Skip to content

Commit 5881726

Browse files
monkenWumonkenWu
authored
Merge pull request #34 from monkenWu/update_to_4.1.5
Update to 4.1.5
2 parents c241151 + 4bc010b commit 5881726

134 files changed

Lines changed: 9436 additions & 5123 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎security.rst‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
##############
2+
安全性類別
3+
##############
4+
5+
安全性類別包含許多方法，有助於保護你的網站免於遭到跨站請求偽造（Cross-Site Request Forgery）攻擊。
6+
7+
.. contents::
8+
:local:
9+
:depth: 2
10+
11+
*******************
12+
載入程式庫
13+
*******************
14+
15+
如果你載入這個程式庫是為了處理 CSRF 保護，那麼你將永遠不需要載入它，因為它已作為一個過濾器運作，不需要手動操作。
16+
17+
如真的有需要直接呼叫這個類別的情況發生，你可以透過 Services 檔案載入它：
18+
19+
::
20+
21+
$security = \Config\Services::security();
22+
23+
*********************************
24+
跨站請求偽造（CSRF）
25+
*********************************
26+
27+
.. warning:: The CSRF Protection is only available for **POST/PUT/PATCH/DELETE** requests.
28+
Requests for other methods are not protected.
29+
30+
CSRF Protection Methods
31+
=======================
32+
33+
By default, the Cookie based CSRF Protection is used. It is
34+
`Double Submit Cookie <https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#double-submit-cookie>`_
35+
on OWASP Cross-Site Request Forgery Prevention Cheat Sheet.
36+
37+
You can also use Session based CSRF Protection. It is
38+
`Synchronizer Token Pattern <https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#synchronizer-token-pattern>`_.
39+
40+
You can set to use the Session based CSRF protection by editing the following config parameter value in
41+
**app/Config/Security.php**::
42+
43+
public $csrfProtection = 'session';
44+
45+
Enable CSRF Protection
46+
======================
47+
48+
你可以透過修改 **app/Config/Filters.php** 開啟 CSRF 的保護功能。並在全域啟用 `CSRF` 過濾器：
49+
50+
::
51+
52+
public $globals = [
53+
'before' => [
54+
//'honeypot'
55+
'csrf'
56+
]
57+
];
58+
59+
你所選擇的 URI 將會進入 CSRF 保護的白名單（例如：API 端點期待外部 POST 的內容）。你可以在過濾器中添加這些 URI 作為例外狀況::
60+
61+
public $globals = [
62+
'before' => [
63+
'csrf' => ['except' => ['api/record/save']]
64+
]
65+
];
66+
67+
也支援輸入正規表示式（與大小寫無關）：
68+
69+
::
70+
71+
public $globals = [
72+
'before' => [
73+
'csrf' => ['except' => ['api/record/[0-9]+']]
74+
]
75+
];
76+
77+
HTML 表單
78+
==========
79+
80+
如果你使用 :doc:`表單輔助函數 <../helpers/form_helper>`，那麼
81+
:func:`form_open()` 會自動在你的表單中插入一個隱藏的 csrf 欄位。
82+
83+
.. note:: To use auto-generation of CSRF field, you need to turn CSRF filter on to the form page.
84+
In most cases it is requested using the ``GET`` method.
85+
86+
如果沒有，你可以使用 ``csrf_token()`` 和 ``csrf_hash()`` 函數。
87+
88+
::
89+
90+
<input type="hidden" name="<?= csrf_token() ?>" value="<?= csrf_hash() ?>" />
91+
92+
此外，你可以使用 ``csrf_field()`` 方法來產生隱藏的輸入欄位::
93+
94+
// Generates: <input type="hidden" name="{csrf_token}" value="{csrf_hash}" />
95+
<?= csrf_field() ?>
96+
97+
當發送一個 JSON 請求時， CSRF 權杖也可以作為被傳遞的參數之一。
98+
下一個傳遞 CSRF 權杖的方法是一個特殊的 Http 標頭，它的名稱可以透過函數 ``csrf_header()`` 來實現。
99+
100+
此外，你可以使用 ``csrf_meta()`` 方法便捷地產生 meta 標籤::
101+
102+
// Generates: <meta name="{csrf_header}" content="{csrf_hash}" />
103+
<?= csrf_meta() ?>
104+
105+
The Order of Token Sent by Users
106+
================================
107+
108+
檢查 CSRF 權杖可用性的順序如下:
109+
110+
1. ``$_POST`` 陣列
111+
2. Http 標頭
112+
3. ``php://input`` （JSON 請求） - 請記得，這種方法是最慢的，因為我們必須先對 JSON 進行解碼，然後再進行編碼
113+
114+
Token Regeneration
115+
===================
116+
117+
權杖可以在每次提交時重新產生（預設），也可以在 CSRF cookie 整個生命週期中保持不變。預設將重新產生權杖，這將提供了更好的安全性，但也可能導致可用性問題，例如：其他權杖會變得無效（導覽歷程記錄上一頁或下一頁、多個分頁視窗、非同步操作等）。你可以透過編輯以下設定參數來改變此特性。
118+
119+
::
120+
121+
public $regenerate = true;
122+
123+
Redirection on Failure
124+
======================
125+
126+
當請求沒有通過 CSRF 驗證檢查時，預設情況下將會重新導向上一頁，你可以設定一個 ``error`` 的即時訊息，向終端使用者顯示該訊息，這提供了比瀏覽器崩潰更好的使用者體驗。這個功能可以透過編輯 **app/Config/App.php** 中的 ``$CSRFRedirect`` 值來關閉：
127+
128+
::
129+
130+
public $redirect = false;
131+
132+
即使重新導向值為 **true**，AJAX 呼叫也不會重新導向，但是會引發錯誤。
133+
134+
*********************
135+
其他實用方法
136+
*********************
137+
138+
你不需要直接使用安全性類別中大部分的方法。以下是一些與 CSRF 無關的方法。
139+
140+
**sanitizeFilename()**
141+
142+
嘗試將檔案名稱消毒，以防止「企圖遍歷目錄」和其他安全性問題，這對於經由使用者輸入所提供的檔案特別有用。第一個參數是路徑消毒。
143+
144+
如果允許使用者輸入相對路徑，例如： file/in/some/approved/folder.txt ，可以將第二個可選參數 $relative_path 傳入 true。
145+
146+
::
147+
148+
$path = $security->sanitizeFilename($request->getVar('filepath'));

