mirror/opensourcepos
1
0
Fork 0
mirror of https://github.com/opensourcepos/opensourcepos.git synced 2026-01-02 22:47:50 -05:00
Code Issues Packages Projects Releases Wiki Activity

Made ospos XSS clean optional and configurable from application/config/config.php (#39)

Browse Source 
Performance improves if set to FALSE but should be only for pure stand alone and isolated from Internet cases.
This commit is contained in:
FrancescoUK
2016-06-21 18:31:39 +01:00
parent 9a1def21cc
commit 04fdbfb187
2 changed files with 24 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
application/config/config.php
View File

@@ -12,6 +12,18 @@ defined('BASEPATH') OR exit('No direct script access allowed');
*/
$config['application_version'] = '3.0.0';
/*
|--------------------------------------------------------------------------
| Internal to OSPOS XSS Clean
|--------------------------------------------------------------------------
|
| This is to indicated whether we want XSS clean to be performed or not
| By default it's enabled as it's assumed the installation has Internet access and needs to be protected,
| however intranet only installations may not need this so they can set FALSE to improve performance
|
*/
$config['ospos_xss_clean'] = TRUE;
/*
|--------------------------------------------------------------------------
| Base Site URL
@@ -89,7 +101,7 @@ $config['url_suffix'] = '';
| than english.
|
*/
$config['language'] = 'en';
$config['language'] = 'en';
/*
|--------------------------------------------------------------------------

12
application/controllers/Secure_Controller.php
View File

@@ -38,7 +38,17 @@ class Secure_Controller extends CI_Controller
*/
protected function xss_clean($str, $is_image = FALSE)
{
return $this->security->xss_clean($str, $is_image);
// This setting is configurable in application/config/config.php.
// Users can disable the XSS clean for performance reasons
// (cases like intranet installation with no Internet access)
if($this->config->item('ospos_xss_clean') == FALSE)
{
return $str;
}
else
{
return $this->security->xss_clean($str, $is_image);
}
}
// this is the basic set of methods most OSPOS Controllers will implement