• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

codeigniter4 / CodeIgniter4 / 24916575916

24 Apr 2026 11:31PM UTC coverage: 88.199%. First build
24916575916

Pull #10139

github

web-flow
Merge bf6f06bfa into 91f2cb0db
Pull Request #10139: fix: reset Kint CSP state in worker mode

7 of 10 new or added lines in 1 file covered. (70.0%)

22115 of 25074 relevant lines covered (88.2%)

208.75 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

87.05
/system/CodeIgniter.php
1
<?php
2

3
/**
4
 * This file is part of CodeIgniter 4 framework.
5
 *
6
 * (c) CodeIgniter Foundation <admin@codeigniter.com>
7
 *
8
 * For the full copyright and license information, please view
9
 * the LICENSE file that was distributed with this source code.
10
 */
11

12
namespace CodeIgniter;
13

14
use Closure;
15
use CodeIgniter\Cache\ResponseCache;
16
use CodeIgniter\Debug\Timer;
17
use CodeIgniter\Events\Events;
18
use CodeIgniter\Exceptions\LogicException;
19
use CodeIgniter\Exceptions\PageNotFoundException;
20
use CodeIgniter\Filters\Filters;
21
use CodeIgniter\HTTP\CLIRequest;
22
use CodeIgniter\HTTP\DownloadResponse;
23
use CodeIgniter\HTTP\Exceptions\RedirectException;
24
use CodeIgniter\HTTP\IncomingRequest;
25
use CodeIgniter\HTTP\Method;
26
use CodeIgniter\HTTP\RedirectResponse;
27
use CodeIgniter\HTTP\Request;
28
use CodeIgniter\HTTP\RequestInterface;
29
use CodeIgniter\HTTP\ResponsableInterface;
30
use CodeIgniter\HTTP\ResponseInterface;
31
use CodeIgniter\HTTP\URI;
32
use CodeIgniter\Router\RouteCollectionInterface;
33
use CodeIgniter\Router\Router;
34
use Config\App;
35
use Config\Cache;
36
use Config\Feature;
37
use Config\Kint as KintConfig;
38
use Config\Services;
39
use Exception;
40
use Kint;
41
use Kint\Renderer\CliRenderer;
42
use Kint\Renderer\RichRenderer;
43
use Locale;
44
use Throwable;
45

46
/**
47
 * This class is the core of the framework, and will analyse the
48
 * request, route it to a controller, and send back the response.
49
 * Of course, there are variations to that flow, but this is the brains.
50
 *
51
 * @see \CodeIgniter\CodeIgniterTest
52
 */
53
class CodeIgniter
54
{
55
    /**
56
     * The current version of CodeIgniter Framework
57
     */
58
    public const CI_VERSION = '4.7.3-dev';
59

60
    /**
61
     * App startup time.
62
     *
63
     * @var float|null
64
     */
65
    protected $startTime;
66

67
    /**
68
     * Total app execution time
69
     *
70
     * @var float
71
     */
72
    protected $totalTime;
73

74
    /**
75
     * Main application configuration
76
     *
77
     * @var App
78
     */
79
    protected $config;
80

81
    /**
82
     * Timer instance.
83
     *
84
     * @var Timer
85
     */
86
    protected $benchmark;
87

88
    /**
89
     * Current request.
90
     *
91
     * @var CLIRequest|IncomingRequest|null
92
     */
93
    protected $request;
94

95
    /**
96
     * Current response.
97
     *
98
     * @var ResponseInterface|null
99
     */
100
    protected $response;
101

102
    /**
103
     * Router to use.
104
     *
105
     * @var Router|null
106
     */
107
    protected $router;
108

109
    /**
110
     * Controller to use.
111
     *
112
     * @var (Closure(mixed...): ResponseInterface|string)|string|null
113
     */
114
    protected $controller;
115

116
    /**
117
     * Controller method to invoke.
118
     *
119
     * @var string|null
120
     */
121
    protected $method;
122

123
    /**
124
     * Output handler to use.
125
     *
126
     * @var string|null
127
     */
128
    protected $output;
129

130
    /**
131
     * Cache expiration time
132
     *
133
     * @var int seconds
134
     *
135
     * @deprecated 4.4.0 Moved to ResponseCache::$ttl. No longer used.
136
     */
137
    protected static $cacheTTL = 0;
138

139
    /**
140
     * Context
141
     *  web:     Invoked by HTTP request
142
     *  php-cli: Invoked by CLI via `php public/index.php`
143
     *
144
     * @var 'php-cli'|'web'|null
145
     */
146
    protected ?string $context = null;
147

148
    /**
149
     * Whether to enable Control Filters.
150
     */
151
    protected bool $enableFilters = true;
152

153
    /**
154
     * Whether to return Response object or send response.
155
     *
156
     * @deprecated 4.4.0 No longer used.
157
     */
158
    protected bool $returnResponse = false;
159

160
    /**
161
     * Application output buffering level
162
     */
163
    protected int $bufferLevel;
164

