@@ -14,18 +14,18 @@ class App extends BaseConfig
1414 * URL to your CodeIgniter root. Typically, this will be your base URL,
1515 * WITH a trailing slash:
1616 *
17- * http://example.com/
17+ * E.g., http://example.com/
1818 */
1919 public string $ baseURL'http://localhost:8080/ ' ;
2020
2121 /**
2222 * Allowed Hostnames in the Site URL other than the hostname in the baseURL.
2323 * If you want to accept multiple Hostnames, set this.
2424 *
25- * E.g. When your site URL ($baseURL) is 'http://example.com/', and your site
26- * also accepts 'http://media. example.com/' and
27- * 'http://accounts.example.com/':
28- * ['media.example.com', 'accounts.example.com']
25+ * E.g.,
26+ * When your site URL ($baseURL) is 'http://example.com/', and your site
27+ * also accepts 'http://media.example.com/' and 'http://accounts.example.com/':
28+ * ['media.example.com', 'accounts.example.com']
2929 *
3030 * @var list<string>
3131 */
@@ -36,9 +36,9 @@ class App extends BaseConfig
3636 * Index File
3737 * --------------------------------------------------------------------------
3838 *
39- * Typically this will be your index.php file, unless you've renamed it to
40- * something else. If you are using mod_rewrite to remove the page set this
41- * variable so that it is blank .
39+ * Typically, this will be your ` index.php` file, unless you've renamed it to
40+ * something else. If you have configured your web server to remove this file
41+ * from your site URIs, set this variable to an empty string .
4242 */
4343 public string $ indexPage'index.php ' ;
4444
@@ -48,17 +48,41 @@ class App extends BaseConfig
4848 * --------------------------------------------------------------------------
4949 *
5050 * This item determines which server global should be used to retrieve the
51- * URI string. The default setting of 'REQUEST_URI' works for most servers.
51+ * URI string. The default setting of 'REQUEST_URI' works for most servers.
5252 * If your links do not seem to work, try one of the other delicious flavors:
5353 *
54- * 'REQUEST_URI' Uses $_SERVER['REQUEST_URI']
55- * 'QUERY_STRING' Uses $_SERVER['QUERY_STRING']
56- * 'PATH_INFO' Uses $_SERVER['PATH_INFO']
54+ * 'REQUEST_URI': Uses $_SERVER['REQUEST_URI']
55+ * 'QUERY_STRING': Uses $_SERVER['QUERY_STRING']
56+ * 'PATH_INFO': Uses $_SERVER['PATH_INFO']
5757 *
5858 * WARNING: If you set this to 'PATH_INFO', URIs will always be URL-decoded!
5959 */
6060 public string $ uriProtocol'REQUEST_URI ' ;
6161
62+ /*
63+ |--------------------------------------------------------------------------
64+ | Allowed URL Characters
65+ |--------------------------------------------------------------------------
66+ |
67+ | This lets you specify which characters are permitted within your URLs.
68+ | When someone tries to submit a URL with disallowed characters they will
69+ | get a warning message.
70+ |
71+ | As a security measure you are STRONGLY encouraged to restrict URLs to
72+ | as few characters as possible.
73+ |
74+ | By default, only these are allowed: `a-z 0-9~%.:_-`
75+ |
76+ | Set an empty string to allow all characters -- but only if you are insane.
77+ |
78+ | The configured value is actually a regular expression character group
79+ | and it will be used as: '/\A[<permittedURIChars>]+\z/iu'
80+ |
81+ | DO NOT CHANGE THIS UNLESS YOU FULLY UNDERSTAND THE REPERCUSSIONS!!
82+ |
83+ */
84+ public string $ permittedURIChars'a-z 0-9~%.:_\- ' ;
85+
6286 /**
6387 * --------------------------------------------------------------------------
6488 * Default Locale
@@ -94,7 +118,7 @@ class App extends BaseConfig
94118 *
95119 * IncomingRequest::setLocale() also uses this list.
96120 *
97- * @var string[]
121+ * @var list< string>
98122 */
99123 public array $ supportedLocales'en ' ];
100124
@@ -106,7 +130,8 @@ class App extends BaseConfig
106130 * The default timezone that will be used in your application to display
107131 * dates with the date helper, and can be retrieved through app_timezone()
108132 *
109- * @see https://www.php.net/manual/en/timezones.php for list of timezones supported by PHP.
133+ * @see https://www.php.net/manual/en/timezones.php for list of timezones
134+ * supported by PHP.
110135 */
111136 public string $ appTimezone'UTC ' ;
112137
@@ -130,7 +155,7 @@ class App extends BaseConfig
130155 * If true, this will force every request made to this application to be
131156 * made via a secure connection (HTTPS). If the incoming request is not
132157 * secure, the user will be redirected to a secure version of the page
133- * and the HTTP Strict Transport Security header will be set.
158+ * and the HTTP Strict Transport Security (HSTS) header will be set.
134159 */
135160 public bool $ forceGlobalSecureRequestsfalse ;
136161
0 commit comments