How to XSS filtering variable? - codeigniter

I'm using Codeigniter 2.1.3 with Friendly URL (.htaccess).
In Controller:
public function confirm($key) {
var_dump($this->input->get());
}
But link _http://site.com/confirm/12345 returns "boolean false".
How to enable Query strings in URL, or how to filtering $key ?
My .htaccess:
RewriteEngine on
RewriteCond $1 !^(index\.php|robots\.txt|files|templates)
RewriteRule ^(.*)$ /index.php?/$1 [L]

You receive key as the function argument, so you can do this:
public function confirm($key) {
echo $key;
}
http://site.com/confirm/12345 will echo 12345.
Filtering of characters in this can be done via $config['permitted_uri_chars'] in config.php.
If you want to receive it as a GET parameter and want to perform XSS filtering on it, the URL needs to be
http://site.com/confirm?key=12345 and in your controller
public function confirm() {
echo $this->input->get('key', TRUE); // true implies XSS filtering
}
The second method requires $config['enable_query_strings'] to be set to TRUE.

Related

Why can't I proceed to login page?

This is the only thing that i can see on my computer at the address http://localhost/onlineExam/login/validate_credentials
Object not found!
The requested URL was not found on this server. The link on the referring page seems to be wrong or outdated. Please inform the author of that page about the error.
If you think this is a server error, please contact the webmaster.
Error 404
localhost
Apache/2.4.39 (Win64) OpenSSL/1.1.1c PHP/7.3.7
class Login extends CI_Controller
{
function index()
{
$data['main_content'] = 'login_form';
$this->load->view('includes/templates', $data);
}
function validate_credentials(){
$this->load->model('user_model');
$query = $this->user_model->validate();
if($query)// if the user's credentials validated...
{
$data = array(
'username' => $this->input->post('username'), 'is_logged_in' => true
);
$this->session->set_userdata($data);
redirect('site/users_area');
}
else{
$this->index();
$data['error'] = 'Invalid Username or Password';
$data['main_content'] = 'login_form';
$this->load->view('includes/templates', $data);
}
}
}
Please check .htaccess file is present in the root folder, that is 'onlineExam' as per your URL.
If not present, create/update with this lines:
RewriteEngine On
RewriteBase /onlineExam/
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1 [L]
After that, also check base_url at onlineExam/application/config/config.php
$config['base_url'] = 'http://localhost/onlineExam';
This could be a number of things
1) As Stated above you need to make sure a htaccess file is present in the root of your project folder
2) If your htaccess file isn't removing the index.php part of your URL then your link would not be
http://localhost/onlineExam/login/validate_credentials
but rather
http://localhost/onlineExam/index.php/login/validate_credentials
3) Make sure your filename is the same as your class name. At times too case sensitive operating system may affect your files. Login.php != login.php (This is a rare case and happened to older version of some OS')

Laravel 5.4 route wildcards

I was wondering how to create URL's in Laravel, without any prefix.
For Example:
How to transform following URL:
http://www.example.com/posts/some-post
To this URL:
http://www.example.com/some-post
I know this can be done as:
Route::any('/{slug}', function($slug) {
$page = App\Models\Page::firstByAttributes(['slug' => $slug]);
if($page) {
return Redirect::action('pagesController#find', array($page));
}
})->where('slug', '.*');
But for above code I've to maintain all unique slugs for each URL.
Any other way to do this right?
Thanks.
If you want to do it with Laravel:
Routes
Route::get('posts/{slug}', function($slug) {
// Does a 302 redirect, and the route below will handle it
return redirect($slug);
});
Route::get('{slug}', 'pagesController#find');
Controller
public function find($slug) {
$page = App\Models\Page::where('slug', $slug);
// ... your code
// ...
// return view('something', ['page' => $page]);
}
The redirection you describe can be easily done with an Apache rewrite rule, before you hit the application layer, which should be much more efficient. Eg, assuming Apache is set up to allow redirects from .htaccess, the following should be enough:
RewriteEngine On
RewriteRule ^posts/(.*) /$1 [R=301, L]
The R=301 indicates the redirect should happen with a 301 http response code, which will preserve your page rank etc.

