├── .gitignore ├── LICENSE ├── README.md ├── app ├── .htaccess ├── Common.php ├── Config │ ├── App.php │ ├── Autoload.php │ ├── Boot │ │ ├── development.php │ │ ├── production.php │ │ └── testing.php │ ├── CURLRequest.php │ ├── Cache.php │ ├── Constants.php │ ├── ContentSecurityPolicy.php │ ├── Cookie.php │ ├── Cors.php │ ├── Database.php │ ├── DocTypes.php │ ├── Email.php │ ├── Encryption.php │ ├── Events.php │ ├── Exceptions.php │ ├── Feature.php │ ├── Filters.php │ ├── ForeignCharacters.php │ ├── Format.php │ ├── Generators.php │ ├── Honeypot.php │ ├── Images.php │ ├── Kint.php │ ├── Logger.php │ ├── Migrations.php │ ├── Mimes.php │ ├── Modules.php │ ├── Optimize.php │ ├── Pager.php │ ├── Paths.php │ ├── Publisher.php │ ├── Routes.php │ ├── Routing.php │ ├── Security.php │ ├── Services.php │ ├── Session.php │ ├── Toolbar.php │ ├── UserAgents.php │ ├── Validation.php │ └── View.php ├── Controllers │ ├── BaseController.php │ └── Home.php ├── Database │ ├── Migrations │ │ └── .gitkeep │ └── Seeds │ │ └── .gitkeep ├── Filters │ └── .gitkeep ├── Helpers │ └── .gitkeep ├── Language │ ├── .gitkeep │ └── en │ │ └── Validation.php ├── Libraries │ └── .gitkeep ├── Models │ └── .gitkeep ├── ThirdParty │ └── .gitkeep ├── Views │ ├── errors │ │ ├── cli │ │ │ ├── error_404.php │ │ │ ├── error_exception.php │ │ │ └── production.php │ │ └── html │ │ │ ├── debug.css │ │ │ ├── debug.js │ │ │ ├── error_400.php │ │ │ ├── error_404.php │ │ │ ├── error_exception.php │ │ │ └── production.php │ └── welcome_message.php └── index.html ├── builds ├── composer.json ├── env ├── phpunit.xml.dist ├── preload.php ├── public ├── .htaccess ├── favicon.ico ├── index.php └── robots.txt ├── spark ├── tests ├── .htaccess ├── README.md ├── _support │ ├── Database │ │ ├── Migrations │ │ │ └── 2020-02-22-222222_example_migration.php │ │ └── Seeds │ │ │ └── ExampleSeeder.php │ ├── Libraries │ │ └── ConfigReader.php │ └── Models │ │ └── ExampleModel.php ├── database │ └── ExampleDatabaseTest.php ├── index.html ├── session │ └── ExampleSessionTest.php └── unit │ └── HealthTest.php └── writable ├── .htaccess ├── cache └── index.html ├── index.html ├── logs └── index.html ├── session └── index.html └── uploads └── index.html /.gitignore: -------------------------------------------------------------------------------- 1 | #------------------------- 2 | # Operating Specific Junk Files 3 | #------------------------- 4 | 5 | # OS X 6 | .DS_Store 7 | .AppleDouble 8 | .LSOverride 9 | 10 | # OS X Thumbnails 11 | ._* 12 | 13 | # Windows image file caches 14 | Thumbs.db 15 | ehthumbs.db 16 | Desktop.ini 17 | 18 | # Recycle Bin used on file shares 19 | $RECYCLE.BIN/ 20 | 21 | # Windows Installer files 22 | *.cab 23 | *.msi 24 | *.msm 25 | *.msp 26 | 27 | # Windows shortcuts 28 | *.lnk 29 | 30 | # Linux 31 | *~ 32 | 33 | # KDE directory preferences 34 | .directory 35 | 36 | # Linux trash folder which might appear on any partition or disk 37 | .Trash-* 38 | 39 | #------------------------- 40 | # Environment Files 41 | #------------------------- 42 | # These should never be under version control, 43 | # as it poses a security risk. 44 | .env 45 | .vagrant 46 | Vagrantfile 47 | 48 | #------------------------- 49 | # Temporary Files 50 | #------------------------- 51 | writable/cache/* 52 | !writable/cache/index.html 53 | 54 | writable/logs/* 55 | !writable/logs/index.html 56 | 57 | writable/session/* 58 | !writable/session/index.html 59 | 60 | writable/uploads/* 61 | !writable/uploads/index.html 62 | 63 | writable/debugbar/* 64 | !writable/debugbar/.gitkeep 65 | 66 | php_errors.log 67 | 68 | #------------------------- 69 | # User Guide Temp Files 70 | #------------------------- 71 | user_guide_src/build/* 72 | user_guide_src/cilexer/build/* 73 | user_guide_src/cilexer/dist/* 74 | user_guide_src/cilexer/pycilexer.egg-info/* 75 | 76 | #------------------------- 77 | # Test Files 78 | #------------------------- 79 | tests/coverage* 80 | 81 | # Don't save phpunit under version control. 