fix: filter except empty by kenjis · Pull Request #7823 · codeigniter4/CodeIgniter4

kenjis · 2023-08-15T10:43:11Z

This PR changes the behavior:

['except' => []] means to exclude nothing.
['except' => ''] means to exclude baseURL only.
- because the URI string '' means the URI path for the baseURL.
- when navigating to the baseURL, uri_string() returns ''.

['except' => []] or ['except' => ''] means "except all" in the current code.
This behavior is unexpected, and not good for security.

If a dev comments out all items in except key accidentally, the filter will be disabled.

['except' => [
// 'foo/*',// 'bar/*',
]]

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

neznaika0

Thanks

kenjis · 2023-08-15T11:04:04Z

Strictly speaking, this may be a breaking change. However, it does not appear that any developer would want to disable the filter by specifying an empty array or empty string.

If there is, it would be a case of specifying them by mistake and not realizing that the filter is disabled.

datamweb · 2023-08-15T11:11:11Z

want to disable the filter by specifying an empty array or empty string

I agree that this should not be the behavior.
But the question is what if for any reason the developer wants to except all 15 minutes altogether?
I think it should be something like the following to "except all".

['except' => [
'*',
]];
// or
['except' => '*' ];

kenjis · 2023-08-15T11:14:54Z

@datamweb'*' or ['*'] works.
See https://github.com/codeigniter4/CodeIgniter4/pull/7823/files#diff-ae159768f526f66aeb6af1c17c64b57f36659a0d795530b3014a5ded5cbd6176R221

neznaika0 · 2023-08-15T11:16:31Z

Ha, it's wrong, but it will work. To exclude everyone, you need to remove the filter. There is no logic to enable the filter and disable it by rules

datamweb · 2023-08-15T11:34:14Z

exclude everyone, you need to remove the filter.

I was considering the implementation with the Settings package.

It looks good to me.

This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis · 2023-08-16T04:38:36Z

The URI string '' means the URI path for the baseURL.
It has the same meaning as /.
So ['except' => ''] should mean to exclude the baseURL only.

I changed that way.

MGatner

I agree this is a good fix for a common "gotcha"

kenjis · 2023-08-15T10:43:11Z

Description
See #7822 (comment)

This PR changes the behavior:

['except' => []] means to exclude nothing.
['except' => ''] means to exclude baseURL only.
- because the URI string '' means the URI path for the baseURL.
- when navigating to the baseURL, uri_string() returns ''.

['except' => []] or ['except' => ''] means "except all" in the current code.
This behavior is unexpected, and not good for security.

If a dev comments out all items in except key accidentally, the filter will be disabled.

['except' => [
// 'foo/*',// 'bar/*',
]]

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

neznaika0

Thanks

kenjis · 2023-08-15T11:04:04Z

Strictly speaking, this may be a breaking change. However, it does not appear that any developer would want to disable the filter by specifying an empty array or empty string.

If there is, it would be a case of specifying them by mistake and not realizing that the filter is disabled.

datamweb · 2023-08-15T11:11:11Z

want to disable the filter by specifying an empty array or empty string

I agree that this should not be the behavior.
But the question is what if for any reason the developer wants to except all 15 minutes altogether?
I think it should be something like the following to "except all".

['except' => [
'*',
]];
// or
['except' => '*' ];

kenjis · 2023-08-15T11:14:54Z

@datamweb'*' or ['*'] works.
See https://github.com/codeigniter4/CodeIgniter4/pull/7823/files#diff-ae159768f526f66aeb6af1c17c64b57f36659a0d795530b3014a5ded5cbd6176R221

neznaika0 · 2023-08-15T11:16:31Z

Ha, it's wrong, but it will work. To exclude everyone, you need to remove the filter. There is no logic to enable the filter and disable it by rules

datamweb · 2023-08-15T11:34:14Z

exclude everyone, you need to remove the filter.

I was considering the implementation with the Settings package.

It looks good to me.

This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis · 2023-08-16T04:38:36Z

The URI string '' means the URI path for the baseURL.
It has the same meaning as /.
So ['except' => ''] should mean to exclude the baseURL only.

I changed that way.