165
    /**
166
     * Web Page Caching
167
     */
168
    protected ResponseCache $pageCache;
169

170
    /**
171
     * Constructor.
172
     */
173
    public function __construct(App $config)
174
    {
175
        $this->startTime = microtime(true);
7,237✔
176
        $this->config    = $config;
7,237✔
177

178
        $this->pageCache = Services::responsecache();
7,237✔
179
    }
180

181
    /**
182
     * Handles some basic app and environment setup.
183
     *
184
     * @return void
185
     */
186
    public function initialize()
187
    {
188
        // Set default locale on the server
189
        Locale::setDefault($this->config->defaultLocale);
7,237✔
190

191
        // Set default timezone on the server
192
        date_default_timezone_set($this->config->appTimezone);
7,237✔
193
    }
194

195
    /**
196
     * Reset request-specific state for worker mode.
197
     * Clears all request/response data to prepare for the next request.
198
     */
199
    public function resetForWorkerMode(): void
200
    {
201
        $this->request    = null;
1✔
202
        $this->response   = null;
1✔
203
        $this->router     = null;
1✔
204
        $this->controller = null;
1✔
205
        $this->method     = null;
1✔
206
        $this->output     = null;
1✔
207

208
        // Reset timing
209
        $this->startTime = null;
1✔
210
        $this->totalTime = 0;
1✔
211

212
        $this->resetKintForWorkerMode();
1✔
213
    }
214

215
    /**
216
     * Resets Kint request-specific state for worker mode.
217
     */
218
    private function resetKintForWorkerMode(): void
219
    {
220
        if (! CI_DEBUG || ! class_exists(Kint::class, false)) {
1✔
NEW
221
            return;
×
222
        }
223

224
        $csp = service('csp');
1✔
225
        if ($csp->enabled()) {
1✔
226
            RichRenderer::$js_nonce  = $csp->getScriptNonce();
1✔
227
            RichRenderer::$css_nonce = $csp->getStyleNonce();
1✔
228
        } else {
NEW
229
            RichRenderer::$js_nonce  = null;
×
NEW
230
            RichRenderer::$css_nonce = null;
×
231
        }
232

233
        RichRenderer::$needs_pre_render = true;
1✔
234
    }
235

236
    /**
237
     * Initializes Kint
238
     *
239
     * @return void
240
     *
241
     * @deprecated 4.5.0 Moved to Autoloader.
242
     */
243
    protected function initializeKint()
244
    {
245
        if (CI_DEBUG) {
246
            $this->autoloadKint();
247
            $this->configureKint();
248
        } elseif (class_exists(Kint::class)) {
249
            // In case that Kint is already loaded via Composer.
250
            Kint::$enabled_mode = false;
251
            // @codeCoverageIgnore
252
        }
253

254
        helper('kint');
255
    }
256

257
    /**
258
     * @deprecated 4.5.0 Moved to Autoloader.
259
     */
260
    private function autoloadKint(): void
261
    {
262
        // If we have KINT_DIR it means it's already loaded via composer
263
        if (! defined('KINT_DIR')) {
264
            spl_autoload_register(function ($class): void {
265
                $class = explode('\\', $class);
266

267
                if (array_shift($class) !== 'Kint') {
268
                    return;
269
                }
270

271
                $file = SYSTEMPATH . 'ThirdParty/Kint/' . implode('/', $class) . '.php';
272

273
                if (is_file($file)) {
274
                    require_once $file;
275
                }
276
            });
277

278
            require_once SYSTEMPATH . 'ThirdParty/Kint/init.php';
279
        }
280
    }
281

282
    /**
283
     * @deprecated 4.5.0 Moved to Autoloader.
284
     */
285
    private function configureKint(): void
286
    {
287
        $config = new KintConfig();
288

289
        Kint::$depth_limit         = $config->maxDepth;
290
        Kint::$display_called_from = $config->displayCalledFrom;
291
        Kint::$expanded            = $config->expanded;
292

293
        if (isset($config->plugins) && is_array($config->plugins)) {
294
            Kint::$plugins = $config->plugins;
295
        }
296

297
        $csp = Services::csp();
298
        if ($csp->enabled()) {
299
            RichRenderer::$js_nonce  = $csp->getScriptNonce();
300
            RichRenderer::$css_nonce = $csp->getStyleNonce();
301
        }
302

303
        RichRenderer::$theme  = $config->richTheme;
304
        RichRenderer::$folder = $config->richFolder;
305

306
        if (isset($config->richObjectPlugins) && is_array($config->richObjectPlugins)) {
307
            RichRenderer::$value_plugins = $config->richObjectPlugins;
308
        }
309
        if (isset($config->richTabPlugins) && is_array($config->richTabPlugins)) {
310
            RichRenderer::$tab_plugins = $config->richTabPlugins;
311
        }
312

