Skip to content

Commit bc9b3c9

Browse files
monkenWumonkenWu
authored
Merge pull request #35 from monkenWu/dev
v4.1.5 T1 更新
2 parents dd190b0 + 5881726 commit bc9b3c9

136 files changed

Lines changed: 9544 additions & 5123 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/deploy-userguide-latest.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# When changes are pushed to the develop branch,
2+
# build the current version of the User Guide
3+
# with Sphinx and deploy it to the gh-pages branch.
4+
#
5+
# @todo Consolidate checkouts
6+
name: Deploy User Guide (latest)
7+
8+
on:
9+
push:
10+
branches: [ dev ]
11+
12+
jobs:
13+
build:
14+
name: Deploy to gh-pages
15+
# if: (github.repository == 'codeigniter4/CodeIgniter4')
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@v2
20+
21+
# Build the latest User Guide
22+
- name: Build with Sphinx
23+
uses: ammaraskar/sphinx-action@0.4
24+
with:
25+
docs-folder: ./
26+
27+
# Create an artifact of the html output
28+
- name: Upload artifact
29+
uses: actions/upload-artifact@v2
30+
with:
31+
name: HTML Documentation
32+
path: ./build/html/
33+
34+
# Commit changes to the gh-pages branch
35+
- name: Commit changes
36+
run: |
37+
git clone https://github.com/monkenWu/codeIgniter4-taiwan-User-Guide.git --branch gh-pages --single-branch gh-pages
38+
cp -r ./build/html/* gh-pages/
39+
cd gh-pages
40+
git config --local user.email "action@github.com"
41+
git config --local user.name "${GITHUB_ACTOR}"
42+
git add .
43+
# Ignore failures due to lack of changes
44+
git commit -m "Update User Guide" -a || true
45+
- name: Push changes
46+
uses: ad-m/github-push-action@v0.6.0
47+
with:
48+
branch: gh-pages
49+
directory: gh-pages
50+
github_token: ${{ secrets.ACCESS_TOKEN }}

‎.github/workflows/deploy-userguide-website.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
# When changes are pushed to the develop branch,
2+
# build the current version of the User Guide
3+
# with Sphinx and deploy it to the gh-pages branch.
4+
#
5+
# @todo Consolidate checkouts
6+
name: Deploy User Guide (website)
7+
8+
on:
9+
push:
10+
branches: [ master ]
11+
12+
jobs:
13+
build:
14+
name: Deploy to taiwan website
15+
# if: (github.repository == 'codeigniter4/CodeIgniter4')
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@v2
20+
21+
# Build the latest User Guide
22+
- name: Build with Sphinx
23+
uses: ammaraskar/sphinx-action@0.4
24+
with:
25+
docs-folder: ./
26+
27+
# Create an artifact of the html output
28+
- name: Upload artifact
29+
uses: actions/upload-artifact@v2
30+
with:
31+
name: HTML Documentation
32+
path: ./build/html/
33+
34+
# 壓縮產出檔案
35+
- name: Run a multi-line script
36+
run: |
37+
sudo apt-get install zip -y
38+
zip -r user_guide_deploy.zip ./build/html
39+
40+
# 透過 SSH 複製檔案
41+
- name: copy file via ssh
42+
uses: appleboy/scp-action@master
43+
with:
44+
host: ${{ secrets.SSH_KNOWN_HOSTS }}
45+
username: ${{ secrets.SSH_USERNAME }}
46+
key: ${{ secrets.SSH_PRIVATE_KEY }}
47+
port: ${{ secrets.SSH_PORT }}
48+
source: "user_guide_deploy.zip"
49+
target: "/home/cd"
50+
# 透過 SSH 執行部屬指令檔案
51+
- name: executing remote ssh commands using ssh key
52+
uses: appleboy/ssh-action@master
53+
with:
54+
host: ${{ secrets.SSH_KNOWN_HOSTS }}
55+
username: ${{ secrets.SSH_USERNAME }}
56+
key: ${{ secrets.SSH_PRIVATE_KEY }}
57+
port: ${{ secrets.SSH_PORT }}
58+
script: bash /home/cd/user_guide_deploy.sh