MGatner

I agree this is a good fix for a common "gotcha"

kenjis · 2023-08-15T10:43:11Z

Description
See #7822 (comment)

This PR changes the behavior:

['except' => []] means to exclude nothing.
['except' => ''] means to exclude baseURL only.
- because the URI string '' means the URI path for the baseURL.
- when navigating to the baseURL, uri_string() returns ''.

['except' => []] or ['except' => ''] means "except all" in the current code.
This behavior is unexpected, and not good for security.

If a dev comments out all items in except key accidentally, the filter will be disabled.

['except' => [
// 'foo/*',// 'bar/*',
]]

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

neznaika0

Thanks

kenjis · 2023-08-15T11:04:04Z

Strictly speaking, this may be a breaking change. However, it does not appear that any developer would want to disable the filter by specifying an empty array or empty string.

If there is, it would be a case of specifying them by mistake and not realizing that the filter is disabled.

datamweb · 2023-08-15T11:11:11Z

want to disable the filter by specifying an empty array or empty string

I agree that this should not be the behavior.
But the question is what if for any reason the developer wants to except all 15 minutes altogether?
I think it should be something like the following to "except all".

['except' => [
'*',
]];
// or
['except' => '*' ];

kenjis · 2023-08-15T11:14:54Z

@datamweb'*' or ['*'] works.
See https://github.com/codeigniter4/CodeIgniter4/pull/7823/files#diff-ae159768f526f66aeb6af1c17c64b57f36659a0d795530b3014a5ded5cbd6176R221

neznaika0 · 2023-08-15T11:16:31Z

Ha, it's wrong, but it will work. To exclude everyone, you need to remove the filter. There is no logic to enable the filter and disable it by rules

datamweb · 2023-08-15T11:34:14Z

exclude everyone, you need to remove the filter.

I was considering the implementation with the Settings package.

It looks good to me.

This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis · 2023-08-16T04:38:36Z

The URI string '' means the URI path for the baseURL.
It has the same meaning as /.
So ['except' => ''] should mean to exclude the baseURL only.

I changed that way.

MGatner

I agree this is a good fix for a common "gotcha"

kenjis · 2023-08-15T10:43:11Z

Description
See #7822 (comment)

This PR changes the behavior:

['except' => []] means to exclude nothing.
['except' => ''] means to exclude baseURL only.
- because the URI string '' means the URI path for the baseURL.
- when navigating to the baseURL, uri_string() returns ''.

['except' => []] or ['except' => ''] means "except all" in the current code.
This behavior is unexpected, and not good for security.

If a dev comments out all items in except key accidentally, the filter will be disabled.

['except' => [
// 'foo/*',// 'bar/*',
]]

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

neznaika0

Thanks

kenjis · 2023-08-15T11:04:04Z

Strictly speaking, this may be a breaking change. However, it does not appear that any developer would want to disable the filter by specifying an empty array or empty string.

If there is, it would be a case of specifying them by mistake and not realizing that the filter is disabled.

datamweb · 2023-08-15T11:11:11Z

want to disable the filter by specifying an empty array or empty string

I agree that this should not be the behavior.
But the question is what if for any reason the developer wants to except all 15 minutes altogether?
I think it should be something like the following to "except all".

['except' => [
'*',
]];
// or
['except' => '*' ];

kenjis · 2023-08-15T11:14:54Z

@datamweb'*' or ['*'] works.
See https://github.com/codeigniter4/CodeIgniter4/pull/7823/files#diff-ae159768f526f66aeb6af1c17c64b57f36659a0d795530b3014a5ded5cbd6176R221

neznaika0 · 2023-08-15T11:16:31Z

Ha, it's wrong, but it will work. To exclude everyone, you need to remove the filter. There is no logic to enable the filter and disable it by rules

datamweb · 2023-08-15T11:34:14Z

exclude everyone, you need to remove the filter.

I was considering the implementation with the Settings package.

It looks good to me.

This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis · 2023-08-16T04:38:36Z

The URI string '' means the URI path for the baseURL.
It has the same meaning as /.
So ['except' => ''] should mean to exclude the baseURL only.

I changed that way.