82 | phpunit 83 | 84 | #------------------------- 85 | # Composer 86 | #------------------------- 87 | vendor/ 88 | 89 | #------------------------- 90 | # IDE / Development Files 91 | #------------------------- 92 | 93 | # Modules Testing 94 | _modules/* 95 | 96 | # phpenv local config 97 | .php-version 98 | 99 | # Jetbrains editors (PHPStorm, etc) 100 | .idea/ 101 | *.iml 102 | 103 | # NetBeans 104 | /nbproject/ 105 | /build/ 106 | /nbbuild/ 107 | /dist/ 108 | /nbdist/ 109 | /nbactions.xml 110 | /nb-configuration.xml 111 | /.nb-gradle/ 112 | 113 | # Sublime Text 114 | *.tmlanguage.cache 115 | *.tmPreferences.cache 116 | *.stTheme.cache 117 | *.sublime-workspace 118 | *.sublime-project 119 | .phpintel 120 | /api/ 121 | 122 | # Visual Studio Code 123 | .vscode/ 124 | 125 | /results/ 126 | /phpunit*.xml 127 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | The MIT License (MIT) 2 | 3 | Copyright (c) 2014-2019 British Columbia Institute of Technology 4 | Copyright (c) 2019-present CodeIgniter Foundation 5 | 6 | Permission is hereby granted, free of charge, to any person obtaining a copy 7 | of this software and associated documentation files (the "Software"), to deal 8 | in the Software without restriction, including without limitation the rights 9 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | copies of the Software, and to permit persons to whom the Software is 11 | furnished to do so, subject to the following conditions: 12 | 13 | The above copyright notice and this permission notice shall be included in 14 | all copies or substantial portions of the Software. 15 | 16 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | THE SOFTWARE. 23 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # CodeIgniter 4 Application Starter 2 | 3 | ## What is CodeIgniter? 4 | 5 | CodeIgniter is a PHP full-stack web framework that is light, fast, flexible and secure. 6 | More information can be found at the [official site](https://codeigniter.com). 7 | 8 | This repository holds a composer-installable app starter. 9 | It has been built from the 10 | [development repository](https://github.com/codeigniter4/CodeIgniter4). 11 | 12 | More information about the plans for version 4 can be found in [CodeIgniter 4](https://forum.codeigniter.com/forumdisplay.php?fid=28) on the forums. 13 | 14 | You can read the [user guide](https://codeigniter.com/user_guide/) 15 | corresponding to the latest version of the framework. 16 | 17 | ## Installation & updates 18 | 19 | `composer create-project codeigniter4/appstarter` then `composer update` whenever 20 | there is a new release of the framework. 21 | 22 | When updating, check the release notes to see if there are any changes you might need to apply 23 | to your `app` folder. The affected files can be copied or merged from 24 | `vendor/codeigniter4/framework/app`. 25 | 26 | ## Setup 27 | 28 | Copy `env` to `.env` and tailor for your app, specifically the baseURL 29 | and any database settings. 30 | 31 | ## Important Change with index.php 32 | 33 | `index.php` is no longer in the root of the project! It has been moved inside the *public* folder, 34 | for better security and separation of components. 35 | 36 | This means that you should configure your web server to "point" to your project's *public* folder, and 37 | not to the project root. A better practice would be to configure a virtual host to point there. A poor practice would be to point your web server to the project root and expect to enter *public/...*, as the rest of your logic and the 38 | framework are exposed. 39 | 40 | **Please** read the user guide for a better explanation of how CI4 works! 41 | 42 | ## Repository Management 43 | 44 | We use GitHub issues, in our main repository, to track **BUGS** and to track approved **DEVELOPMENT** work packages. 45 | We use our [forum](http://forum.codeigniter.com) to provide SUPPORT and to discuss 46 | FEATURE REQUESTS. 47 | 48 | This repository is a "distribution" one, built by our release preparation script. 49 | Problems with it can be raised on our forum, or as issues in the main repository. 50 | 51 | ## Server Requirements 52 | 53 | PHP version 8.1 or higher is required, with the following extensions installed: 54 | 55 | - [intl](http://php.net/manual/en/intl.requirements.php) 56 | - [mbstring](http://php.net/manual/en/mbstring.installation.php) 57 | 58 | > [!WARNING] 59 | > - The end of life date for PHP 7.4 was November 28, 2022. 60 | > - The end of life date for PHP 8.0 was November 26, 2023. 61 | > - If you are still using PHP 7.4 or 8.0, you should upgrade immediately. 62 | > - The end of life date for PHP 8.1 will be December 31, 2025. 