313
        CliRenderer::$cli_colors         = $config->cliColors;
314
        CliRenderer::$force_utf8         = $config->cliForceUTF8;
315
        CliRenderer::$detect_width       = $config->cliDetectWidth;
316
        CliRenderer::$min_terminal_width = $config->cliMinWidth;
317
    }
318

319
    /**
320
     * Launch the application!
321
     *
322
     * This is "the loop" if you will. The main entry point into the script
323
     * that gets the required class instances, fires off the filters,
324
     * tries to route the response, loads the controller and generally
325
     * makes all the pieces work together.
326
     *
327
     * @param bool $returnResponse Used for testing purposes only.
328
     *
329
     * @return ResponseInterface|null
330
     */
331
    public function run(?RouteCollectionInterface $routes = null, bool $returnResponse = false)
332
    {
333
        if ($this->context === null) {
99✔
334
            throw new LogicException(
×
335
                'Context must be set before run() is called. If you are upgrading from 4.1.x, '
×
336
                . 'you need to merge `public/index.php` and `spark` file from `vendor/codeigniter4/framework`.',
×
337
            );
×
338
        }
339

340
        $this->pageCache->setTtl(0);
99✔
341
        $this->bufferLevel = ob_get_level();
99✔
342

343
        $this->startBenchmark();
99✔
344

345
        $this->getRequestObject();
99✔
346
        $this->getResponseObject();
99✔
347

348
        Events::trigger('pre_system');
99✔
349

350
        $this->benchmark->stop('bootstrap');
99✔
351

352
        $this->benchmark->start('required_before_filters');
99✔
353
        // Start up the filters
354
        $filters = Services::filters();
99✔
355
        // Run required before filters
356
        $possibleResponse = $this->runRequiredBeforeFilters($filters);
99✔
357

358
        // If a ResponseInterface instance is returned then send it back to the client and stop
359
        if ($possibleResponse instanceof ResponseInterface) {
99✔
360
            $this->response = $possibleResponse;
3✔
361
        } else {
362
            try {
363
                $this->response = $this->handleRequest($routes, config(Cache::class), $returnResponse);
98✔
364
            } catch (ResponsableInterface $e) {
18✔
365
                $this->outputBufferingEnd();
6✔
366

367
                $this->response = $e->getResponse();
6✔
368
            } catch (PageNotFoundException $e) {
12✔
369
                $this->response = $this->display404errors($e);
12✔
370
            } catch (Throwable $e) {
×
371
                $this->outputBufferingEnd();
×
372

373
                throw $e;
×
374
            }
375
        }
376

377
        $this->runRequiredAfterFilters($filters);
91✔
378

379
        // Is there a post-system event?
380
        Events::trigger('post_system');
91✔
381

382
        if ($returnResponse) {
91✔
383
            return $this->response;
36✔
384
        }
385

386
        $this->sendResponse();
55✔
387

388
        return null;
55✔
389
    }
390

391
    /**
392
     * Run required before filters.
393
     */
394
    private function runRequiredBeforeFilters(Filters $filters): ?ResponseInterface
395
    {
396
        $possibleResponse = $filters->runRequired('before');
99✔
397
        $this->benchmark->stop('required_before_filters');
99✔
398

399
        // If a ResponseInterface instance is returned then send it back to the client and stop
400
        if ($possibleResponse instanceof ResponseInterface) {
99✔
401
            return $possibleResponse;
3✔
402
        }
403

404
        return null;
98✔
405
    }
406

407
    /**
408
     * Run required after filters.
409
     */
410
    private function runRequiredAfterFilters(Filters $filters): void
411
    {
412
        $filters->setResponse($this->response);
91✔
413

414
        // Run required after filters
415
        $this->benchmark->start('required_after_filters');
91✔
416
        $response = $filters->runRequired('after');
91✔
417
        $this->benchmark->stop('required_after_filters');
91✔
418

419
        if ($response instanceof ResponseInterface) {
91✔
420
            $this->response = $response;
91✔
421
        }
422
    }
423

424
    /**
425
     * Invoked via php-cli command?
426
     */
427
    private function isPhpCli(): bool
428
    {
429
        return $this->context === 'php-cli';
61✔
430
    }
431

432
    /**
433
     * Web access?
434
     */
435
    private function isWeb(): bool
436
    {
437
        return $this->context === 'web';
99✔
438
    }
439

440
    /**
441
     * Disables Controller Filters.
442
     */
443
    public function disableFilters(): void
444
    {
445
        $this->enableFilters = false;
1✔
446
    }
447

448
    /**
449
     * Handles the main request logic and fires the controller.
450
     *
451
     * @return ResponseInterface
452
     *
453
     * @throws PageNotFoundException
454
     * @throws RedirectException
455
     *
456
     * @deprecated $returnResponse is deprecated.
457
     */
458
    protected function handleRequest(?RouteCollectionInterface $routes, Cache $cacheConfig, bool $returnResponse = false)
459
    {
460
        if ($this->request instanceof IncomingRequest && $this->request->getMethod() === 'CLI') {
461
            return $this->response->setStatusCode(405)->setBody('Method Not Allowed');
462
        }
463