MGatner

I agree this is a good fix for a common "gotcha"

kenjis · 2023-08-15T10:43:11Z

Description
See #7822 (comment)

This PR changes the behavior:

['except' => []] means to exclude nothing.
['except' => ''] means to exclude baseURL only.
- because the URI string '' means the URI path for the baseURL.
- when navigating to the baseURL, uri_string() returns ''.

['except' => []] or ['except' => ''] means "except all" in the current code.
This behavior is unexpected, and not good for security.

If a dev comments out all items in except key accidentally, the filter will be disabled.

['except' => [
// 'foo/*',// 'bar/*',
]]

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

neznaika0

Thanks

kenjis · 2023-08-15T11:04:04Z

Strictly speaking, this may be a breaking change. However, it does not appear that any developer would want to disable the filter by specifying an empty array or empty string.

If there is, it would be a case of specifying them by mistake and not realizing that the filter is disabled.

datamweb · 2023-08-15T11:11:11Z

want to disable the filter by specifying an empty array or empty string

I agree that this should not be the behavior.
But the question is what if for any reason the developer wants to except all 15 minutes altogether?
I think it should be something like the following to "except all".

['except' => [
'*',
]];
// or
['except' => '*' ];

kenjis · 2023-08-15T11:14:54Z

@datamweb'*' or ['*'] works.
See https://github.com/codeigniter4/CodeIgniter4/pull/7823/files#diff-ae159768f526f66aeb6af1c17c64b57f36659a0d795530b3014a5ded5cbd6176R221

neznaika0 · 2023-08-15T11:16:31Z

Ha, it's wrong, but it will work. To exclude everyone, you need to remove the filter. There is no logic to enable the filter and disable it by rules

datamweb · 2023-08-15T11:34:14Z

exclude everyone, you need to remove the filter.

I was considering the implementation with the Settings package.

It looks good to me.

This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis · 2023-08-16T04:38:36Z

The URI string '' means the URI path for the baseURL.
It has the same meaning as /.
So ['except' => ''] should mean to exclude the baseURL only.

I changed that way.

MGatner

I agree this is a good fix for a common "gotcha"

kenjis · 2023-08-15T10:43:11Z

Description
See #7822 (comment)

This PR changes the behavior:

['except' => []] means to exclude nothing.
['except' => ''] means to exclude baseURL only.
- because the URI string '' means the URI path for the baseURL.
- when navigating to the baseURL, uri_string() returns ''.

['except' => []] or ['except' => ''] means "except all" in the current code.
This behavior is unexpected, and not good for security.

If a dev comments out all items in except key accidentally, the filter will be disabled.

['except' => [
// 'foo/*',// 'bar/*',
]]

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

neznaika0

Thanks

kenjis · 2023-08-15T11:04:04Z

Strictly speaking, this may be a breaking change. However, it does not appear that any developer would want to disable the filter by specifying an empty array or empty string.

If there is, it would be a case of specifying them by mistake and not realizing that the filter is disabled.

datamweb · 2023-08-15T11:11:11Z

want to disable the filter by specifying an empty array or empty string

I agree that this should not be the behavior.
But the question is what if for any reason the developer wants to except all 15 minutes altogether?
I think it should be something like the following to "except all".

['except' => [
'*',
]];
// or
['except' => '*' ];

kenjis · 2023-08-15T11:14:54Z

@datamweb'*' or ['*'] works.
See https://github.com/codeigniter4/CodeIgniter4/pull/7823/files#diff-ae159768f526f66aeb6af1c17c64b57f36659a0d795530b3014a5ded5cbd6176R221

neznaika0 · 2023-08-15T11:16:31Z

Ha, it's wrong, but it will work. To exclude everyone, you need to remove the filter. There is no logic to enable the filter and disable it by rules

datamweb · 2023-08-15T11:34:14Z

exclude everyone, you need to remove the filter.

I was considering the implementation with the Settings package.

It looks good to me.

This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis · 2023-08-16T04:38:36Z

The URI string '' means the URI path for the baseURL.
It has the same meaning as /.
So ['except' => ''] should mean to exclude the baseURL only.

I changed that way.