63 | 64 | Additionally, make sure that the following extensions are enabled in your PHP: 65 | 66 | - json (enabled by default - don't turn it off) 67 | - [mysqlnd](http://php.net/manual/en/mysqlnd.install.php) if you plan to use MySQL 68 | - [libcurl](http://php.net/manual/en/curl.requirements.php) if you plan to use the HTTP\CURLRequest library 69 | -------------------------------------------------------------------------------- /app/.htaccess: -------------------------------------------------------------------------------- 1 | 2 | Require all denied 3 | 4 | 5 | Deny from all 6 | 7 | -------------------------------------------------------------------------------- /app/Common.php: -------------------------------------------------------------------------------- 1 | 31 | */ 32 | public array $allowedHostnames = []; 33 | 34 | /** 35 | * -------------------------------------------------------------------------- 36 | * Index File 37 | * -------------------------------------------------------------------------- 38 | * 39 | * Typically, this will be your `index.php` file, unless you've renamed it to 40 | * something else. If you have configured your web server to remove this file 41 | * from your site URIs, set this variable to an empty string. 42 | */ 43 | public string $indexPage = 'index.php'; 44 | 45 | /** 46 | * -------------------------------------------------------------------------- 47 | * URI PROTOCOL 48 | * -------------------------------------------------------------------------- 49 | * 50 | * This item determines which server global should be used to retrieve the 51 | * URI string. The default setting of 'REQUEST_URI' works for most servers. 52 | * If your links do not seem to work, try one of the other delicious flavors: 53 | * 54 | * 'REQUEST_URI': Uses $_SERVER['REQUEST_URI'] 55 | * 'QUERY_STRING': Uses $_SERVER['QUERY_STRING'] 56 | * 'PATH_INFO': Uses $_SERVER['PATH_INFO'] 57 | * 58 | * WARNING: If you set this to 'PATH_INFO', URIs will always be URL-decoded! 59 | */ 60 | public string $uriProtocol = 'REQUEST_URI'; 61 | 62 | /* 63 | |-------------------------------------------------------------------------- 64 | | Allowed URL Characters 65 | |-------------------------------------------------------------------------- 66 | | 67 | | This lets you specify which characters are permitted within your URLs. 68 | | When someone tries to submit a URL with disallowed characters they will 69 | | get a warning message. 70 | | 71 | | As a security measure you are STRONGLY encouraged to restrict URLs to 72 | | as few characters as possible. 73 | | 74 | | By default, only these are allowed: `a-z 0-9~%.:_-` 75 | | 76 | | Set an empty string to allow all characters -- but only if you are insane. 77 | | 78 | | The configured value is actually a regular expression character group 79 | | and it will be used as: '/\A[]+\z/iu' 80 | | 81 | | DO NOT CHANGE THIS UNLESS YOU FULLY UNDERSTAND THE REPERCUSSIONS!! 82 | | 83 | */ 84 | public string $permittedURIChars = 'a-z 0-9~%.:_\-'; 85 | 86 | /** 87 | * -------------------------------------------------------------------------- 88 | * Default Locale 89 | * -------------------------------------------------------------------------- 90 | * 91 | * The Locale roughly represents the language and location that your visitor 92 | * is viewing the site from. It affects the language strings and other 93 | * strings (like currency markers, numbers, etc), that your program 94 | * should run under for this request. 95 | */ 96 | public string $defaultLocale = 'en'; 97 | 98 | /** 99 | * -------------------------------------------------------------------------- 100 | * Negotiate Locale 101 | * -------------------------------------------------------------------------- 102 | * 103 | * If true, the current Request object will automatically determine the 104 | * language to use based on the value of the Accept-Language header. 105 | * 106 | * If false, no automatic detection will be performed. 107 | */ 108 | public bool $negotiateLocale = false; 109 | 110 | /** 111 | * -------------------------------------------------------------------------- 112 | * Supported Locales 113 | * -------------------------------------------------------------------------- 114 | * 115 | * If $negotiateLocale is true, this array lists the locales supported 116 | * by the application in descending order of priority. If no match is 117 | * found, the first locale will be used. 118 | * 119 | * IncomingRequest::setLocale() also uses this list. 120 | * 121 | * @var list 122 | */ 123 | public array $supportedLocales = ['en']; 124 | 125 | /** 126 | * -------------------------------------------------------------------------- 127 | * Application Timezone 128 | * -------------------------------------------------------------------------- 129 | * 130 | * The default timezone that will be used in your application to display 131 | * dates with the date helper, and can be retrieved through app_timezone() 132 | * 133 | * @see https://www.php.net/manual/en/timezones.php for list of timezones 134 | * supported by PHP. 135 | */ 136 | public string $appTimezone = 'UTC'; 137 | 138 | /** 139 | * -------------------------------------------------------------------------- 140 | * Default Character Set 141 | * -------------------------------------------------------------------------- 142 | * 143 | * This determines which character set is used by default in various methods 144 | * that require a character set to be provided. 