diff --git a/.github/workflows/deptrac.yml b/.github/workflows/deptrac.yml
index ebaf4df..f90b4b7 100644
--- a/.github/workflows/deptrac.yml
+++ b/.github/workflows/deptrac.yml
@@ -20,4 +20,4 @@ on:
jobs:
deptrac:
- uses: codeigniter4/.github/.github/workflows/deptrac.yml@main
+ uses: codeigniter4/.github/.github/workflows/deptrac.yml@CI45
diff --git a/.github/workflows/infection.yml b/.github/workflows/infection.yml
index bc1d813..4176eb3 100644
--- a/.github/workflows/infection.yml
+++ b/.github/workflows/infection.yml
@@ -12,4 +12,4 @@ on:
jobs:
infection:
- uses: codeigniter4/.github/.github/workflows/infection.yml@main
+ uses: codeigniter4/.github/.github/workflows/infection.yml@CI45
diff --git a/.github/workflows/phpcpd.yml b/.github/workflows/phpcpd.yml
index 8ef9e2f..cf06b52 100644
--- a/.github/workflows/phpcpd.yml
+++ b/.github/workflows/phpcpd.yml
@@ -16,6 +16,6 @@ on:
jobs:
phpcpd:
- uses: codeigniter4/.github/.github/workflows/phpcpd.yml@main
+ uses: codeigniter4/.github/.github/workflows/phpcpd.yml@CI45
with:
dirs: "src/ tests/"
diff --git a/.github/workflows/phpcsfixer.yml b/.github/workflows/phpcsfixer.yml
index ee1221a..d69637a 100644
--- a/.github/workflows/phpcsfixer.yml
+++ b/.github/workflows/phpcsfixer.yml
@@ -16,4 +16,4 @@ on:
jobs:
phpcsfixer:
- uses: codeigniter4/.github/.github/workflows/phpcsfixer.yml@main
+ uses: codeigniter4/.github/.github/workflows/phpcsfixer.yml@CI45
diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml
index 58e2add..a768f3c 100644
--- a/.github/workflows/phpstan.yml
+++ b/.github/workflows/phpstan.yml
@@ -20,4 +20,4 @@ on:
jobs:
phpstan:
- uses: codeigniter4/.github/.github/workflows/phpstan.yml@main
+ uses: codeigniter4/.github/.github/workflows/phpstan.yml@CI45
diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
index 9bcd5ec..cb05edd 100644
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -20,4 +20,4 @@ on:
jobs:
phpunit:
- uses: codeigniter4/.github/.github/workflows/phpunit.yml@main
+ uses: codeigniter4/.github/.github/workflows/phpunit.yml@CI45
diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml
index 53c76e7..cdbf1fa 100644
--- a/.github/workflows/psalm.yml
+++ b/.github/workflows/psalm.yml
@@ -20,4 +20,4 @@ on:
jobs:
psalm:
- uses: codeigniter4/.github/.github/workflows/psalm.yml@main
+ uses: codeigniter4/.github/.github/workflows/psalm.yml@CI45
diff --git a/.github/workflows/rector.yml b/.github/workflows/rector.yml
index 8c19b16..c44a709 100644
--- a/.github/workflows/rector.yml
+++ b/.github/workflows/rector.yml
@@ -20,4 +20,4 @@ on:
jobs:
rector:
- uses: codeigniter4/.github/.github/workflows/rector.yml@main
+ uses: codeigniter4/.github/.github/workflows/rector.yml@CI45
diff --git a/.github/workflows/unused.yml b/.github/workflows/unused.yml
index 1758dda..137a0dc 100644
--- a/.github/workflows/unused.yml
+++ b/.github/workflows/unused.yml
@@ -18,4 +18,4 @@ on:
jobs:
unused:
- uses: codeigniter4/.github/.github/workflows/unused.yml@main
+ uses: codeigniter4/.github/.github/workflows/unused.yml@CI45
diff --git a/app/.htaccess b/app/.htaccess
index f24db0a..3462048 100644
--- a/app/.htaccess
+++ b/app/.htaccess
@@ -1,6 +1,6 @@
- Require all denied
+ Require all denied
- Deny from all
+ Deny from all
diff --git a/app/Config/App.php b/app/Config/App.php
index 6ae6786..b761da7 100644
--- a/app/Config/App.php
+++ b/app/Config/App.php
@@ -14,7 +14,7 @@ class App extends BaseConfig
* URL to your CodeIgniter root. Typically, this will be your base URL,
* WITH a trailing slash:
*
- * http://example.com/
+ * E.g., http://example.com/
*/
public string $baseURL = 'http://localhost:8080/';
@@ -22,10 +22,10 @@ class App extends BaseConfig
* Allowed Hostnames in the Site URL other than the hostname in the baseURL.