MGatner

I agree this is a good fix for a common "gotcha"

kenjis · 2023-08-15T10:43:11Z

Description
See #7822 (comment)

This PR changes the behavior:

['except' => []] means to exclude nothing.
['except' => ''] means to exclude baseURL only.
- because the URI string '' means the URI path for the baseURL.
- when navigating to the baseURL, uri_string() returns ''.

['except' => []] or ['except' => ''] means "except all" in the current code.
This behavior is unexpected, and not good for security.

If a dev comments out all items in except key accidentally, the filter will be disabled.

['except' => [
// 'foo/*',// 'bar/*',
]]

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

neznaika0

Thanks

kenjis · 2023-08-15T11:04:04Z

Strictly speaking, this may be a breaking change. However, it does not appear that any developer would want to disable the filter by specifying an empty array or empty string.

If there is, it would be a case of specifying them by mistake and not realizing that the filter is disabled.

datamweb · 2023-08-15T11:11:11Z

want to disable the filter by specifying an empty array or empty string

I agree that this should not be the behavior.
But the question is what if for any reason the developer wants to except all 15 minutes altogether?
I think it should be something like the following to "except all".

['except' => [
'*',
]];
// or
['except' => '*' ];

kenjis · 2023-08-15T11:14:54Z

@datamweb'*' or ['*'] works.
See https://github.com/codeigniter4/CodeIgniter4/pull/7823/files#diff-ae159768f526f66aeb6af1c17c64b57f36659a0d795530b3014a5ded5cbd6176R221

neznaika0 · 2023-08-15T11:16:31Z

Ha, it's wrong, but it will work. To exclude everyone, you need to remove the filter. There is no logic to enable the filter and disable it by rules

datamweb · 2023-08-15T11:34:14Z

exclude everyone, you need to remove the filter.

I was considering the implementation with the Settings package.

It looks good to me.

This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis · 2023-08-16T04:38:36Z

The URI string '' means the URI path for the baseURL.
It has the same meaning as /.
So ['except' => ''] should mean to exclude the baseURL only.

I changed that way.

MGatner

I agree this is a good fix for a common "gotcha"

kenjis · 2023-08-15T10:43:11Z

Description
See #7822 (comment)

This PR changes the behavior:

['except' => []] means to exclude nothing.
['except' => ''] means to exclude baseURL only.
- because the URI string '' means the URI path for the baseURL.
- when navigating to the baseURL, uri_string() returns ''.

['except' => []] or ['except' => ''] means "except all" in the current code.
This behavior is unexpected, and not good for security.

If a dev comments out all items in except key accidentally, the filter will be disabled.

['except' => [
// 'foo/*',// 'bar/*',
]]

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

neznaika0

Thanks

kenjis · 2023-08-15T11:04:04Z

Strictly speaking, this may be a breaking change. However, it does not appear that any developer would want to disable the filter by specifying an empty array or empty string.

If there is, it would be a case of specifying them by mistake and not realizing that the filter is disabled.

datamweb · 2023-08-15T11:11:11Z

want to disable the filter by specifying an empty array or empty string

I agree that this should not be the behavior.
But the question is what if for any reason the developer wants to except all 15 minutes altogether?
I think it should be something like the following to "except all".

['except' => [
'*',
]];
// or
['except' => '*' ];

kenjis · 2023-08-15T11:14:54Z

@datamweb'*' or ['*'] works.
See https://github.com/codeigniter4/CodeIgniter4/pull/7823/files#diff-ae159768f526f66aeb6af1c17c64b57f36659a0d795530b3014a5ded5cbd6176R221

neznaika0 · 2023-08-15T11:16:31Z

Ha, it's wrong, but it will work. To exclude everyone, you need to remove the filter. There is no logic to enable the filter and disable it by rules

datamweb · 2023-08-15T11:34:14Z

exclude everyone, you need to remove the filter.

I was considering the implementation with the Settings package.

It looks good to me.

This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis · 2023-08-16T04:38:36Z

The URI string '' means the URI path for the baseURL.
It has the same meaning as /.
So ['except' => ''] should mean to exclude the baseURL only.

I changed that way.

