fix: filter except empty

[kenjis]

Description
See #7822 (comment)

This PR changes the behavior:

• ['except' => []] means to exclude nothing.
• ['except' => ''] means to exclude baseURL only.
  • because the URI string '' means the URI path for the baseURL.
  • when navigating to the baseURL, uri_string() returns ''.

---

['except' => []] or ['except' => ''] means "except all" in the current code.
This behavior is unexpected, and not good for security.

If a dev comments out all items in except key accidentally, the filter will be disabled.

['except' => [
    // 'foo/*',
    // 'bar/*',
]]

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[neznaika0]

Thanks

[kenjis]

Strictly speaking, this may be a breaking change. However, it does not appear that any developer would want to disable the filter by specifying an empty array or empty string.

If there is, it would be a case of specifying them by mistake and not realizing that the filter is disabled.

[datamweb]

want to disable the filter by specifying an empty array or empty string

I agree that this should not be the behavior.
But the question is what if for any reason the developer wants to except all 15 minutes altogether?
I think it should be something like the following to "except all".

['except' => [
    '*',
]];
// or
['except' =>  '*' ];

[kenjis]

@datamweb '*' or ['*'] works.
See https://github.com/codeigniter4/CodeIgniter4/pull/7823/files#diff-ae159768f526f66aeb6af1c17c64b57f36659a0d795530b3014a5ded5cbd6176R221

[neznaika0]

Ha, it's wrong, but it will work. To exclude everyone, you need to remove the filter. There is no logic to enable the filter and disable it by rules

[datamweb]

exclude everyone, you need to remove the filter.

I was considering the implementation with the Settings package.

It looks good to me.

[kenjis]

The URI string '' means the URI path for the baseURL.
It has the same meaning as /.
So ['except' => ''] should mean to exclude the baseURL only.

I changed that way.

[MGatner]

I agree this is a good fix for a common "gotcha"