History: SecurityDataFlow

!!!~~#666666,transparent:Question:  Using the “user” field during login as an example, where does the user-submitted data flow in tiki?~~
!!!~~#666666,transparent:Answer:  Here is a draft, unofficial answer:~~

~~ ,#00FFFF:./tiki-login.php:~~
~~ ,#F4CCCC:__$requestedUser__~~~~ ,transparent: = isset($_REQUEST['user']) ? ~~~~ ,#F4CCCC:$_REQUEST['~~~~ ,#F4CCCC:__user__~~~~ ,#F4CCCC:']~~~~ ,transparent: : false;~~
~~ ,transparent:$ret = $userlib->~~~~ ,transparent:__validate_user__~~~~ ,transparent:(~~~~ ,#F4CCCC:__$requestedUser__~~~~ ,transparent:, $pass, $challenge, $response);~~

~~ ,#00FFFF:./lib/userslib.php:~~
~~ ,transparent:class UsersLib extends TikiLib~~
~~ ,transparent:    function ~~~~ ,transparent:__validate_user__~~~~ ,transparent:(~~~~ ,#F4CCCC:__$user__~~~~ ,transparent:, $pass, $challenge = '', $response = '', $validate_phase=false)~~
~~ ,transparent:        list($result, $user) = $this->~~~~ ,transparent:__validate_user_tiki__~~~~ ,transparent:(~~~~ ,#F4CCCC:__$user__~~~~ ,transparent:, $pass, $challenge, $response, $validate_phase);~~
~~ ,transparent:    function ~~~~ ,transparent:__validate_user_tiki__~~~~ ,transparent:(~~~~ ,#F4CCCC:__$user__~~~~ ,transparent:, $pass, $challenge, $response, $validate_phase = false)~~
~~ ,transparent:__        $query__~~~~ ,transparent: = 'select * from `users_users` where binary `login` = ~~~~ ,transparent:__?__~~~~ ,transparent:';  ~~
~~ ,transparent:        $result = $this->~~~~ ,transparent:__query($query__~~~~ ,transparent:, array(~~~~ ,#F4CCCC:__$user__~~~~ ,transparent:));~~

~~ ,#00FFFF:./lib/tikilib.php:~~
~~ ,transparent:class TikiLib extends TikiDb_Bridge~~

~~ ,#00FFFF:./lib/core/TikiDb/Bridge.php:~~
~~ ,transparent:class TikiDb_Bridge extends TikiDb~~
~~ ,transparent:    function ~~~~ ,transparent:__query(__~~~~ ,transparent:__$query__~~~~ ,transparent: = null, ~~~~ ,#F4CCCC:__$values__~~~~ ,transparent: = null, $numrows = -1, $offset = -1, $reporterrors = true ) // {{{~~
~~ ,transparent:        return self::~~~~ ,transparent:__get()__~~~~ ,transparent:->~~~~ ,transparent:__query($query__~~~~ ,transparent:, ~~~~ ,#F4CCCC:__$values__~~~~ ,transparent:, $numrows, $offset, $reporterrors);  //get()=db connection instance~~

~~ ,#00FFFF:./lib/core/TikiDb.php:~~
~~ ,transparent:abstract class TikiDb~~
~~ ,transparent:    public static function ~~~~ ,transparent:__get() __~~~~ ,transparent:// {{{~~
~~ ,transparent:        return self::~~~~ ,transparent:__$instance__~~~~ ,transparent:;~~
~~ ,transparent:    private static $instance;~~
~~ ,transparent:    public static function ~~~~ ,transparent:__set(__~~~~ ,transparent:TikiDb ~~~~ ,transparent:__$instance__~~~~ ,transparent:) // {{{~~
~~ ,transparent:        return self::~~~~ ,transparent:$instance = $instance;~~
~~ ,transparent:    abstract function ~~~~ ,transparent:__query($query__~~~~ ,transparent: = null, ~~~~ ,#F4CCCC:__$values__~~~~ ,transparent: = null, $numrows = -1, $offset = -1, $reporterrors = true);~~

~~ ,#00FFFF:./lib/core/TikiDb/Pdo.php:~~
~~ ,transparent:class TikiDb_Pdo extends TikiDb~~
~~ ,transparent:function ~~~~ ,transparent:__query($query__~~~~ ,transparent: = null, ~~~~ ,#F4CCCC:__$values__~~~~ ,transparent: = null, $numrows = -1, $offset = -1, $reporterrors = true ) // {{{~~
~~ ,transparent:    $result = $this->~~~~ ,transparent:___query($query__~~~~ ,transparent:, ~~~~ ,#F4CCCC:__$values__~~~~ ,transparent:, $numrows, $offset);~~
~~ ,transparent:private function ~~~~ ,transparent:___query__~~~~ ,transparent:(~~~~ ,transparent:__$query__~~~~ ,transparent:, ~~~~ ,#F4CCCC:__$values__~~~~ ,transparent: = null, $numrows = -1, $offset = -1) // {{{~~
~~ ,transparent:    if ($values) {~~
~~ ,transparent:        if ( @ ~~~~ ,transparent:__$pq__~~~~ ,transparent: = $this->db->~~~~ ,transparent:__prepare__~~~~ ,transparent:(~~~~ ,transparent:__$query__~~~~ ,transparent:) ) {~~
~~ ,transparent:            $result = ~~~~ ,transparent:__$pq__~~~~ ,transparent:->~~~~ ,transparent:__execute__~~~~ ,transparent:(~~~~ ,#F4CCCC:__$values__~~~~ ,transparent:);~~

 

 

~~ ,transparent:See also: ~~((Login documentation))