464
        $routeFilters = $this->tryToRouteIt($routes);
465

466
        // $uri is URL-encoded.
467
        $uri = $this->request->getPath();
468

469
        if ($this->enableFilters) {
470
            /** @var Filters $filters */
471
            $filters = service('filters');
472

473
            // If any filters were specified within the routes file,
474
            // we need to ensure it's active for the current request
475
            if ($routeFilters !== null) {
476
                $filters->enableFilters($routeFilters, 'before');
477

478
                $oldFilterOrder = config(Feature::class)->oldFilterOrder ?? false; // @phpstan-ignore nullCoalesce.property
479
                if (! $oldFilterOrder) {
480
                    $routeFilters = array_reverse($routeFilters);
481
                }
482

483
                $filters->enableFilters($routeFilters, 'after');
484
            }
485

486
            // Run "before" filters
487
            $this->benchmark->start('before_filters');
488
            $possibleResponse = $filters->run($uri, 'before');
489
            $this->benchmark->stop('before_filters');
490

491
            // If a ResponseInterface instance is returned then send it back to the client and stop
492
            if ($possibleResponse instanceof ResponseInterface) {
493
                $this->outputBufferingEnd();
494

495
                return $possibleResponse;
496
            }
497

498
            if ($possibleResponse instanceof IncomingRequest || $possibleResponse instanceof CLIRequest) {
499
                $this->request = $possibleResponse;
500
            }
501
        }
502

503
        $returned = $this->startController();
504

505
        // If startController returned a Response (from an attribute or Closure), use it
506
        if ($returned instanceof ResponseInterface) {
507
            $this->gatherOutput($cacheConfig, $returned);
508
        }
509
        // Closure controller has run in startController().
510
        elseif (! is_callable($this->controller)) {
511
            $controller = $this->createController();
512

513
            if (! method_exists($controller, '_remap') && ! is_callable([$controller, $this->method], false)) {
514
                throw PageNotFoundException::forMethodNotFound($this->method);
515
            }
516

517
            // Is there a "post_controller_constructor" event?
518
            Events::trigger('post_controller_constructor');
519

520
            $returned = $this->runController($controller);
521
        } else {
522
            $this->benchmark->stop('controller_constructor');
523
            $this->benchmark->stop('controller');
524
        }
525

526
        // If $returned is a string, then the controller output something,
527
        // probably a view, instead of echoing it directly. Send it along
528
        // so it can be used with the output.
529
        $this->gatherOutput($cacheConfig, $returned);
530

531
        if ($this->enableFilters) {
532
            /** @var Filters $filters */
533
            $filters = service('filters');
534
            $filters->setResponse($this->response);
535

536
            // Run "after" filters
537
            $this->benchmark->start('after_filters');
538
            $response = $filters->run($uri, 'after');
539
            $this->benchmark->stop('after_filters');
540

541
            if ($response instanceof ResponseInterface) {
542
                $this->response = $response;
543
            }
544
        }
545

546
        // Execute controller attributes' after() methods AFTER framework filters
547
        if ((config('Routing')->useControllerAttributes ?? true) === true) { // @phpstan-ignore nullCoalesce.property
548
            $this->benchmark->start('route_attributes_after');
549
            $this->response = $this->router->executeAfterAttributes($this->request, $this->response);
550
            $this->benchmark->stop('route_attributes_after');
551
        }
552

553
        // Skip unnecessary processing for special Responses.
554
        if (
555
            ! $this->response instanceof DownloadResponse
556
            && ! $this->response instanceof RedirectResponse
557
        ) {
558
            // Save our current URI as the previous URI in the session
559
            // for safer, more accurate use with `previous_url()` helper function.
560
            $this->storePreviousURL(current_url(true));
561
        }
562

563
        unset($uri);
564

565
        return $this->response;
566
    }
567

568
    /**
569
     * You can load different configurations depending on your
570
     * current environment. Setting the environment also influences
571
     * things like logging and error reporting.
572
     *
573
     * This can be set to anything, but default usage is:
574
     *
575
     *     development
576
     *     testing
577
     *     production
578
     *
579
     * @codeCoverageIgnore
580
     *
581
     * @return void
582
     *
583
     * @deprecated 4.4.0 No longer used. Moved to index.php and spark.
584
     */
585
    protected function detectEnvironment()
586
    {
587
        // Make sure ENVIRONMENT isn't already set by other means.
588
        if (! defined('ENVIRONMENT')) {
589
            define('ENVIRONMENT', env('CI_ENVIRONMENT', 'production'));
590
        }
591
    }
592