145 | * 146 | * @see http://php.net/htmlspecialchars for a list of supported charsets. 147 | */ 148 | public string $charset = 'UTF-8'; 149 | 150 | /** 151 | * -------------------------------------------------------------------------- 152 | * Force Global Secure Requests 153 | * -------------------------------------------------------------------------- 154 | * 155 | * If true, this will force every request made to this application to be 156 | * made via a secure connection (HTTPS). If the incoming request is not 157 | * secure, the user will be redirected to a secure version of the page 158 | * and the HTTP Strict Transport Security (HSTS) header will be set. 159 | */ 160 | public bool $forceGlobalSecureRequests = false; 161 | 162 | /** 163 | * -------------------------------------------------------------------------- 164 | * Reverse Proxy IPs 165 | * -------------------------------------------------------------------------- 166 | * 167 | * If your server is behind a reverse proxy, you must whitelist the proxy 168 | * IP addresses from which CodeIgniter should trust headers such as 169 | * X-Forwarded-For or Client-IP in order to properly identify 170 | * the visitor's IP address. 171 | * 172 | * You need to set a proxy IP address or IP address with subnets and 173 | * the HTTP header for the client IP address. 174 | * 175 | * Here are some examples: 176 | * [ 177 | * '10.0.1.200' => 'X-Forwarded-For', 178 | * '192.168.5.0/24' => 'X-Real-IP', 179 | * ] 180 | * 181 | * @var array 182 | */ 183 | public array $proxyIPs = []; 184 | 185 | /** 186 | * -------------------------------------------------------------------------- 187 | * Content Security Policy 188 | * -------------------------------------------------------------------------- 189 | * 190 | * Enables the Response's Content Secure Policy to restrict the sources that 191 | * can be used for images, scripts, CSS files, audio, video, etc. If enabled, 192 | * the Response object will populate default values for the policy from the 193 | * `ContentSecurityPolicy.php` file. Controllers can always add to those 194 | * restrictions at run time. 195 | * 196 | * For a better understanding of CSP, see these documents: 197 | * 198 | * @see http://www.html5rocks.com/en/tutorials/security/content-security-policy/ 199 | * @see http://www.w3.org/TR/CSP/ 200 | */ 201 | public bool $CSPEnabled = false; 202 | } 203 | -------------------------------------------------------------------------------- /app/Config/Autoload.php: -------------------------------------------------------------------------------- 1 | |string> 39 | */ 40 | public $psr4 = [ 41 | APP_NAMESPACE => APPPATH, 42 | ]; 43 | 44 | /** 45 | * ------------------------------------------------------------------- 46 | * Class Map 47 | * ------------------------------------------------------------------- 48 | * The class map provides a map of class names and their exact 49 | * location on the drive. Classes loaded in this manner will have 50 | * slightly faster performance because they will not have to be 51 | * searched for within one or more directories as they would if they 52 | * were being autoloaded through a namespace. 53 | * 54 | * Prototype: 55 | * $classmap = [ 56 | * 'MyClass' => '/path/to/class/file.php' 57 | * ]; 58 | * 59 | * @var array 60 | */ 61 | public $classmap = []; 62 | 63 | /** 64 | * ------------------------------------------------------------------- 65 | * Files 66 | * ------------------------------------------------------------------- 67 | * The files array provides a list of paths to __non-class__ files 68 | * that will be autoloaded. This can be useful for bootstrap operations 69 | * or for loading functions. 