24

I'm trying to set up a CMS on the back of a site but whenever post data has a <a href=... in it the post data gets scrapped.

I've got $config['global_xss_filtering'] = TRUE; in config

My question is there a way of disabling xss filtering for one item?

e.g.

$this->input->post('content', true); - turns it on, but how to turn it off?

Thanks everyone.

PVS

1
  • thanks man spend 2 hours for this.I had issue while saving base64 images through ckeditor.XSS filtering was false but set it true in config file by my colleague
    – mokNathal
    Dec 2, 2015 at 10:23

7 Answers 7

27

If you want to change the default behavior of the post() method, you can extend the core Input library, or if you're lazy you can just change line 278 (or so) of the Input library to read:

/**
* Fetch an item from the POST array
*
* @access   public
* @param    string
* @param    bool
* @return   string
*/
function post($index = '', $xss_clean = TRUE)
{
    return $this->_fetch_from_array($_POST, $index, $xss_clean);
}

The only difference here is that I've changed the $xss_clean variable to TRUE instead of FALSE. Now you can turn off global XSS filtering and it will automatically filter inputs unless you specify false as the second parameter in your call to the Input library's post() method. Just one method down is the get() method, and you can change that in the same way.

However, if I were you, I'd just extend the native library, because there's a good chance you'll have forgotten about this by the time you update CodeIgniter, and then you'll suddenly be wondering why you're getting XSS attacked. That would look like this:

class MY_Input extends CI_Input {

    function My_Input()
    {
        parent::CI_Input();
    }

    function post($index = '', $xss_clean = TRUE)
    {
        return parent::post($index, $xss_clean);
    }
}

You can learn more about extending libraries here:

http://codeigniter.com/user_guide/general/creating_libraries.html

7
  • Nice hack. I think it should be return parent::post($index, $xss_clean);, however.
    – user67416
    Jan 5, 2011 at 5:51
  • 2
    A better link to read about extending this is the 'Extending Core Class' part of this page codeigniter.com/user_guide/general/core_classes.html
    – gacrux
    Feb 27, 2012 at 1:19
  • awsome hack, saved my life. I wonder if we should explain CI developers to add this inbuilt in next version. Or may be they are not doing it because of security issues. May 4, 2012 at 1:51
  • @aslamdoctor, I'm more than certain that they won't "fix" this because of security issues. RoR just went through a bunch of nasty publicity for being lax about something like this.
    – treeface
    May 9, 2012 at 19:17
  • 4
    This works better: class MY_Input extends CI_Input { public function __construct() { parent::__construct(); } public function post($index = null, $xss_clean = TRUE) { return parent::post($index, $xss_clean); } }
    – Niraj Shah
    Jun 13, 2013 at 13:51
6

If you want to keep global xss_clean enabled and override on only certain cases, you can extend the Input library to keep a clone of $_POST for providing raw data when asked:

<?php if (!defined('BASEPATH')) exit('No direct access allowed.');
class MY_Input extends CI_Input {

public function __construct() {
    $this->_POST_RAW = $_POST; //clone raw post data 
    parent::__construct(); 
}

public function post($index = null, $xss_clean = TRUE) { 
    if(!$xss_clean){ //if asked for raw post data -eg. post('key', false)-, return raw data. Use with caution.
        return $this->_POST_RAW[$index];
    }
    return parent::post($index, $xss_clean); 
    }
}
?>

This way you can use $this->input->post('mydata', FALSE) to retrieve un-sanitized raw post data even if xss_clean is enabled globally.

1

i defined

global $mypost;
$mypost=$_POST;

in index.php of my root cms

then anywhere i can the global variable like

global $mypost;

$var=isset($mypost["field"])? $mypost["field"]:"";

whenever i need post without filter.

worked for me hope it helps.

1
  • But this is also XSS filtered. Aug 27, 2013 at 10:12
1

In my case, treeface's solution doesn't work, but i found another way. I made MY_Input with _sanitize_globals() and I added if construction in place where is sanitizing post data.

// Clean $_POST Data
if (is_array($_POST) AND count($_POST) > 0) {
    foreach ($_POST as $key => $val) {
        if($this->_clean_input_keys($key) != 'my_none_sanitize_field')
        $_POST[$this->_clean_input_keys($key)] = $this->_clean_input_data($val);
    }
}
0

Yes, the extension to Input with the post method replacement was very useful, as was the astute reader who notice that it should be return parent::post($index, $xss_clean). I was getting errors and didn't think about that obvious error. Fixed it and I'm off and running.

We're using it to escape post data for use in sql statements. Although CI's db methods are nice, we have some large sql statements that are easier to code by hand.

0

working with CI 2.2 I think that the solution from treeface will leave input->get(), input->cookie() etc not being xss_cleaned. (we use get in oauth requests etc). The global config change stops them being escaped by the constructor and the core class still defaults xss_clean to FALSE on these methods...

I have basically implemented the same solution across more methods.

class MY_Input extends CI_Input {

    /* fixes to allow xss_clean to be disabled on a per field basis
    * [ e.g. tinymce html content with style / class / event attributes ]
    * initial ref : http://stackoverflow.com/questions/3788476/codeigniter-disable-xss-filtering-on-a-post-basis
    * this is based on CI 2.2
    * the above (stackoverflow) solution only updates the post method - which means all the rest ( get, get_post, cookie, server, request_headers, get_request_header)
    * NB : we need GET to allow oauth type activities !
    *
    *   1 - change the global config to xss_clean = false [ otherwise the constructor will 'xss_clean' everything before we have a chance to say no ! ]
    *   2 - make all of methods that take the xss_clean parameter use TRUE as default value
    *   3 - we can now pass the second parameter in as FALSE if we do not want to xss_clean
    */

    function get($index = '', $xss_clean = TRUE)
    {
        return parent::get($index, $xss_clean);
    }

    function post($index = '', $xss_clean = TRUE)
    {
        return parent::post($index, $xss_clean);
    }

    function get_post($index = '', $xss_clean = TRUE)
    {
        return parent::get($index, $xss_clean);
    }

    function cookie($index = '', $xss_clean = TRUE)
    {
        return parent::cookie($index, $xss_clean);
    }

    function server($index = '', $xss_clean = TRUE)
    {
        return parent::server($index, $xss_clean);
    }

    function request_headers($xss_clean = TRUE)
    {
        return parent::request_headers($xss_clean);
    }

    function get_request_header($index, $xss_clean = TRUE)
    {
        return parent::get_request_header($index, $xss_clean);
    }

}

hope this is of some help to someone

-4

you can temporarily turn it off

$this->config->set_item('global_xss_filtering', false);

$c = $this->input->post('content'); then turn it back on..

$this->config->set_item('global_xss_filtering', true);

3
  • OP, I'd be interested to see if this works. Based on my understanding of CI's XSS filtering scheme, I think this would actually not have the desired effect. I believe CI does its XSS filtering of the entire $_POST variable when the controller is initiated, so changing the config after the fact would have little affect. Still..it's worth a try.
    – treeface
    Sep 24, 2010 at 17:56
  • Hi, this didn't seem to work with my CI installation. Thanks for responding though! Sep 30, 2010 at 8:40
  • You might be able to do this in a hook before the filtering is done. There are several stages of hooks to act. [link]codeigniter.com/user_guide/general/hooks.html[/link]
    – Eric Cope
    Mar 8, 2011 at 20:45

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.