593
    /**
594
     * Load any custom boot files based upon the current environment.
595
     *
596
     * If no boot file exists, we shouldn't continue because something
597
     * is wrong. At the very least, they should have error reporting setup.
598
     *
599
     * @return void
600
     *
601
     * @deprecated 4.5.0 Moved to system/bootstrap.php.
602
     */
603
    protected function bootstrapEnvironment()
604
    {
605
        if (is_file(APPPATH . 'Config/Boot/' . ENVIRONMENT . '.php')) {
606
            require_once APPPATH . 'Config/Boot/' . ENVIRONMENT . '.php';
607
        } else {
608
            // @codeCoverageIgnoreStart
609
            header('HTTP/1.1 503 Service Unavailable.', true, 503);
610
            echo 'The application environment is not set correctly.';
611

612
            exit(EXIT_ERROR); // EXIT_ERROR
613
            // @codeCoverageIgnoreEnd
614
        }
615
    }
616

617
    /**
618
     * Start the Benchmark
619
     *
620
     * The timer is used to display total script execution both in the
621
     * debug toolbar, and potentially on the displayed page.
622
     *
623
     * @return void
624
     */
625
    protected function startBenchmark()
626
    {
627
        if ($this->startTime === null) {
99✔
628
            $this->startTime = microtime(true);
×
629
        }
630

631
        $this->benchmark = Services::timer();
99✔
632
        $this->benchmark->start('total_execution', $this->startTime);
99✔
633
        $this->benchmark->start('bootstrap');
99✔
634
    }
635

636
    /**
637
     * Sets a Request object to be used for this request.
638
     * Used when running certain tests.
639
     *
640
     * @param CLIRequest|IncomingRequest $request
641
     *
642
     * @return $this
643
     *
644
     * @internal Used for testing purposes only.
645
     * @testTag
646
     */
647
    public function setRequest($request)
648
    {
649
        $this->request = $request;
38✔
650

651
        return $this;
38✔
652
    }
653

654
    /**
655
     * Get our Request object, (either IncomingRequest or CLIRequest).
656
     *
657
     * @return void
658
     */
659
    protected function getRequestObject()
660
    {
661
        if ($this->request instanceof Request) {
99✔
662
            $this->spoofRequestMethod();
40✔
663

664
            return;
40✔
665
        }
666

667
        if ($this->isPhpCli()) {
61✔
668
            Services::createRequest($this->config, true);
×
669
        } else {
670
            Services::createRequest($this->config);
61✔
671
        }
672

673
        $this->request = service('request');
61✔
674

675
        $this->spoofRequestMethod();
61✔
676
    }
677

678
    /**
679
     * Get our Response object, and set some default values, including
680
     * the HTTP protocol version and a default successful response.
681
     *
682
     * @return void
683
     */
684
    protected function getResponseObject()
685
    {
686
        $this->response = Services::response($this->config);
99✔
687

688
        if ($this->isWeb()) {
99✔
689
            $this->response->setProtocolVersion($this->request->getProtocolVersion());
99✔
690
        }
691

692
        // Assume success until proven otherwise.
693
        $this->response->setStatusCode(200);
99✔
694
    }
695

696
    /**
697
     * Force Secure Site Access? If the config value 'forceGlobalSecureRequests'
698
     * is true, will enforce that all requests to this site are made through
699
     * HTTPS. Will redirect the user to the current page with HTTPS, as well
700
     * as set the HTTP Strict Transport Security header for those browsers
701
     * that support it.
702
     *
703
     * @param int $duration How long the Strict Transport Security
704
     *                      should be enforced for this URL.
705
     *
706
     * @return void
707
     *
708
     * @deprecated 4.5.0 No longer used. Moved to ForceHTTPS filter.
709
     */
710
    protected function forceSecureAccess($duration = 31_536_000)
711
    {
712
        if ($this->config->forceGlobalSecureRequests !== true) {
713
            return;
714
        }
715

716
        force_https($duration, $this->request, $this->response);
717
    }
718

719
    /**
720
     * Determines if a response has been cached for the given URI.
721
     *
722
     * @return false|ResponseInterface
723
     *
724
     * @throws Exception
725
     *
726
     * @deprecated 4.5.0 PageCache required filter is used. No longer used.
727
     * @deprecated 4.4.2 The parameter $config is deprecated. No longer used.
728
     */
729
    public function displayCache(Cache $config)
730
    {
731
        $cachedResponse = $this->pageCache->get($this->request, $this->response);
732
        if ($cachedResponse instanceof ResponseInterface) {
733
            $this->response = $cachedResponse;
734

735
            $this->totalTime = $this->benchmark->getElapsedTime('total_execution');
736
            $output          = $this->displayPerformanceMetrics($cachedResponse->getBody());
737
            $this->response->setBody($output);
738

739
            return $this->response;
740
        }
741

742
        return false;
743
    }
744

745
    /**
746
     * Tells the app that the final output should be cached.
747
     *
748
     * @deprecated 4.4.0 Moved to ResponseCache::setTtl(). No longer used.
749
     *
750
     * @return void
751
     */
752
    public static function cache(int $time)
753
    {
754
        static::$cacheTTL = $time;
755
    }
756

757
    /**
758
     * Caches the full response from the current request. Used for
759
     * full-page caching for very high performance.
760
     *
761
     * @return bool
762
     *
763
     * @deprecated 4.4.0 No longer used.
764
     */
765
    public function cachePage(Cache $config)
766
    {
767
        $headers = [];
768