‎source/changelogs/index.rst‎

Lines changed: 24 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -10,25 +10,28 @@ Version |version|
1010
See all the changes.
1111

1212
.. toctree::
13-
:titlesonly:
13+
:titlesonly:
1414

15-
v4.1.2
16-
v4.1.1
17-
v4.1.0
18-
v4.0.5
19-
v4.0.4
20-
v4.0.3
21-
v4.0.0
22-
v4.0.0-rc.4
23-
v4.0.0-rc.3
24-
v4.0.0-rc.2
25-
v4.0.0-rc.1
26-
v4.0.0-beta.4
27-
v4.0.0-beta.3
28-
v4.0.0-beta.2
29-
v4.0.0-beta.1
30-
v4.0.0-alpha.5
31-
v4.0.0-alpha.4
32-
v4.0.0-alpha.3
33-
v4.0.0-alpha.2
34-
v4.0.0-alpha.1
15+
v4.1.5
16+
v4.1.4
17+
v4.1.3
18+
v4.1.2
19+
v4.1.1
20+
v4.1.0
21+
v4.0.5
22+
v4.0.4
23+
v4.0.3
24+
v4.0.0
25+
v4.0.0-rc.4
26+
v4.0.0-rc.3
27+
v4.0.0-rc.2
28+
v4.0.0-rc.1
29+
v4.0.0-beta.4
30+
v4.0.0-beta.3
31+
v4.0.0-beta.2
32+
v4.0.0-beta.1
33+
v4.0.0-alpha.5
34+
v4.0.0-alpha.4
35+
v4.0.0-alpha.3
36+
v4.0.0-alpha.2
37+
v4.0.0-alpha.1