* If you want to accept multiple Hostnames, set this.
*
- * E.g. When your site URL ($baseURL) is 'http://example.com/', and your site
- * also accepts 'http://media.example.com/' and
- * 'http://accounts.example.com/':
- * ['media.example.com', 'accounts.example.com']
+ * E.g.,
+ * When your site URL ($baseURL) is 'http://example.com/', and your site
+ * also accepts 'http://media.example.com/' and 'http://accounts.example.com/':
+ * ['media.example.com', 'accounts.example.com']
*
* @var list
*/
@@ -36,9 +36,9 @@ class App extends BaseConfig
* Index File
* --------------------------------------------------------------------------
*
- * Typically this will be your index.php file, unless you've renamed it to
- * something else. If you are using mod_rewrite to remove the page set this
- * variable so that it is blank.
+ * Typically, this will be your `index.php` file, unless you've renamed it to
+ * something else. If you have configured your web server to remove this file
+ * from your site URIs, set this variable to an empty string.
*/
public string $indexPage = 'index.php';
@@ -48,17 +48,41 @@ class App extends BaseConfig
* --------------------------------------------------------------------------
*
* This item determines which server global should be used to retrieve the
- * URI string. The default setting of 'REQUEST_URI' works for most servers.
+ * URI string. The default setting of 'REQUEST_URI' works for most servers.
* If your links do not seem to work, try one of the other delicious flavors:
*
- * 'REQUEST_URI' Uses $_SERVER['REQUEST_URI']
- * 'QUERY_STRING' Uses $_SERVER['QUERY_STRING']
- * 'PATH_INFO' Uses $_SERVER['PATH_INFO']
+ * 'REQUEST_URI': Uses $_SERVER['REQUEST_URI']
+ * 'QUERY_STRING': Uses $_SERVER['QUERY_STRING']
+ * 'PATH_INFO': Uses $_SERVER['PATH_INFO']
*
* WARNING: If you set this to 'PATH_INFO', URIs will always be URL-decoded!
*/
public string $uriProtocol = 'REQUEST_URI';
+ /*
+ |--------------------------------------------------------------------------
+ | Allowed URL Characters
+ |--------------------------------------------------------------------------
+ |
+ | This lets you specify which characters are permitted within your URLs.
+ | When someone tries to submit a URL with disallowed characters they will
+ | get a warning message.
+ |
+ | As a security measure you are STRONGLY encouraged to restrict URLs to
+ | as few characters as possible.
+ |
+ | By default, only these are allowed: `a-z 0-9~%.:_-`
+ |
+ | Set an empty string to allow all characters -- but only if you are insane.
+ |
+ | The configured value is actually a regular expression character group
+ | and it will be used as: '/\A[]+\z/iu'
+ |
+ | DO NOT CHANGE THIS UNLESS YOU FULLY UNDERSTAND THE REPERCUSSIONS!!
+ |
+ */
+ public string $permittedURIChars = 'a-z 0-9~%.:_\-';
+
/**
* --------------------------------------------------------------------------
* Default Locale
@@ -94,7 +118,7 @@ class App extends BaseConfig
*
* IncomingRequest::setLocale() also uses this list.
*
- * @var string[]
+ * @var list
*/
public array $supportedLocales = ['en'];
@@ -106,7 +130,8 @@ class App extends BaseConfig
* The default timezone that will be used in your application to display
* dates with the date helper, and can be retrieved through app_timezone()
*
- * @see https://www.php.net/manual/en/timezones.php for list of timezones supported by PHP.
+ * @see https://www.php.net/manual/en/timezones.php for list of timezones
+ * supported by PHP.
*/
public string $appTimezone = 'UTC';
@@ -130,7 +155,7 @@ class App extends BaseConfig
* If true, this will force every request made to this application to be
* made via a secure connection (HTTPS). If the incoming request is not
* secure, the user will be redirected to a secure version of the page
- * and the HTTP Strict Transport Security header will be set.
+ * and the HTTP Strict Transport Security (HSTS) header will be set.
*/
public bool $forceGlobalSecureRequests = false;
diff --git a/app/Config/Autoload.php b/app/Config/Autoload.php
index 7a4602d..76cd926 100644
--- a/app/Config/Autoload.php
+++ b/app/Config/Autoload.php
@@ -30,22 +30,17 @@ class Autoload extends AutoloadConfig
* their location on the file system. These are used by the autoloader
* to locate files the first time they have been instantiated.
*
- * The '/app' and '/system' directories are already mapped for you.
- * you may change the name of the 'App' namespace if you wish,
+ * The 'Config' (APPPATH . 'Config') and 'CodeIgniter' (SYSTEMPATH) are
+ * already mapped for you.