Second url parameter is returning php error

There is no problem when I enter the first parameter but when I enter the second parameter I get the error I mentioned below
.htaccess
RewriteEngine on
RewriteCond $1 !^(index\\.php|resources|robots\\.txt)
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1 [L,QSA]
I enter this url: www.domain.com/first-parameter/second-parameter
Returned Error:
A PHP Error was encountered
Severity: Error
Message: Call to undefined function base_url()
Filename: _inc/_head.php
Line Number: 4
Backtrace:
routes.php
/*Ayarlar*/
$route['default_controller'] = 'Home';
$route['404_override'] = '';
/*Ayarlar*/
$route['(:any)'] = 'Home/index/$1';
$route['translate_uri_dashes'] = true;
I enter this url: www.domain.com/first-parameter/second-parameter
Example Local Url: http://localhost/sicacik-yemek-tarifleri-mobile/bilgi/assadad/asasad
controllers/Home.php
class Home extends public_Controller {
public function __construct()
{
parent::__construct();
}
public function index($s1='')
{
if(!empty($s1)){
if (!empty($data['anakategori'])) {
$this->load->view('example',$data);
} elseif (!empty($data['altkategori'])) {
$this->load->view('example',$data);
}elseif(!empty($data['tarif'])){
$this->load->view('example',$data);
} elseif(!empty($kacKalori)){
$this->load->view('example',$data);
}else{
show_404();
}
}else{
$this->load->view('Home',$data);
}
}
}
Don't post images instead of code. Code is used to be copied finding solution in more convinient/easier way.
First this (Important in RED on user guide):
The reserved routes must come before any wildcard or regular expression routes.
so your $route['translate_uri_dashes'] = true; has to be in different place.
Check default file to determine where to put it.
Also,
Routes will run in the order they are defined. Higher routes will always take precedence over lower ones.
so you have to reorder last two
$route['soru-cevap/(:any)/(:any)'] = 'soru_cevap/index/$1/$2'; //this one is more specific one
$route['soru-cevap/(:any)'] = 'soru_cevap/index/$1';
//Take a look of controller and method names.
//Ones with dashes probably won't work.
You need to include $route['(:any)/(:any)'] = 'Home/index/$1/$2'; line in route.php
For www.domain.com/first-parameter/second-parameter url.

how to forced https instead of http after user login in zend framework2

I want user redirect to https insetad of http just after login in my new website made in zend framework2. please help.
I there any method available in zend freamework2 to get current used protocol(http or https).
You can redirect the user to the https version of a page inside the application. Above solution simply redirects all requests to it's http variant, and only for Apache. I would rather do it inside the application (then you're more in control) and make it server agnostic (what happens when you switch to nginx?)
An example is based on an answer I gave earlier here: ZF2 and force HTTPS for specific routes
The solution: create a controller plugin which you can call every time you need it.
Specify the pages you need to force a redirect (i.e. the page you show the login form):
use Zend\Http\Response;
public function loginAction()
{
// If return value is response, this means the user will be redirected
$result = $this->forceHttps();
if ($result instanceof Response) {
return $result;
}
// code here
}
And then you could create a controller plugin (call it ForceHttps) to return a response when the user should be redirected:
use Zend\Uri\Http as HttpUri;
class ForceHttps extends AbstractPlugin
{
public function __invoke()
{
$request = $this->getController()->getRequest();
if ('https' === $request->getUri()->getScheme()) {
return;
}
// Not secure, create full url
$plugin = $this->getController()->url();
$string = $plugin->fromRoute(null, array(), array(
'force_canonical' => true,
), true);
$url = new HttpUri($string);
$url->setScheme('https');
return $this->getController()->redirect()->toUrl($url);
}
}
What happens is
Check if the current scheme is https. If not, continue
Grab the current used url from the url() plugin, use the current route name (hence the first parameter is null), force the canonical version (i.e. with a full scheme and domain name) and reuse the current route match parameters (the true as last parameter).
Import the url (as a string) in the Zend\Url\Http object
Reset the scheme to the https version
Pass the url to the redirect plugin to grab a response which will perform the redirect
on your .htaccess write these rules
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.yoursite.com/$1 [R=301,L]
RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ public/index.php [NC,L]
note that public/index.php is the root so you have to modify it and www.yoursite.com too
for logged-in user you have to do with php
$auth = Zend_Auth::getInstance();
if($auth->hasIdentity()) {//redirection should be here//}

Dynamic CMS pages and static pages CodeIgniter

I'm using Codeigniter 2, and i have some dynamic pages (CMS) which are created from the back office and have the page name as ID . And some pages are static , there is a example :
Dynamic pages :
www.domain.com/privacy
www.domain.com/about
and static page :
www.domain.com/invitation
So the question is how can route this pages : i tried to use :
$route['([a-z0-9\-]+)'] = 'home/cms/$1';
But it gives me 404 for static pages ( www.domain.com/invitation )
Any help and thank you in advance
You can either explicitly remove the static files from the redirection in your .htaccess file:
RewriteEngine on
RewriteCond $1 !^(invitation\.php|index\.php|images|robots\.txt)
RewriteRule ^(.*)$ /index.php/$1 [L]
or, you can use the _remap function. Inside the _remap function, you would check for existence of a physical file for your "method" - if there, load it - if not, route to the controller method:
public function _remap($method, $params = array())
{
$filepath = BASEPATH.$method.".php";
if (file_exists($filepath))
{
include($filepath);
return;
}
else if (method_exists($this, $method))
{
return call_user_func_array(array($this, $method), $params);
}
else
{
show_404();
}
}

Resources