EllisLab/CodeIgniter — pull request #791 by MidnightHack (2011-12-16 23:26:03+00:00)
Title: fixing cookie problem : issues #33

hello,
I fixed issues #33 by modifying :
system/core/Input.php:: _clean_input_keys function to :

function _clean_input_keys($str , $cookie = false)
{
if ( ! preg_match("/^[a-z0-9:_\/-]+$/i", $str))
{
//if $cookie true will unset it
if($cookie)
{
unset($_COOKIE[$str]);
}
else
{
exit('Disallowed Key Characters.');
}
}

and system/core/Input.php:: _clean_input_data function to :

function _clean_input_data($str, $cookie = false)
{
if (is_array($str))
{
$new_array = array();
foreach ($str as $key => $val)
{
$new_array[$this->_clean_input_keys($key, $cookie)] = $this->_clean_input_data($val, $cookie);
}
return $new_array;
}

/* We strip slashes if magic quotes is on to keep things consistent

NOTE: In PHP 5.4 get_magic_quotes_gpc() will always return 0 and
it will probably not exist in future versions at all.
*/
if ( ! is_php('5.4') && get_magic_quotes_gpc())
{
$str = stripslashes($str);
}

// Clean UTF-8 if supported
if (UTF8_ENABLED === TRUE)
{
$str = $this->uni->clean_string($str);
}

// Remove control characters
$str = remove_invisible_characters($str);

// Should we filter the input data?
if ($this->_enable_xss === TRUE)
{
$str = $this->security->xss_clean($str);
}

// Standardize newlines if needed
if ($this->_standardize_newlines == TRUE)
{
if (strpos($str, "\r") !== FALSE)
{
$str = str_replace(array("\r\n", "\r", "\r\n\n"), PHP_EOL, $str);
}
}

return $str;
}

and at the end

line 511 : $_COOKIE[$this->_clean_input_keys($key)] = $this->_clean_input_data($val);
to : $_COOKIE[$this->_clean_input_keys($key,true)] = $this->_clean_input_data($val, true);

the new "Input.php" :https://github.com/MidnightHack/CodeIgniter/blob/develop/system/core/Input.php