‎security.rst‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
##############
2+
安全性類別
3+
##############
4+
5+
安全性類別包含許多方法，有助於保護你的網站免於遭到跨站請求偽造（Cross-Site Request Forgery）攻擊。
6+
7+
.. contents::
8+
:local:
9+
:depth: 2
10+
11+
*******************
12+
載入程式庫
13+
*******************
14+
15+
如果你載入這個程式庫是為了處理 CSRF 保護，那麼你將永遠不需要載入它，因為它已作為一個過濾器運作，不需要手動操作。
16+
17+
如真的有需要直接呼叫這個類別的情況發生，你可以透過 Services 檔案載入它：
18+
19+
::
20+
21+
$security = \Config\Services::security();
22+
23+
*********************************
24+
跨站請求偽造（CSRF）
25+
*********************************
26+
27+
.. warning:: The CSRF Protection is only available for **POST/PUT/PATCH/DELETE** requests.
28+
Requests for other methods are not protected.
29+
30+
CSRF Protection Methods
31+
=======================
32+
33+
By default, the Cookie based CSRF Protection is used. It is
34+
`Double Submit Cookie <https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#double-submit-cookie>`_
35+
on OWASP Cross-Site Request Forgery Prevention Cheat Sheet.
36+
37+
You can also use Session based CSRF Protection. It is
38+
`Synchronizer Token Pattern <https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#synchronizer-token-pattern>`_.
39+
40+
You can set to use the Session based CSRF protection by editing the following config parameter value in
41+
**app/Config/Security.php**::
42+
43+
public $csrfProtection = 'session';
44+
45+
Enable CSRF Protection
46+
======================
47+
48+
你可以透過修改 **app/Config/Filters.php** 開啟 CSRF 的保護功能。並在全域啟用 `CSRF` 過濾器：
49+
50+
::
51+
52+
public $globals = [
53+
'before' => [
54+
//'honeypot'
55+
'csrf'
56+
]
57+
];
58+
59+
你所選擇的 URI 將會進入 CSRF 保護的白名單（例如：API 端點期待外部 POST 的內容）。你可以在過濾器中添加這些 URI 作為例外狀況::
60+
61+
public $globals = [
62+
'before' => [
63+
'csrf' => ['except' => ['api/record/save']]
64+
]
65+
];
66+
67+
也支援輸入正規表示式（與大小寫無關）：
68+
69+
::
70+
71+
public $globals = [
72+
'before' => [
73+
'csrf' => ['except' => ['api/record/[0-9]+']]
74+
]
75+
];
76+
77+
HTML 表單
78+
==========
79+
80+
如果你使用 :doc:`表單輔助函數 <../helpers/form_helper>`，那麼
81+
:func:`form_open()` 會自動在你的表單中插入一個隱藏的 csrf 欄位。
82+
83+
.. note:: To use auto-generation of CSRF field, you need to turn CSRF filter on to the form page.
84+
In most cases it is requested using the ``GET`` method.
85+
86+
如果沒有，你可以使用 ``csrf_token()`` 和 ``csrf_hash()`` 函數。
87+
88+
::
89+
90+
<input type="hidden" name="<?= csrf_token() ?>" value="<?= csrf_hash() ?>" />
91+
92+
此外，你可以使用 ``csrf_field()`` 方法來產生隱藏的輸入欄位::
93+
94+
// Generates: <input type="hidden" name="{csrf_token}" value="{csrf_hash}" />
95+
<?= csrf_field() ?>
96+
97+
當發送一個 JSON 請求時， CSRF 權杖也可以作為被傳遞的參數之一。
98+
下一個傳遞 CSRF 權杖的方法是一個特殊的 Http 標頭，它的名稱可以透過函數 ``csrf_header()`` 來實現。
99+
100+
此外，你可以使用 ``csrf_meta()`` 方法便捷地產生 meta 標籤::
101+
102+
// Generates: <meta name="{csrf_header}" content="{csrf_hash}" />
103+
<?= csrf_meta() ?>
104+
105+
The Order of Token Sent by Users
106+
================================
107+
108+
檢查 CSRF 權杖可用性的順序如下:
109+
110+
1. ``$_POST`` 陣列
111+
2. Http 標頭
112+
3. ``php://input`` （JSON 請求） - 請記得，這種方法是最慢的，因為我們必須先對 JSON 進行解碼，然後再進行編碼
113+
114+
Token Regeneration
115+
===================
116+
117+
權杖可以在每次提交時重新產生（預設），也可以在 CSRF cookie 整個生命週期中保持不變。預設將重新產生權杖，這將提供了更好的安全性，但也可能導致可用性問題，例如：其他權杖會變得無效（導覽歷程記錄上一頁或下一頁、多個分頁視窗、非同步操作等）。你可以透過編輯以下設定參數來改變此特性。
118+
119+
::
120+
121+
public $regenerate = true;
122+
123+
Redirection on Failure
124+
======================
125+
126+
當請求沒有通過 CSRF 驗證檢查時，預設情況下將會重新導向上一頁，你可以設定一個 ``error`` 的即時訊息，向終端使用者顯示該訊息，這提供了比瀏覽器崩潰更好的使用者體驗。這個功能可以透過編輯 **app/Config/App.php** 中的 ``$CSRFRedirect`` 值來關閉：
127+
128+
::
129+
130+
public $redirect = false;
131+
132+
即使重新導向值為 **true**，AJAX 呼叫也不會重新導向，但是會引發錯誤。
133+
134+
*********************
135+
其他實用方法
136+
*********************
137+
138+
你不需要直接使用安全性類別中大部分的方法。以下是一些與 CSRF 無關的方法。
139+
140+
**sanitizeFilename()**
141+
142+
嘗試將檔案名稱消毒，以防止「企圖遍歷目錄」和其他安全性問題，這對於經由使用者輸入所提供的檔案特別有用。第一個參數是路徑消毒。
143+
144+
如果允許使用者輸入相對路徑，例如： file/in/some/approved/folder.txt ，可以將第二個可選參數 $relative_path 傳入 true。
145+
146+
::
147+
148+
$path = $security->sanitizeFilename($request->getVar('filepath'));