MGatner

I agree this is a good fix for a common "gotcha"

kenjis added the bug Verified issues on the current code behavior or pull requests that will fix them label Aug 15, 2023

This was referenced Aug 15, 2023
[Helper] form_open() not insert csrf field #7822
Closed
Dev: v4.4.0 release #7812
Closed

neznaika0 reviewed Aug 15, 2023
View reviewed changes

datamweb approved these changes Aug 15, 2023
View reviewed changes

kenjis marked this pull request as draft August 16, 2023 01:45

kenjis added 4 commits August 16, 2023 10:46

test: add test for except empty array
bc1f279

fix: "except empty" means "except all"
e7297f1
This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

test: fix test case
fc3ae4c

refactor: extract method
b6a3c7d

kenjis force-pushed the fix-filter-except branch from 8ea1a4a to b6a3c7dCompare August 16, 2023 01:46

kenjis added 4 commits August 16, 2023 13:21

docs: add/fix PHPDoc types
459ea26

test: use dataProvider
f9ecd03

test: add test cases for except
2ad0864

fix: empty string should mean except only baseURL
79aaefb
The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis force-pushed the fix-filter-except branch from c223a28 to 79aaefbCompare August 16, 2023 04:21

kenjis marked this pull request as ready for review August 16, 2023 04:38

kenjis force-pushed the fix-filter-except branch from 7564d92 to ef08813Compare August 16, 2023 04:49

kenjis added 2 commits August 16, 2023 14:04

docs: add/update PHPDoc types
9b93434

docs: add changelog
e510da9

kenjis force-pushed the fix-filter-except branch from ef08813 to e510da9Compare August 16, 2023 05:05

MGatner approved these changes Aug 20, 2023
View reviewed changes

kenjis merged commit 700f6e4 into codeigniter4:developAug 21, 2023

kenjis deleted the fix-filter-except branch August 21, 2023 01:11

kenjis added the bug Verified issues on the current code behavior or pull requests that will fix them label Aug 15, 2023

This was referenced Aug 15, 2023
[Helper] form_open() not insert csrf field #7822
Closed
Dev: v4.4.0 release #7812
Closed

neznaika0 reviewed Aug 15, 2023
View reviewed changes

datamweb approved these changes Aug 15, 2023
View reviewed changes

kenjis marked this pull request as draft August 16, 2023 01:45

kenjis added 4 commits August 16, 2023 10:46

test: add test for except empty array
bc1f279

fix: "except empty" means "except all"
e7297f1
This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

test: fix test case
fc3ae4c

refactor: extract method
b6a3c7d

kenjis force-pushed the fix-filter-except branch from 8ea1a4a to b6a3c7dCompare August 16, 2023 01:46

kenjis added 4 commits August 16, 2023 13:21

docs: add/fix PHPDoc types
459ea26

test: use dataProvider
f9ecd03

test: add test cases for except
2ad0864

fix: empty string should mean except only baseURL
79aaefb
The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis force-pushed the fix-filter-except branch from c223a28 to 79aaefbCompare August 16, 2023 04:21

kenjis marked this pull request as ready for review August 16, 2023 04:38

kenjis force-pushed the fix-filter-except branch from 7564d92 to ef08813Compare August 16, 2023 04:49

kenjis added 2 commits August 16, 2023 14:04

docs: add/update PHPDoc types
9b93434

docs: add changelog
e510da9

kenjis force-pushed the fix-filter-except branch from ef08813 to e510da9Compare August 16, 2023 05:05

MGatner approved these changes Aug 20, 2023
View reviewed changes

kenjis merged commit 700f6e4 into codeigniter4:developAug 21, 2023

kenjis deleted the fix-filter-except branch August 21, 2023 01:11

kenjis added the bug Verified issues on the current code behavior or pull requests that will fix them label Aug 15, 2023