‎source/changelogs/v4.1.3.rst‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
Version 4.1.3
2+
=============
3+
4+
Release Date: June 6, 2021
5+
6+
**4.1.3 release of CodeIgniter4**
7+
8+
Enhancements:
9+
10+
- New functions in the File Helper: ``directory_mirror()`` and ``same_file()``
11+
- Implemented NexusPHP's ``Tachycardia`` for slow test identification
12+
- Added a new ``$ttl`` option to ``Cache`` config for future use
13+
14+
Changes:
15+
16+
- Added MySQL 8.0 to the test matrix
17+
- Improved environment detection from ``$_SERVER``
18+
- Numerous sweeping code improvements via Rector and analysis
19+
20+
Bugs Fixed:
21+
22+
- Fixed a bug where ``CURLRequest`` would try to use a project URI instead of its base
23+
- Fixed a bug where CLI mode was not detected under ``cgi-fcgi``
24+
- Fixed a logic bug in Cookie construction
25+
- Fixed numerous issues in SQLite3's ``Forge`` class related to an incorrect attribute name

‎source/changelogs/v4.1.4.rst‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
Version 4.1.4
2+
=============
3+
4+
Release Date: September 6, 2021
5+
6+
**4.1.4 release of CodeIgniter4**
7+
8+
This release focuses on code style. All changes (except those noted below) are cosmetic to bring the code in line with the new
9+
`CodeIgniter Coding Standard <https://github.com/CodeIgniter/coding-standard>`_ (based on PSR-12).
10+
11+
Breaking Changes:
12+
13+
- The following methods were changed from "public" to "protected" to match their parent class methods and better align with their uses:
14+
15+
* ``CodeIgniter\Database\MySQLi\Connection::execute()``
16+
* ``CodeIgniter\Database\MySQLi\Connection::_fieldData()``
17+
* ``CodeIgniter\Database\MySQLi\Connection::_indexData()``
18+
* ``CodeIgniter\Database\MySQLi\Connection::_foreignKeyData()``
19+
* ``CodeIgniter\Database\Postgre\Builder::_like_statement()``
20+
* ``CodeIgniter\Database\Postgre\Connection::execute()``
21+
* ``CodeIgniter\Database\Postgre\Connection::_fieldData()``
22+
* ``CodeIgniter\Database\Postgre\Connection::_indexData()``
23+
* ``CodeIgniter\Database\Postgre\Connection::_foreignKeyData()``
24+
* ``CodeIgniter\Database\SQLSRV\Connection::execute()``
25+
* ``CodeIgniter\Database\SQLSRV\Connection::_fieldData()``
26+
* ``CodeIgniter\Database\SQLSRV\Connection::_indexData()``
27+
* ``CodeIgniter\Database\SQLSRV\Connection::_foreignKeyData()``
28+
* ``CodeIgniter\Database\SQLite3\Connection::execute()``
29+
* ``CodeIgniter\Database\SQLite3\Connection::_fieldData()``
30+
* ``CodeIgniter\Database\SQLite3\Connection::_indexData()``
31+
* ``CodeIgniter\Database\SQLite3\Connection::_foreignKeyData()``
32+
* ``CodeIgniter\Images\Handlers\GDHandler::_flatten()``
33+
* ``CodeIgniter\Images\Handlers\GDHandler::_flip()``
34+
* ``CodeIgniter\Images\Handlers\ImageMagickHandler::_flatten()``
35+
* ``CodeIgniter\Images\Handlers\ImageMagickHandler::_flip()``
36+
* ``CodeIgniter\Test\Mock\MockIncomingRequest::detectURI()``
37+
* ``CodeIgniter\Test\Mock\MockSecurity.php::sendCookie()``
38+
39+
- To be compatible with the strict inheritance checks of PHP 8.1, the following method signatures were added return types to match their parents' signatures whenever possible:
40+
41+
* ``CodeIgniter\Cookie\Cookie::offsetExists()``
42+
* ``CodeIgniter\Cookie\Cookie::offsetSet()``
43+
* ``CodeIgniter\Cookie\Cookie::offsetUnset()``
44+
* ``CodeIgniter\Cookie\CookieStore::getIterator()``
45+
* ``CodeIgniter\I18n\Time::__wakeup()``
46+
* ``CodeIgniter\Test\Filters\CITestStreamFilter::filter()``
47+
48+
- Related to the strict inheritance checks of PHP 8.1, the following session handlers implementing ``SessionHandlerInterface`` have their public methods modified to match the interface:
49+
50+
* ``CodeIgniter\Session\Handlers\ArrayHandler``
51+
* ``CodeIgniter\Session\Handlers\DatabaseHandler``
52+
* ``CodeIgniter\Session\Handlers\FileHandler``
53+
* ``CodeIgniter\Session\Handlers\MemcachedHandler``
54+
* ``CodeIgniter\Session\Handlers\RedisHandler``