769
        foreach ($this->response->headers() as $header) {
770
            $headers[$header->getName()] = $header->getValueLine();
771
        }
772

773
        return cache()->save($this->generateCacheName($config), serialize(['headers' => $headers, 'output' => $this->output]), static::$cacheTTL);
774
    }
775

776
    /**
777
     * Returns an array with our basic performance stats collected.
778
     */
779
    public function getPerformanceStats(): array
780
    {
781
        // After filter debug toolbar requires 'total_execution'.
782
        $this->totalTime = $this->benchmark->getElapsedTime('total_execution');
×
783

784
        return [
×
785
            'startTime' => $this->startTime,
×
786
            'totalTime' => $this->totalTime,
×
787
        ];
×
788
    }
789

790
    /**
791
     * Generates the cache name to use for our full-page caching.
792
     *
793
     * @deprecated 4.4.0 No longer used.
794
     */
795
    protected function generateCacheName(Cache $config): string
796
    {
797
        if ($this->request instanceof CLIRequest) {
798
            return md5($this->request->getPath());
799
        }
800

801
        $uri = clone $this->request->getUri();
802

803
        $query = $config->cacheQueryString
804
            ? $uri->getQuery(is_array($config->cacheQueryString) ? ['only' => $config->cacheQueryString] : [])
805
            : '';
806

807
        return md5((string) $uri->setFragment('')->setQuery($query));
808
    }
809

810
    /**
811
     * Replaces the elapsed_time and memory_usage tag.
812
     *
813
     * @deprecated 4.5.0 PerformanceMetrics required filter is used. No longer used.
814
     */
815
    public function displayPerformanceMetrics(string $output): string
816
    {
817
        return str_replace(
818
            ['{elapsed_time}', '{memory_usage}'],
819
            [(string) $this->totalTime, number_format(memory_get_peak_usage() / 1024 / 1024, 3)],
820
            $output,
821
        );
822
    }
823

824
    /**
825
     * Try to Route It - As it sounds like, works with the router to
826
     * match a route against the current URI. If the route is a
827
     * "redirect route", will also handle the redirect.
828
     *
829
     * @param RouteCollectionInterface|null $routes A collection interface to use in place
830
     *                                              of the config file.
831
     *
832
     * @return list<string>|string|null Route filters, that is, the filters specified in the routes file
833
     *
834
     * @throws RedirectException
835
     */
836
    protected function tryToRouteIt(?RouteCollectionInterface $routes = null)
837
    {
838
        $this->benchmark->start('routing');
97✔
839

840
        if (! $routes instanceof RouteCollectionInterface) {
97✔
841
            $routes = service('routes')->loadRoutes();
37✔
842
        }
843

844
        // $routes is defined in Config/Routes.php
845
        $this->router = Services::router($routes, $this->request);
97✔
846

847
        // $uri is URL-encoded.
848
        $uri = $this->request->getPath();
97✔
849

850
        $this->outputBufferingStart();
97✔
851

852
        $this->controller = $this->router->handle($uri);
97✔
853
        $this->method     = $this->router->methodName();
80✔
854

855
        // If a {locale} segment was matched in the final route,
856
        // then we need to set the correct locale on our Request.
857
        if ($this->router->hasLocale()) {
80✔
858
            $this->request->setLocale($this->router->getLocale());
×
859
        }
860

861
        $this->benchmark->stop('routing');
80✔
862

863
        return $this->router->getFilters();
80✔
864
    }
865

866
    /**
867
     * Determines the path to use for us to try to route to, based
868
     * on the CLI/IncomingRequest path.
869
     *
870
     * @return string
871
     *
872
     * @deprecated 4.5.0 No longer used.
873
     */
874
    protected function determinePath()
875
    {
876
        return $this->request->getPath();
877
    }
878

879
    /**
880
     * Now that everything has been setup, this method attempts to run the
881
     * controller method and make the script go. If it's not able to, will
882
     * show the appropriate Page Not Found error.
883
     *
884
     * @return ResponseInterface|string|null
885
     */
886
    protected function startController()
887
    {
888
        $this->benchmark->start('controller');
80✔
889
        $this->benchmark->start('controller_constructor');
80✔
890

891
        // Is it routed to a Closure?
892
        if (is_object($this->controller) && ($this->controller::class === 'Closure')) {
80✔
893
            $controller = $this->controller;
29✔
894

895
            return $controller(...$this->router->params());
29✔
896
        }
897

898
        // No controller specified - we don't know what to do now.
899
        if (! isset($this->controller)) {
51✔
900
            throw PageNotFoundException::forEmptyController();
×
901
        }
902

903
        // Try to autoload the class
904
        if (
905
            ! class_exists($this->controller, true)
51✔
906
            || ($this->method[0] === '_' && $this->method !== '__invoke')
51✔
907
        ) {
908
            throw PageNotFoundException::forControllerNotFound($this->controller, $this->method);
×
909
        }
910