‎source/changelogs/index.rst‎

Lines changed: 24 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -10,25 +10,28 @@ Version |version|
1010
See all the changes.
1111

1212
.. toctree::
13-
:titlesonly:
13+
:titlesonly:
1414

15-
v4.1.2
16-
v4.1.1
17-
v4.1.0
18-
v4.0.5
19-
v4.0.4
20-
v4.0.3
21-
v4.0.0
22-
v4.0.0-rc.4
23-
v4.0.0-rc.3
24-
v4.0.0-rc.2
25-
v4.0.0-rc.1
26-
v4.0.0-beta.4
27-
v4.0.0-beta.3
28-
v4.0.0-beta.2
29-
v4.0.0-beta.1
30-
v4.0.0-alpha.5
31-
v4.0.0-alpha.4
32-
v4.0.0-alpha.3
33-
v4.0.0-alpha.2
34-
v4.0.0-alpha.1
15+
v4.1.5
16+
v4.1.4
17+
v4.1.3
18+
v4.1.2
19+
v4.1.1
20+
v4.1.0
21+
v4.0.5
22+
v4.0.4
23+
v4.0.3
24+
v4.0.0
25+
v4.0.0-rc.4
26+
v4.0.0-rc.3
27+
v4.0.0-rc.2
28+
v4.0.0-rc.1
29+
v4.0.0-beta.4
30+
v4.0.0-beta.3
31+
v4.0.0-beta.2
32+
v4.0.0-beta.1
33+
v4.0.0-alpha.5
34+
v4.0.0-alpha.4
35+
v4.0.0-alpha.3
36+
v4.0.0-alpha.2
37+
v4.0.0-alpha.1

‎source/changelogs/v4.1.3.rst‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
Version 4.1.3
2+
=============
3+
4+
Release Date: June 6, 2021
5+
6+
**4.1.3 release of CodeIgniter4**
7+
8+
Enhancements:
9+
10+
- New functions in the File Helper: ``directory_mirror()`` and ``same_file()``
11+
- Implemented NexusPHP's ``Tachycardia`` for slow test identification
12+
- Added a new ``$ttl`` option to ``Cache`` config for future use
13+
14+
Changes:
15+
16+
- Added MySQL 8.0 to the test matrix
17+
- Improved environment detection from ``$_SERVER``
18+
- Numerous sweeping code improvements via Rector and analysis
19+
20+
Bugs Fixed:
21+
22+
- Fixed a bug where ``CURLRequest`` would try to use a project URI instead of its base
23+
- Fixed a bug where CLI mode was not detected under ``cgi-fcgi``
24+
- Fixed a logic bug in Cookie construction
25+
- Fixed numerous issues in SQLite3's ``Forge`` class related to an incorrect attribute name