70 | * 71 | * Prototype: 72 | * $files = [ 73 | * '/path/to/my/file.php', 74 | * ]; 75 | * 76 | * @var list 77 | */ 78 | public $files = []; 79 | 80 | /** 81 | * ------------------------------------------------------------------- 82 | * Helpers 83 | * ------------------------------------------------------------------- 84 | * Prototype: 85 | * $helpers = [ 86 | * 'form', 87 | * ]; 88 | * 89 | * @var list 90 | */ 91 | public $helpers = []; 92 | } 93 | -------------------------------------------------------------------------------- /app/Config/Boot/development.php: -------------------------------------------------------------------------------- 1 | 82 | */ 83 | public array $file = [ 84 | 'storePath' => WRITEPATH . 'cache/', 85 | 'mode' => 0640, 86 | ]; 87 | 88 | /** 89 | * ------------------------------------------------------------------------- 90 | * Memcached settings 91 | * ------------------------------------------------------------------------- 92 | * 93 | * Your Memcached servers can be specified below, if you are using 94 | * the Memcached drivers. 95 | * 96 | * @see https://codeigniter.com/user_guide/libraries/caching.html#memcached 97 | * 98 | * @var array 99 | */ 100 | public array $memcached = [ 101 | 'host' => '127.0.0.1', 102 | 'port' => 11211, 103 | 'weight' => 1, 104 | 'raw' => false, 105 | ]; 106 | 107 | /** 108 | * ------------------------------------------------------------------------- 109 | * Redis settings 110 | * ------------------------------------------------------------------------- 111 | * 112 | * Your Redis server can be specified below, if you are using 113 | * the Redis or Predis drivers. 114 | * 115 | * @var array 116 | */ 117 | public array $redis = [ 118 | 'host' => '127.0.0.1', 119 | 'password' => null, 120 | 'port' => 6379, 121 | 'timeout' => 0, 122 | 'database' => 0, 123 | ]; 124 | 125 | /** 126 | * -------------------------------------------------------------------------- 127 | * Available Cache Handlers 128 | * -------------------------------------------------------------------------- 129 | * 130 | * This is an array of cache engine alias' and class names. Only engines 131 | * that are listed here are allowed to be used. 132 | * 133 | * @var array> 134 | */ 135 | public array $validHandlers = [ 136 | 'dummy' => DummyHandler::class, 137 | 'file' => FileHandler::class, 138 | 'memcached' => MemcachedHandler::class, 139 | 'predis' => PredisHandler::class, 140 | 'redis' => RedisHandler::class, 141 | 'wincache' => WincacheHandler::class, 142 | ]; 143 | 144 | /** 145 | * -------------------------------------------------------------------------- 146 | * Web Page Caching: Cache Include Query String 147 | * -------------------------------------------------------------------------- 148 | * 149 | * Whether to take the URL query string into consideration when generating 150 | * output cache files. Valid options are: 151 | * 152 | * false = Disabled 153 | * true = Enabled, take all query parameters into account. 154 | * Please be aware that this may result in numerous cache 155 | * files generated for the same page over and over again. 156 | * ['q'] = Enabled, but only take into account the specified list 157 | * of query parameters. 158 | * 159 | * @var bool|list 160 | */ 161 | public $cacheQueryString = false; 162 | } 163 | -------------------------------------------------------------------------------- /app/Config/Constants.php: -------------------------------------------------------------------------------- 1 | |string|null 49 | */ 50 | public $defaultSrc; 51 | 52 | /** 53 | * Lists allowed scripts' URLs. 54 | * 55 | * @var list|string 56 | */ 57 | public $scriptSrc = 'self'; 58 | 59 | /** 60 | * Lists allowed stylesheets' URLs. 61 | * 62 | * @var list|string 63 | */ 64 | public $styleSrc = 'self'; 65 | 66 | /** 67 | * Defines the origins from which images can be loaded. 68 | * 69 | * @var list|string 70 | */ 71 | public $imageSrc = 'self'; 72 | 73 | /** 74 | * Restricts the URLs that can appear in a page's `` element. 75 | * 76 | * Will default to self if not overridden 77 | * 78 | * @var list|string|null 79 | */ 80 | public $baseURI; 81 | 82 | /** 83 | * Lists the URLs for workers and embedded frame contents 84 | * 85 | * @var list|string 86 | */ 87 | public $childSrc = 'self'; 88 | 89 | /** 90 | * Limits the origins that you can connect to (via XHR, 91 | * WebSockets, and EventSource). 92 | * 93 | * @var list|string 94 | */ 95 | public $connectSrc = 'self'; 96 | 97 | /** 98 | * Specifies the origins that can serve web fonts. 99 | * 100 | * @var list|string 101 | */ 102 | public $fontSrc; 103 | 104 | /** 105 | * Lists valid endpoints for submission from `
` tags. 106 | * 107 | * @var list|string 108 | */ 109 | public $formAction = 'self'; 110 | 111 | /** 112 | * Specifies the sources that can embed the current page. 113 | * This directive applies to ``, `