911
        // Execute route attributes' before() methods
912
        // This runs after routing/validation but BEFORE expensive controller instantiation
913
        if ((config('Routing')->useControllerAttributes ?? true) === true) { // @phpstan-ignore nullCoalesce.property
51✔
914
            $this->benchmark->start('route_attributes_before');
50✔
915
            $attributeResponse = $this->router->executeBeforeAttributes($this->request);
50✔
916
            $this->benchmark->stop('route_attributes_before');
49✔
917

918
            // If attribute returns a Response, short-circuit
919
            if ($attributeResponse instanceof ResponseInterface) {
49✔
920
                $this->benchmark->stop('controller_constructor');
1✔
921
                $this->benchmark->stop('controller');
1✔
922

923
                return $attributeResponse;
1✔
924
            }
925

926
            // If attribute returns a modified Request, use it
927
            if ($attributeResponse instanceof RequestInterface) {
49✔
928
                $this->request = $attributeResponse;
49✔
929
            }
930
        }
931

932
        return null;
50✔
933
    }
934

935
    /**
936
     * Instantiates the controller class.
937
     *
938
     * @return Controller
939
     */
940
    protected function createController()
941
    {
942
        assert(is_string($this->controller));
943

944
        $class = new $this->controller();
52✔
945
        $class->initController($this->request, $this->response, Services::logger());
52✔
946

947
        $this->benchmark->stop('controller_constructor');
52✔
948

949
        return $class;
52✔
950
    }
951

952
    /**
953
     * Runs the controller, allowing for _remap methods to function.
954
     *
955
     * CI4 supports three types of requests:
956
     *  1. Web: URI segments become parameters, sent to Controllers via Routes,
957
     *      output controlled by Headers to browser
958
     *  2. PHP CLI: accessed by CLI via php public/index.php, arguments become URI segments,
959
     *      sent to Controllers via Routes, output varies
960
     *
961
     * @param Controller $class
962
     *
963
     * @return false|ResponseInterface|string|void
964
     */
965
    protected function runController($class)
966
    {
967
        // This is a Web request or PHP CLI request
968
        $params = $this->router->params();
49✔
969

970
        // The controller method param types may not be string.
971
        // So cannot set `declare(strict_types=1)` in this file.
972
        $output = method_exists($class, '_remap')
49✔
973
            ? $class->_remap($this->method, ...$params)
×
974
            : $class->{$this->method}(...$params);
49✔
975

976
        $this->benchmark->stop('controller');
49✔
977

978
        return $output;
49✔
979
    }
980

981
    /**
982
     * Displays a 404 Page Not Found error. If set, will try to
983
     * call the 404Override controller/method that was set in routing config.
984
     *
985
     * @return ResponseInterface|void
986
     */
987
    protected function display404errors(PageNotFoundException $e)
988
    {
989
        $this->response->setStatusCode($e->getCode());
12✔
990

991
        // Is there a 404 Override available?
992
        $override = $this->router->get404Override();
12✔
993

994
        if ($override !== null) {
12✔
995
            $returned = null;
4✔
996

997
            if ($override instanceof Closure) {
4✔
998
                echo $override($e->getMessage());
1✔
999
            } elseif (is_array($override)) {
3✔
1000
                $this->benchmark->start('controller');
3✔
1001
                $this->benchmark->start('controller_constructor');
3✔
1002

1003
                $this->controller = $override[0];
3✔
1004
                $this->method     = $override[1];
3✔
1005

1006
                $controller = $this->createController();
3✔
1007

1008
                $returned = $controller->{$this->method}($e->getMessage());
3✔
1009

1010
                $this->benchmark->stop('controller');
3✔
1011
            }
1012

1013
            unset($override);
4✔
1014

1015
            $cacheConfig = config(Cache::class);
4✔
1016
            $this->gatherOutput($cacheConfig, $returned);
4✔
1017

1018
            return $this->response;
4✔
1019
        }
1020

1021
        $this->outputBufferingEnd();
8✔
1022

1023
        // Throws new PageNotFoundException and remove exception message on production.
1024
        throw PageNotFoundException::forPageNotFound(
8✔
1025
            (ENVIRONMENT !== 'production' || ! $this->isWeb()) ? $e->getMessage() : null,
8✔
1026
        );
8✔
1027
    }
1028

1029
    /**
1030
     * Gathers the script output from the buffer, replaces some execution
1031
     * time tag in the output and displays the debug toolbar, if required.
1032
     *
1033
     * @param Cache|null                    $cacheConfig Deprecated. No longer used.
1034
     * @param ResponseInterface|string|null $returned
1035
     *
1036
     * @deprecated $cacheConfig is deprecated.
1037
     *
1038
     * @return void
1039
     */
1040
    protected function gatherOutput(?Cache $cacheConfig = null, $returned = null)
1041
    {
1042
        $this->output = $this->outputBufferingEnd();
1043

