After the release, there were some unpleasant errors . We work.
CHtmlCHtml :CHtml::dateField()CHtml::rangeField()CHtml::numberField()CHtml::emailField()CHtml::urlField()CHtml::activeDateField()CHtml::activeRangeField()CHtml::activeNumberField()CHtml::activeEmailField()CHtml::activeUrlField() echo CHtml::activeNumberField($model, 'fieldName'); CFormatter::formatSize() echo Yii::app()->format->formatSize(115969); // : 113.25 KB integer from the action of the console application. The value will be used as a return code.CJavaScript::encode() and js:CJavaScript::encode() and took a value from a form or URL, your application is most likely vulnerable. To close the vulnerability, you need to pass the second parameter true : CJavaScript::encode($userInput, true); js: prefix. If you still need to pass a JavaScript expression, frame it with CJavaScriptExpression : CJavaScript::encode(new CJavaScriptExpression('alert("Yii!");'), true); safe ) does not affect the behavior of CJavaScriptExpression . public function filters() { return array( array( 'CHttpCacheFilter + index', 'lastModified'=>Yii::app()->db->createCommand("SELECT MAX(`update_time`) FROM {{post}}")->queryScalar(), ), ); } except parameter that contains a list of scripts. The syntax is the same as on : // ( ) array('username', 'required', 'except'=>'ignore, this, scenarios, at-all',) Source: https://habr.com/ru/post/148761/
All Articles