‎source/changelogs/v4.1.5.rst‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
Version 4.1.5
2+
#############
3+
4+
Release Date: November 8, 2021
5+
6+
**4.1.5 release of CodeIgniter4**
7+
8+
.. contents::
9+
:local:
10+
:depth: 1
11+
12+
BREAKING
13+
========
14+
15+
- Fixed `a bug <https://github.com/codeigniter4/CodeIgniter4/issues/2913>`_ on CSRF protection. Now CSRF protection works on PUT/PATCH/DELETE requests when CSRF filter is applied. If you use such requests, you need to send CSRF token.
16+
- In the previous version, if you didn't provide your own headers, ``CURLRequest`` would send the request-headers from the browser, due to a bug. As of this version, it does not send them.
17+
- Fixed ``BaseBuilder::insertBatch()`` return value for ``testMode``. Now it returns SQL string array instead of a number of affected rows. This change was made because of maintaining compatibility between returning types for batch methods. Now the returned data type for ``BaseBuilder::insertBatch()`` is the same as the `updateBatch()` method.
18+
- Major optimizations have been made to the way data is processed in ``BaseBuilder::insertBatch()`` and ``BaseBuilder::updateBatch()`` methods. This resulted in reduced memory usage and faster query processing. As a trade-off, the result generated by the ``$query->getOriginalQuery()`` method was changed. It no longer returns the query with the binded parameters, but the actual query that was run.
19+
20+
Enhancements
21+
============
22+
23+
- Added Cache config for reserved characters
24+
- The ``addForeignKey`` function of the ``Forge`` class can now define composite foreign keys in an array
25+
- The ``dropKey`` function of the ``Forge`` class can remove key
26+
27+
Changes
28+
=======
29+
30+
- Always escape identifiers in the ``set``, ``setUpdateBatch``, and ``insertBatch`` functions in ``BaseBuilder``.
31+
32+
Deprecations
33+
============
34+
35+
- Deprecated ``CodeIgniter\\Cache\\Handlers\\BaseHandler::RESERVED_CHARACTERS`` in favor of the new config property

‎source/cli/cli.rst‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -30,44 +30,46 @@
3030

3131
::
3232

33-
<?php namespace App\Controllers;
33+
<?php
3434

35-
use CodeIgniter\Controller;
35+
namespace App\Controllers;
3636

37-
class Tools extends Controller {
37+
use CodeIgniter\Controller;
3838

39-
public function message($to = 'World')
40-
{
41-
echo "Hello {$to}!".PHP_EOL;
42-
}
43-
}
39+
class Tools extends Controller
40+
{
41+
public function message($to = 'World')
42+
{
43+
echo "Hello {$to}!" . PHP_EOL;
44+
}
45+
}
4446

4547
接著，把這個檔案儲存在你的 **app/Controllers/** 目錄底下。
4648

4749
通常你會使用這樣的 URL 造訪你的網站：
4850

4951
::
5052

51-
example.com/index.php/tools/message/to
53+
example.com/index.php/tools/message/to
5254

5355
但現在，我們打開 Mac/Linux 的 Terminal ，或者在 Windows 中打開 cmd ，然後定位至 CodeIgniter 的專案根目錄。
5456

5557
.. code-block:: bash
5658
57-
$ cd /path/to/project/public
58-
$ php index.php tools message
59+
$ cd /path/to/project/public
60+
$ php index.php tools message
5961
6062
如果你做得沒錯，你應該會看到螢幕上出現 *Hello World!* 的訊息。
6163

6264
.. code-block:: bash
6365
64-
$ php index.php tools message "John Smith"
66+
$ php index.php tools message "John Smith"
6567
6668
在這裡，我們使用與 URL 一樣的方式傳遞一個參數， "John Smith" 就會作為參數傳入到控制器方法中，你得輸出就會變為：
6769

6870
::
6971

70-
Hello John Smith!
72+
Hello John Smith!
7173

7274
基本知識
7375
==================

0 commit comments

Comments
 (0)