‎source/changelogs/v4.1.4.rst‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
Version 4.1.4
2+
=============
3+
4+
Release Date: September 6, 2021
5+
6+
**4.1.4 release of CodeIgniter4**
7+
8+
This release focuses on code style. All changes (except those noted below) are cosmetic to bring the code in line with the new
9+
`CodeIgniter Coding Standard <https://github.com/CodeIgniter/coding-standard>`_ (based on PSR-12).
10+
11+
Breaking Changes:
12+
13+
- The following methods were changed from "public" to "protected" to match their parent class methods and better align with their uses:
14+
15+
* ``CodeIgniter\Database\MySQLi\Connection::execute()``
16+
* ``CodeIgniter\Database\MySQLi\Connection::_fieldData()``
17+
* ``CodeIgniter\Database\MySQLi\Connection::_indexData()``
18+
* ``CodeIgniter\Database\MySQLi\Connection::_foreignKeyData()``
19+
* ``CodeIgniter\Database\Postgre\Builder::_like_statement()``
20+
* ``CodeIgniter\Database\Postgre\Connection::execute()``
21+
* ``CodeIgniter\Database\Postgre\Connection::_fieldData()``
22+
* ``CodeIgniter\Database\Postgre\Connection::_indexData()``
23+
* ``CodeIgniter\Database\Postgre\Connection::_foreignKeyData()``
24+
* ``CodeIgniter\Database\SQLSRV\Connection::execute()``
25+
* ``CodeIgniter\Database\SQLSRV\Connection::_fieldData()``
26+
* ``CodeIgniter\Database\SQLSRV\Connection::_indexData()``
27+
* ``CodeIgniter\Database\SQLSRV\Connection::_foreignKeyData()``
28+
* ``CodeIgniter\Database\SQLite3\Connection::execute()``
29+
* ``CodeIgniter\Database\SQLite3\Connection::_fieldData()``
30+
* ``CodeIgniter\Database\SQLite3\Connection::_indexData()``
31+
* ``CodeIgniter\Database\SQLite3\Connection::_foreignKeyData()``
32+
* ``CodeIgniter\Images\Handlers\GDHandler::_flatten()``
33+
* ``CodeIgniter\Images\Handlers\GDHandler::_flip()``
34+
* ``CodeIgniter\Images\Handlers\ImageMagickHandler::_flatten()``
35+
* ``CodeIgniter\Images\Handlers\ImageMagickHandler::_flip()``
36+
* ``CodeIgniter\Test\Mock\MockIncomingRequest::detectURI()``
37+
* ``CodeIgniter\Test\Mock\MockSecurity.php::sendCookie()``
38+
39+
- To be compatible with the strict inheritance checks of PHP 8.1, the following method signatures were added return types to match their parents' signatures whenever possible:
40+
41+
* ``CodeIgniter\Cookie\Cookie::offsetExists()``
42+
* ``CodeIgniter\Cookie\Cookie::offsetSet()``
43+
* ``CodeIgniter\Cookie\Cookie::offsetUnset()``
44+
* ``CodeIgniter\Cookie\CookieStore::getIterator()``
45+
* ``CodeIgniter\I18n\Time::__wakeup()``
46+
* ``CodeIgniter\Test\Filters\CITestStreamFilter::filter()``
47+
48+
- Related to the strict inheritance checks of PHP 8.1, the following session handlers implementing ``SessionHandlerInterface`` have their public methods modified to match the interface:
49+
50+
* ``CodeIgniter\Session\Handlers\ArrayHandler``
51+
* ``CodeIgniter\Session\Handlers\DatabaseHandler``
52+
* ``CodeIgniter\Session\Handlers\FileHandler``
53+
* ``CodeIgniter\Session\Handlers\MemcachedHandler``
54+
* ``CodeIgniter\Session\Handlers\RedisHandler``

0 commit comments

Comments
 (0)