This was referenced Aug 15, 2023
[Helper] form_open() not insert csrf field #7822
Closed
Dev: v4.4.0 release #7812
Closed

neznaika0 reviewed Aug 15, 2023
View reviewed changes

datamweb approved these changes Aug 15, 2023
View reviewed changes

kenjis marked this pull request as draft August 16, 2023 01:45

kenjis added 4 commits August 16, 2023 10:46

test: add test for except empty array
bc1f279

fix: "except empty" means "except all"
e7297f1
This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

test: fix test case
fc3ae4c

refactor: extract method
b6a3c7d

kenjis force-pushed the fix-filter-except branch from 8ea1a4a to b6a3c7dCompare August 16, 2023 01:46

kenjis added 4 commits August 16, 2023 13:21

docs: add/fix PHPDoc types
459ea26

test: use dataProvider
f9ecd03

test: add test cases for except
2ad0864

fix: empty string should mean except only baseURL
79aaefb
The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis force-pushed the fix-filter-except branch from c223a28 to 79aaefbCompare August 16, 2023 04:21

kenjis marked this pull request as ready for review August 16, 2023 04:38

kenjis force-pushed the fix-filter-except branch from 7564d92 to ef08813Compare August 16, 2023 04:49

kenjis added 2 commits August 16, 2023 14:04

docs: add/update PHPDoc types
9b93434

docs: add changelog
e510da9

kenjis force-pushed the fix-filter-except branch from ef08813 to e510da9Compare August 16, 2023 05:05

MGatner approved these changes Aug 20, 2023
View reviewed changes

kenjis merged commit 700f6e4 into codeigniter4:developAug 21, 2023

kenjis deleted the fix-filter-except branch August 21, 2023 01:11

kenjis added the bug Verified issues on the current code behavior or pull requests that will fix them label Aug 15, 2023

This was referenced Aug 15, 2023
[Helper] form_open() not insert csrf field #7822
Closed
Dev: v4.4.0 release #7812
Closed

neznaika0 reviewed Aug 15, 2023
View reviewed changes

datamweb approved these changes Aug 15, 2023
View reviewed changes

kenjis marked this pull request as draft August 16, 2023 01:45

kenjis added 4 commits August 16, 2023 10:46

test: add test for except empty array
bc1f279

fix: "except empty" means "except all"
e7297f1
This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

test: fix test case
fc3ae4c

refactor: extract method
b6a3c7d

kenjis force-pushed the fix-filter-except branch from 8ea1a4a to b6a3c7dCompare August 16, 2023 01:46

kenjis added 4 commits August 16, 2023 13:21

docs: add/fix PHPDoc types
459ea26

test: use dataProvider
f9ecd03

test: add test cases for except
2ad0864

fix: empty string should mean except only baseURL
79aaefb
The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis force-pushed the fix-filter-except branch from c223a28 to 79aaefbCompare August 16, 2023 04:21

kenjis marked this pull request as ready for review August 16, 2023 04:38

kenjis force-pushed the fix-filter-except branch from 7564d92 to ef08813Compare August 16, 2023 04:49

kenjis added 2 commits August 16, 2023 14:04

docs: add/update PHPDoc types
9b93434

docs: add changelog
e510da9

kenjis force-pushed the fix-filter-except branch from ef08813 to e510da9Compare August 16, 2023 05:05

MGatner approved these changes Aug 20, 2023
View reviewed changes

kenjis merged commit 700f6e4 into codeigniter4:developAug 21, 2023

kenjis deleted the fix-filter-except branch August 21, 2023 01:11

kenjis added the bug Verified issues on the current code behavior or pull requests that will fix them label Aug 15, 2023

This was referenced Aug 15, 2023
[Helper] form_open() not insert csrf field #7822
Closed
Dev: v4.4.0 release #7812
Closed

neznaika0 reviewed Aug 15, 2023
View reviewed changes

datamweb approved these changes Aug 15, 2023
View reviewed changes

kenjis marked this pull request as draft August 16, 2023 01:45

kenjis added 4 commits August 16, 2023 10:46

test: add test for except empty array
bc1f279

fix: "except empty" means "except all"
e7297f1
This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

test: fix test case
fc3ae4c

refactor: extract method
b6a3c7d

kenjis force-pushed the fix-filter-except branch from 8ea1a4a to b6a3c7dCompare August 16, 2023 01:46

kenjis added 4 commits August 16, 2023 13:21

docs: add/fix PHPDoc types
459ea26

test: use dataProvider
f9ecd03

test: add test cases for except
2ad0864

fix: empty string should mean except only baseURL
79aaefb
The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis force-pushed the fix-filter-except branch from c223a28 to 79aaefbCompare August 16, 2023 04:21

kenjis marked this pull request as ready for review August 16, 2023 04:38

kenjis force-pushed the fix-filter-except branch from 7564d92 to ef08813Compare August 16, 2023 04:49

kenjis added 2 commits August 16, 2023 14:04

docs: add/update PHPDoc types
9b93434

docs: add changelog
e510da9

kenjis force-pushed the fix-filter-except branch from ef08813 to e510da9Compare August 16, 2023 05:05