+ *
+ * You may change the name of the 'App' namespace if you wish,
* but this should be done prior to creating any namespaced classes,
* else you will need to modify all of those classes for this to work.
*
- * Prototype:
- * $psr4 = [
- * 'CodeIgniter' => SYSTEMPATH,
- * 'App' => APPPATH
- * ];
- *
* @var array|string>
*/
public $psr4 = [
- APP_NAMESPACE => APPPATH, // For custom app namespace
- 'Config' => APPPATH . 'Config',
+ APP_NAMESPACE => APPPATH,
];
/**
diff --git a/app/Config/Boot/production.php b/app/Config/Boot/production.php
index 73c7c60..1822cf5 100644
--- a/app/Config/Boot/production.php
+++ b/app/Config/Boot/production.php
@@ -9,8 +9,10 @@
|
| If you set 'display_errors' to '1', CI4's detailed error report will show.
*/
+error_reporting(E_ALL & ~E_DEPRECATED);
+// If you want to suppress more types of errors.
+// error_reporting(E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT & ~E_USER_NOTICE & ~E_USER_DEPRECATED);
ini_set('display_errors', '0');
-error_reporting(E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT & ~E_USER_NOTICE & ~E_USER_DEPRECATED);
/*
|--------------------------------------------------------------------------
diff --git a/app/Config/Cache.php b/app/Config/Cache.php
index b5b2cdc..3fbade6 100644
--- a/app/Config/Cache.php
+++ b/app/Config/Cache.php
@@ -46,25 +46,6 @@ class Cache extends BaseConfig
*/
public string $storePath = WRITEPATH . 'cache/';
- /**
- * --------------------------------------------------------------------------
- * Cache Include Query String
- * --------------------------------------------------------------------------
- *
- * Whether to take the URL query string into consideration when generating
- * output cache files. Valid options are:
- *
- * false = Disabled
- * true = Enabled, take all query parameters into account.
- * Please be aware that this may result in numerous cache
- * files generated for the same page over and over again.
- * ['q'] = Enabled, but only take into account the specified list
- * of query parameters.
- *
- * @var bool|string[]
- */
- public $cacheQueryString = false;
-
/**
* --------------------------------------------------------------------------
* Key Prefix
@@ -168,4 +149,23 @@ class Cache extends BaseConfig
'redis' => RedisHandler::class,
'wincache' => WincacheHandler::class,
];
+
+ /**
+ * --------------------------------------------------------------------------
+ * Web Page Caching: Cache Include Query String
+ * --------------------------------------------------------------------------
+ *
+ * Whether to take the URL query string into consideration when generating
+ * output cache files. Valid options are:
+ *
+ * false = Disabled
+ * true = Enabled, take all query parameters into account.
+ * Please be aware that this may result in numerous cache
+ * files generated for the same page over and over again.
+ * ['q'] = Enabled, but only take into account the specified list
+ * of query parameters.
+ *
+ * @var bool|list
+ */
+ public $cacheQueryString = false;
}
diff --git a/app/Config/ContentSecurityPolicy.php b/app/Config/ContentSecurityPolicy.php
index 7799c47..2ac41a7 100644
--- a/app/Config/ContentSecurityPolicy.php
+++ b/app/Config/ContentSecurityPolicy.php
@@ -45,28 +45,28 @@ class ContentSecurityPolicy extends BaseConfig
/**
* Will default to self if not overridden
*
- * @var string|string[]|null
+ * @var list|string|null
*/
public $defaultSrc;
/**
* Lists allowed scripts' URLs.
*
- * @var string|string[]
+ * @var list|string
*/
public $scriptSrc = 'self';
/**
* Lists allowed stylesheets' URLs.
*
- * @var string|string[]
+ * @var list|string
*/
public $styleSrc = 'self';
/**
* Defines the origins from which images can be loaded.
*
- * @var string|string[]
+ * @var list|string
*/
public $imageSrc = 'self';
@@ -75,14 +75,14 @@ class ContentSecurityPolicy extends BaseConfig
*
* Will default to self if not overridden
*
- * @var string|string[]|null
+ * @var list|string|null
*/
public $baseURI;
/**
* Lists the URLs for workers and embedded frame contents
*
- * @var string|string[]
+ * @var list|string
*/
public $childSrc = 'self';
@@ -90,21 +90,21 @@ class ContentSecurityPolicy extends BaseConfig
* Limits the origins that you can connect to (via XHR,
* WebSockets, and EventSource).
*
- * @var string|string[]
+ * @var list|string
*/
public $connectSrc = 'self';
/**
* Specifies the origins that can serve web fonts.
*
- * @var string|string[]
+ * @var list|string
*/
public $fontSrc;
/**
* Lists valid endpoints for submission from `