Security - Classes - FuelPHP Documentation

Security クラス

The security class allows you to have CSRF protection in your application.

設定

The security class is configured through the security section of the app/config/config.php configuration file.

The following security configuration settings can be defined:

パラメータ	型	規定値	説明
csrf_autoload	boolean	`true`	When true, load and check the CSRF token using check_token() automatically.
csrf_token_key	string	`'fuel_csrf_token'`	Name used for the CSRF token cookie, and the name of the form field containing the token.
csrf_expiration	integer	`0`	Expiration time for the CRSF token cookie. Default, the cookie expires at end of browser session.
uri_filter	array	`array('htmlentities')`	Array of callable items (PHP functions, object methods, static class methods) used to filter the URI. By default, it uses PHP's htmlentities internal function.
input_filter	array	`array()`	Array of callable items (PHP functions, object methods, static class methods) used to filter $_GET, $_POST and $_COOKIE. By default, no input filters are defined.
output_filter	array	`array('Security::htmlentities')`	Array of callable items (PHP functions, object methods, static class methods) used to filter variables send to a View or Viewmodel. For security reasons, you are required to define an output filter.
htmlentities_flags	integer	`null`	Flags to be used when encoding HTML entities. Defaults to ENT_QUOTES if nothing is defined.
htmlentities_double_encode	boolean	`null`	Whether of not already encoded entities should be encoded again. Defaults to false if nothing is defined.
auto_encode_view_data	boolean	`true`	When true, all variables passed on to view objects are automatically encoded.
whitelisted_classes	array	`array('stdClass', 'Fuel\\Core\\View', 'Fuel\\Core\\ViewModel', 'Closure')`	When auto encoding of view variables is enabled, you can run into issues when passing objects to the view. Classes defined in this array will be exempt from auto encoding.

check_token($value = null)

The check_token method allows you to check the CSRF token.
Check token also ensures a token is present and will reset the token for the next session when it receives a value to check (no matter the result of the check).

Static Yes

パラメータ

パラメータ	規定値	説明
`$value`	`null`	CSRF token to be checked, checks value from POST when empty.

返り値 boolean

例

Security::check_token();

fetch_token()

The fetch_token method allows you to fetch the CSRF token from the cookie.

Static	Yes
パラメータ	None
返り値	string
例	`$csrf_token = Security::fetch_token();`

js_fetch_token()

The js_fetch_token method allows you to produce JavaScript fuel_csrf_token() function that will return the current CSRF token when called. Use to fill right field on form submit for AJAX operations.

Static	Yes
パラメータ	None
返り値	string
例	`// output the javascript function echo Security::js_fetch_token(); // you can now use the generated function in the javascript code on your page <script type="text/javascript"> var current_token = fuel_csrf_token(); </script>`

js_set_token()

The js_set_token method allows you to produce JavaScript fuel_set_csrf_token() function that will set the current CSRF token field in the form when called. Use this on an onsubmit of a form, to update the hidden token field in the form with the current value of the csrf cookie.

Static	Yes
パラメータ	None
返り値	string
例	`// output the javascript function echo Security::js_set_token(); // you use the function generated as an onsubmit function, like so. // do NOT forget the 'this' parameter, so the function knows which form to update! <form onsubmit="fuel_set_csrf_token(this);"> <!-- do your stuff here --> </form>`

clean($value, $filters = null)

The clean method allows you clean data using the filters provided.

Static Yes

パラメータ

パラメータ	規定値	説明
`$value`	必須	The value to be cleaned. This can be a string value, or an array of string values.
`$filters`	`null`	The filters to be used to clean the string(s). A filter can be a single value, or an array of values. Each value must be a valid PHP callback. You may specify functions ('htmlentities'), objects ($this), or static methods ('Classname::method').

返り値 string

例

// first strip tags, convert html entities in the remaining data, and finish it off using our special cleaning solution
$filters = array('strip_tags', 'htmlentities', '\\cleaners\\soap::clean');
$text = Security::clean($text, $filters);

strip_tags($value)

The strip_tags method allows you to strip HTML and PHP tags from a string.

Static Yes

パラメータ

パラメータ	規定値	説明
`$value`	必須	The input string.

返り値 string

例

$text = '<p>Test paragraph.</p>';
$text = Security::strip_tags($text);

xss_clean($value)

The xss_clean method allows you to strip dangerous HTML tags from a string, using the HTMLawed library.

Static Yes

パラメータ

パラメータ	規定値	説明
`$value`	必須	The input string.

返り値 string

例

$text = '<SCRIPT>alert("XSS attack!")</SCRIPT>';
$text = Security::xss_clean($text);

htmlentities($value, $flags = null, $encoding = null, $double_encode = null)

The htmlentities method allows you to turn HTML characters into their entity equivalent. This method operates identical to PHP's htmlentities() function but supports arrays and objects as well.

Static Yes

パラメータ

パラメータ	規定値	説明
`$value`	必須	The input value.
`$flags`	`null`	Flags to be passed to htmlentities(). If not given and not configured, it will default to ENT_QUOTES.
`$encoding`	`null`	The encoding used for the value passed. If not given it will default the FuelPHP's default encoding.
`$double_encoding`	`null`	If true, already encoded values will not be encoded again. If not given and not configured it will default to false.

返り値 mixed

例外 RuntimeException, in case an object has been passed that can't be cast as string.

例

$text = '<p>Test paragraph.</p>';
$text = Security::htmlentities($text);

Procedural helpers

e($string)

The e function is an alias for Security::htmlentities.

パラメータ

パラメータ	規定値	説明
`$string`	必須	The input value.

返り値 string, result from Security::htmlentities

例

$text = '<p>Test paragraph.</p>';
$text = e($text);