <samp>xss_clean()</samp> (thanks to Frans Rosén from <a href="https://detectify.com/">Detectify</a>).</li>
6781
</ul>
6882
</li>
6983
</ul>

‎user_guide/database/active_record.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
<div id="masthead">
2828
<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
2929
<tr>
30-
<td><h1>CodeIgniter User Guide Version 2.2.5</h1></td>
30+
<td><h1>CodeIgniter User Guide Version 2.2.6</h1></td>
3131
<td id="breadcrumb_right"><a href="../toc.html">Table of Contents Page</a></td>
3232
</tr>
3333
</table>

‎user_guide/database/caching.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
<div id="masthead">
2929
<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
3030
<tr>
31-
<td><h1>CodeIgniter User Guide Version 2.2.5</h1></td>
31+
<td><h1>CodeIgniter User Guide Version 2.2.6</h1></td>
3232
<td id="breadcrumb_right"><a href="../toc.html">Table of Contents Page</a></td>
3333
</tr>
3434
</table>

‎user_guide/database/call_function.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
<div id="masthead">
2929
<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
3030
<tr>
31-
<td><h1>CodeIgniter User Guide Version 2.2.5</h1></td>
31+
<td><h1>CodeIgniter User Guide Version 2.2.6</h1></td>
3232
<td id="breadcrumb_right"><a href="../toc.html">Table of Contents Page</a></td>
3333
</tr>
3434
</table>

‎user_guide/database/configuration.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
<div id="masthead">
2929
<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
3030
<tr>
31-
<td><h1>CodeIgniter User Guide Version 2.2.5</h1></td>
31+
<td><h1>CodeIgniter User Guide Version 2.2.6</h1></td>
3232
<td id="breadcrumb_right"><a href="../toc.html">Table of Contents Page</a></td>
3333
</tr>
3434
</table>

‎user_guide/database/connecting.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
<div id="masthead">
2929
<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
3030
<tr>
31-
<td><h1>CodeIgniter User Guide Version 2.2.5</h1></td>
31+
<td><h1>CodeIgniter User Guide Version 2.2.6</h1></td>
3232
<td id="breadcrumb_right"><a href="../toc.html">Table of Contents Page</a></td>
3333
</tr>
3434
</table>

‎user_guide/database/examples.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
<div id="masthead">
2929
<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
3030
<tr>
31-
<td><h1>CodeIgniter User Guide Version 2.2.5</h1></td>
31+
<td><h1>CodeIgniter User Guide Version 2.2.6</h1></td>
3232
<td id="breadcrumb_right"><a href="../toc.html">Table of Contents Page</a></td>
3333
</tr>
3434
</table>

‎user_guide/database/fields.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
<div id="masthead">
2929
<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
3030
<tr>
31-
<td><h1>CodeIgniter User Guide Version 2.2.5</h1></td>
31+
<td><h1>CodeIgniter User Guide Version 2.2.6</h1></td>
3232
<td id="breadcrumb_right"><a href="../toc.html">Table of Contents Page</a></td>
3333
</tr>
3434
</table>

0 commit comments

Comments
 (0)