MGatner approved these changes Aug 20, 2023
View reviewed changes

kenjis merged commit 700f6e4 into codeigniter4:developAug 21, 2023

kenjis deleted the fix-filter-except branch August 21, 2023 01:11

kenjis added the bug Verified issues on the current code behavior or pull requests that will fix them label Aug 15, 2023

This was referenced Aug 15, 2023
[Helper] form_open() not insert csrf field #7822
Closed
Dev: v4.4.0 release #7812
Closed

neznaika0 reviewed Aug 15, 2023
View reviewed changes

datamweb approved these changes Aug 15, 2023
View reviewed changes

kenjis marked this pull request as draft August 16, 2023 01:45

kenjis added 4 commits August 16, 2023 10:46

test: add test for except empty array
bc1f279

fix: "except empty" means "except all"
e7297f1
This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

test: fix test case
fc3ae4c

refactor: extract method
b6a3c7d

kenjis force-pushed the fix-filter-except branch from 8ea1a4a to b6a3c7dCompare August 16, 2023 01:46

kenjis added 4 commits August 16, 2023 13:21

docs: add/fix PHPDoc types
459ea26

test: use dataProvider
f9ecd03

test: add test cases for except
2ad0864

fix: empty string should mean except only baseURL
79aaefb
The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis force-pushed the fix-filter-except branch from c223a28 to 79aaefbCompare August 16, 2023 04:21

kenjis marked this pull request as ready for review August 16, 2023 04:38

kenjis force-pushed the fix-filter-except branch from 7564d92 to ef08813Compare August 16, 2023 04:49

kenjis added 2 commits August 16, 2023 14:04

docs: add/update PHPDoc types
9b93434

docs: add changelog
e510da9

kenjis force-pushed the fix-filter-except branch from ef08813 to e510da9Compare August 16, 2023 05:05

MGatner approved these changes Aug 20, 2023
View reviewed changes

kenjis merged commit 700f6e4 into codeigniter4:developAug 21, 2023

kenjis deleted the fix-filter-except branch August 21, 2023 01:11

kenjis added the bug Verified issues on the current code behavior or pull requests that will fix them label Aug 15, 2023

This was referenced Aug 15, 2023
[Helper] form_open() not insert csrf field #7822
Closed
Dev: v4.4.0 release #7812
Closed

neznaika0 reviewed Aug 15, 2023
View reviewed changes

datamweb approved these changes Aug 15, 2023
View reviewed changes

kenjis marked this pull request as draft August 16, 2023 01:45

kenjis added 4 commits August 16, 2023 10:46

test: add test for except empty array
bc1f279

fix: "except empty" means "except all"
e7297f1
This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

test: fix test case
fc3ae4c

refactor: extract method
b6a3c7d

kenjis force-pushed the fix-filter-except branch from 8ea1a4a to b6a3c7dCompare August 16, 2023 01:46

kenjis added 4 commits August 16, 2023 13:21

docs: add/fix PHPDoc types
459ea26

test: use dataProvider
f9ecd03

test: add test cases for except
2ad0864

fix: empty string should mean except only baseURL
79aaefb
The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis force-pushed the fix-filter-except branch from c223a28 to 79aaefbCompare August 16, 2023 04:21

kenjis marked this pull request as ready for review August 16, 2023 04:38

kenjis force-pushed the fix-filter-except branch from 7564d92 to ef08813Compare August 16, 2023 04:49

kenjis added 2 commits August 16, 2023 14:04

docs: add/update PHPDoc types
9b93434

docs: add changelog
e510da9

kenjis force-pushed the fix-filter-except branch from ef08813 to e510da9Compare August 16, 2023 05:05

MGatner approved these changes Aug 20, 2023
View reviewed changes

kenjis merged commit 700f6e4 into codeigniter4:developAug 21, 2023

kenjis deleted the fix-filter-except branch August 21, 2023 01:11

kenjis added the bug Verified issues on the current code behavior or pull requests that will fix them label Aug 15, 2023

This was referenced Aug 15, 2023
[Helper] form_open() not insert csrf field #7822
Closed
Dev: v4.4.0 release #7812
Closed

neznaika0 reviewed Aug 15, 2023
View reviewed changes

datamweb approved these changes Aug 15, 2023
View reviewed changes

kenjis marked this pull request as draft August 16, 2023 01:45

kenjis added 4 commits August 16, 2023 10:46

test: add test for except empty array
bc1f279

fix: "except empty" means "except all"
e7297f1
This behavior is unexpected and not good for security. If a dev removes all items in `except` key, the filter is disabled. Now "except empty" means "except nothing".

test: fix test case
fc3ae4c

refactor: extract method
b6a3c7d

kenjis force-pushed the fix-filter-except branch from 8ea1a4a to b6a3c7dCompare August 16, 2023 01:46

kenjis added 4 commits August 16, 2023 13:21

docs: add/fix PHPDoc types
459ea26

test: use dataProvider
f9ecd03

test: add test cases for except
2ad0864

fix: empty string should mean except only baseURL
79aaefb
The URI path '' means the baseURL. So ['except' => ''] should mean that except for the baseURL only.

kenjis force-pushed the fix-filter-except branch from c223a28 to 79aaefbCompare August 16, 2023 04:21

kenjis marked this pull request as ready for review August 16, 2023 04:38

kenjis force-pushed the fix-filter-except branch from 7564d92 to ef08813Compare August 16, 2023 04:49

kenjis added 2 commits August 16, 2023 14:04

docs: add/update PHPDoc types
9b93434

docs: add changelog
e510da9

kenjis force-pushed the fix-filter-except branch from ef08813 to e510da9Compare August 16, 2023 05:05

MGatner approved these changes Aug 20, 2023
View reviewed changes

kenjis merged commit 700f6e4 into codeigniter4:developAug 21, 2023

kenjis deleted the fix-filter-except branch August 21, 2023 01:11

Uh oh!

Conversation

kenjis commented Aug 15, 2023• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

neznaika0 left a comment

Choose a reason for hiding this comment

Uh oh!

kenjis commented Aug 15, 2023• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

datamweb commented Aug 15, 2023

Uh oh!

kenjis commented Aug 15, 2023

Uh oh!

neznaika0 commented Aug 15, 2023

Uh oh!

datamweb commented Aug 15, 2023

Uh oh!

kenjis commented Aug 16, 2023

Uh oh!

MGatner left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

kenjis commented Aug 15, 2023• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

neznaika0 left a comment

Choose a reason for hiding this comment

Uh oh!

kenjis commented Aug 15, 2023• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

datamweb commented Aug 15, 2023

Uh oh!

kenjis commented Aug 15, 2023

Uh oh!

neznaika0 commented Aug 15, 2023

Uh oh!

datamweb commented Aug 15, 2023

Uh oh!

kenjis commented Aug 16, 2023

Uh oh!

MGatner left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

kenjis commented Aug 15, 2023• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

neznaika0 left a comment

Choose a reason for hiding this comment

Uh oh!

kenjis commented Aug 15, 2023• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

datamweb commented Aug 15, 2023

Uh oh!

kenjis commented Aug 15, 2023

Uh oh!

neznaika0 commented Aug 15, 2023

kenjis commented Aug 15, 2023•
edited
Loading

kenjis commented Aug 15, 2023•
edited
Loading

kenjis commented Aug 15, 2023•
edited
Loading

kenjis commented Aug 15, 2023•
edited
Loading

kenjis commented Aug 15, 2023•
edited
Loading

kenjis commented Aug 15, 2023•
edited
Loading

kenjis commented Aug 15, 2023•
edited
Loading

kenjis commented Aug 15, 2023•
edited
Loading