1044
        if ($returned instanceof DownloadResponse) {
1045
            $this->response = $returned;
1046

1047
            return;
1048
        }
1049
        // If the controller returned a response object,
1050
        // we need to grab the body from it so it can
1051
        // be added to anything else that might have been
1052
        // echoed already.
1053
        // We also need to save the instance locally
1054
        // so that any status code changes, etc, take place.
1055
        if ($returned instanceof ResponseInterface) {
1056
            $this->response = $returned;
1057
            $returned       = $returned->getBody();
1058
        }
1059

1060
        if (is_string($returned)) {
1061
            $this->output .= $returned;
1062
        }
1063

1064
        $this->response->setBody($this->output);
1065
    }
1066

1067
    /**
1068
     * If we have a session object to use, store the current URI
1069
     * as the previous URI. This is called just prior to sending the
1070
     * response to the client, and will make it available next request.
1071
     *
1072
     * This helps provider safer, more reliable previous_url() detection.
1073
     *
1074
     * @param string|URI $uri
1075
     *
1076
     * @return void
1077
     */
1078
    public function storePreviousURL($uri)
1079
    {
1080
        // Ignore CLI requests
1081
        if (! $this->isWeb()) {
76✔
1082
            return;
×
1083
        }
1084
        // Ignore AJAX requests
1085
        if (method_exists($this->request, 'isAJAX') && $this->request->isAJAX()) {
76✔
1086
            return;
×
1087
        }
1088

1089
        // Ignore unroutable responses
1090
        if ($this->response instanceof DownloadResponse || $this->response instanceof RedirectResponse) {
76✔
1091
            return;
×
1092
        }
1093

1094
        // Ignore non-HTML responses
1095
        if (! str_contains($this->response->getHeaderLine('Content-Type'), 'text/html')) {
76✔
1096
            return;
12✔
1097
        }
1098

1099
        // This is mainly needed during testing...
1100
        if (is_string($uri)) {
64✔
1101
            $uri = new URI($uri);
×
1102
        }
1103

1104
        if (isset($_SESSION)) {
64✔
1105
            session()->set('_ci_previous_url', URI::createURIString(
64✔
1106
                $uri->getScheme(),
64✔
1107
                $uri->getAuthority(),
64✔
1108
                $uri->getPath(),
64✔
1109
                $uri->getQuery(),
64✔
1110
                $uri->getFragment(),
64✔
1111
            ));
64✔
1112
        }
1113
    }
1114

1115
    /**
1116
     * Modifies the Request Object to use a different method if a POST
1117
     * variable called _method is found.
1118
     *
1119
     * @return void
1120
     */
1121
    public function spoofRequestMethod()
1122
    {
1123
        // Only works with POSTED forms
1124
        if ($this->request->getMethod() !== Method::POST) {
99✔
1125
            return;
84✔
1126
        }
1127

1128
        $method = $this->request->getPost('_method');
16✔
1129

1130
        if ($method === null) {
16✔
1131
            return;
14✔
1132
        }
1133

1134
        // Only allows PUT, PATCH, DELETE
1135
        if (in_array($method, [Method::PUT, Method::PATCH, Method::DELETE], true)) {
2✔
1136
            $this->request = $this->request->setMethod($method);
1✔
1137
        }
1138
    }
1139

1140
    /**
1141
     * Sends the output of this request back to the client.
1142
     * This is what they've been waiting for!
1143
     *
1144
     * @return void
1145
     */
1146
    protected function sendResponse()
1147
    {
1148
        $this->response->send();
55✔
1149
    }
1150

1151
    /**
1152
     * Exits the application, setting the exit code for CLI-based applications
1153
     * that might be watching.
1154
     *
1155
     * Made into a separate method so that it can be mocked during testing
1156
     * without actually stopping script execution.
1157
     *
1158
     * @param int $code
1159
     *
1160
     * @deprecated 4.4.0 No longer Used. Moved to index.php.
1161
     *
1162
     * @return void
1163
     */
1164
    protected function callExit($code)
1165
    {
1166
        exit($code); // @codeCoverageIgnore
1167
    }
1168

1169
    /**
1170
     * Sets the app context.
1171
     *
1172
     * @param 'php-cli'|'web' $context
1173
     *
1174
     * @return $this
1175
     */
1176
    public function setContext(string $context)
1177
    {
1178
        $this->context = $context;
39✔
1179

1180
        return $this;
39✔
1181
    }
1182

1183
    protected function outputBufferingStart(): void
1184
    {
1185
        $this->bufferLevel = ob_get_level();
97✔
1186
        ob_start();
97✔
1187
    }
1188

1189
    protected function outputBufferingEnd(): string
1190
    {
1191
        $buffer = '';
97✔
1192

1193
        while (ob_get_level() > $this->bufferLevel) {
97✔
1194
            $buffer .= ob_get_contents();
97✔
1195
            ob_end_clean();
97✔
1196
        }
1197

1198
        return $buffer;
97✔
1199
    }
1200
}
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc