shell bypass 403
<?php
/**
* @package admintools
* @copyright Copyright (c)2010-2024 Nicholas K. Dionysopoulos / Akeeba Ltd
* @license GNU General Public License version 3, or later
*/
namespace Akeeba\Component\AdminTools\Administrator\Dispatcher;
defined('_JEXEC') or die;
use Akeeba\Component\AdminTools\Administrator\Mixin\TriggerEventTrait;
use Akeeba\Component\AdminTools\Administrator\Model\MainpasswordModel;
use Joomla\CMS\Application\CMSApplication;
use Joomla\CMS\Dispatcher\ComponentDispatcher;
use Joomla\CMS\Document\HtmlDocument;
use Joomla\CMS\Language\Text;
use Joomla\CMS\Router\Route;
use Joomla\String\Inflector;
use Throwable;
class Dispatcher extends ComponentDispatcher
{
use TriggerEventTrait;
protected $defaultController = 'controlpanel';
protected $viewMap = [
'blacklistedaddresses' => 'disallowlists',
'blacklistedaddress' => 'disallowlist',
'configurefixpermissions' => 'configurepermissions',
'exceptionsfromwafs' => 'wafexceptions',
'exceptionsfromwaf' => 'wafexception',
'importandexport' => 'exportimport',
'masterpassword' => 'mainpassword',
'redirections' => 'urlredirections',
'redirection' => 'urlredirection',
'securityexceptions' => 'blockedrequestslog',
'wafblacklistedrequests' => 'wafdenylists',
'wafblacklistedrequest' => 'wafdenylist',
'whitelistedaddresses' => 'adminallowlists',
'whitelistedaddress' => 'adminallowlist',
];
public function dispatch()
{
// Check the minimum supported PHP version
$minPHPVersion = '7.4.0';
$softwareName = 'Admin Tools <small>for Joomla!</small>';
$silentResults = $this->app->isClient('site');
if (version_compare(PHP_VERSION, $minPHPVersion, 'lt'))
{
die(
sprintf(
'%s requires PHP %s or later. Your site is running on PHP %s.',
$softwareName,
$minPHPVersion,
PHP_VERSION
)
);
}
try
{
$this->triggerEvent('onBeforeDispatch');
parent::dispatch();
// This will only execute if there is no redirection set by the Controller
$this->triggerEvent('onAfterDispatch');
}
catch (Throwable $e)
{
$title = 'Admin Tools <small>for Joomla!</small>';
$isPro = false;
// Frontend: forwards errors 401, 403 and 404 to Joomla
if (in_array($e->getCode(), [401, 403, 404]) && $this->app->isClient('site'))
{
throw $e;
}
if (!(include_once JPATH_ADMINISTRATOR . '/components/com_admintools/tmpl/common/errorhandler.php'))
{
throw $e;
}
}
}
protected function onBeforeDispatch()
{
$this->loadLanguage();
$this->applyViewAndController();
$this->loadVersion();
$this->loadCommonStaticMedia();
$this->mainPasswordCheck();
}
protected function loadLanguage(): void
{
$jLang = $this->app->getLanguage();
$jLang->load($this->option, JPATH_ADMINISTRATOR);
if (!$this->app->isClient('administrator'))
{
$jLang->load($this->option, JPATH_SITE);
}
}
private function loadCommonStaticMedia()
{
// Make sure we run under a CMS application
if (!($this->app instanceof CMSApplication))
{
return;
}
// Make sure the document is HTML
$document = $this->app->getDocument();
if (!($document instanceof HtmlDocument))
{
return;
}
// Finally, load our 'common' preset
$webAssetManager = $document->getWebAssetManager();
$webAssetManager
->usePreset('com_admintools.backend');
if (version_compare(JVERSION, '4.999.999', 'gt'))
{
$webAssetManager
->useStyle('com_admintools.j5dark');
}
}
protected function applyViewAndController(): void
{
$controller = $this->input->getCmd('controller', null);
$view = $this->input->getCmd('view', null);
$task = $this->input->getCmd('task', 'main');
if (strpos($task, '.') !== false)
{
// Explode the controller.task command.
[$controller, $task] = explode('.', $task);
}
if (empty($controller) && empty($view))
{
$controller = $this->defaultController;
$view = $this->defaultController;
}
elseif (empty($controller) && !empty($view))
{
$view = $this->mapView($view);
$controller = $view;
}
elseif (!empty($controller) && empty($view))
{
$view = $controller;
}
$controller = strtolower($controller);
$view = strtolower($view);
$this->input->set('view', $view);
$this->input->set('controller', $controller);
$this->input->set('task', $task);
}
private function mapView(string $view)
{
$view = strtolower($view);
return $this->viewMap[$view] ?? $view;
}
private function mainPasswordCheck()
{
$view = $this->input->getCmd('view');
$view = Inflector::singularize($view);
$controller = Inflector::singularize($this->input->getCmd('controller', $view));
try
{
/** @var MainpasswordModel $model */
$model = $this->mvcFactory->createModel('Mainpassword', 'Administrator', ['ignore_request' => true]);
}
catch (\Exception $e)
{
return;
}
if ($model === false)
{
return;
}
if ($model->accessAllowed($view) && $model->accessAllowed($controller))
{
return;
}
$this->app->enqueueMessage(Text::_('COM_ADMINTOOLS_CONTROLPANEL_ERR_NOTAUTHORIZED'), 'error');
$this->app->redirect(Route::_('index.php?option=com_admintools&view=Controlpanel', false));
}
protected function loadVersion()
{
$filePath = JPATH_ADMINISTRATOR . '/components/com_admintools/version.php';
if (@file_exists($filePath) && is_file($filePath))
{
include_once $filePath;
}
if (!defined('ADMINTOOLS_VERSION'))
{
define('ADMINTOOLS_VERSION', 'dev');
}
if (!defined('ADMINTOOLS_DATE'))
{
define('ADMINTOOLS_DATE', gmdate('Y-m-d'));
}
if (!defined('ADMINTOOLS_PRO'))
{
$isPro = @file_exists(JPATH_ADMINISTRATOR . '/components/com_admintools/src/Controller/ScansController.php');
define('ADMINTOOLS_PRO', $isPro ? '1' : '0');
}
}
}