shell bypass 403
<?php /** * @package admintools * @copyright Copyright (c)2010-2024 Nicholas K. Dionysopoulos / Akeeba Ltd * @license GNU General Public License version 3, or later */ namespace Akeeba\Component\AdminTools\Administrator\Model; defined('_JEXEC') or die; use Joomla\CMS\Factory; use Joomla\CMS\MVC\Factory\MVCFactoryInterface; use Joomla\CMS\MVC\Model\ListModel; use Joomla\Database\ParameterType; #[\AllowDynamicProperties] class AllowlistsModel extends ListModel { public function __construct($config = [], MVCFactoryInterface $factory = null) { $config['filter_fields'] = $config['filter_fields'] ?? []; $config['filter_fields'] = $config['filter_fields'] ?: [ 'search', 'id', 'ip', 'description', ]; parent::__construct($config, $factory); } protected function populateState($ordering = 'id', $direction = 'desc') { $app = Factory::getApplication(); // If we're under CLI there's nothing to populate if ($app->isClient('cli')) { return; } $search = $app->getUserStateFromRequest($this->context . 'filter.search', 'filter_search', '', 'string'); $this->setState('filter.search', $search); parent::populateState($ordering, $direction); } protected function getStoreId($id = '') { $id .= ':' . $this->getState('filter.search'); return parent::getStoreId($id); } protected function getListQuery() { $db = $this->getDatabase(); $query = $db->getQuery(true) ->select('*') ->from($db->quoteName('#__admintools_ipallow')); $search = $this->getState('filter.search'); if (!empty($search)) { if (substr($search, 0, 3) === 'id:') { $id = (int) substr($search, 3); $query->where($db->quoteName('id') . ' = :id') ->bind(':id', $id, ParameterType::INTEGER); } if (substr($search, 0, 3) === 'ip:') { $ip = '%' . substr($search, 3) . '%'; $query->where($db->quoteName('ip') . ' = :ip') ->bind(':ip', $ip, ParameterType::STRING); } else { $search = '%' . $search . '%'; $query->where($db->quoteName('description') . ' LIKE :search', 'OR') ->where($db->quoteName('ip') . ' LIKE :search2', 'OR') ->bind(':search', $search, ParameterType::STRING) ->bind(':search2', $search, ParameterType::STRING); } } // List ordering clause $orderCol = $this->state->get('list.ordering', 'id'); $orderDirn = $this->state->get('list.direction', 'desc'); $ordering = $db->escape($orderCol) . ' ' . $db->escape($orderDirn); $query->order($ordering); return $query; } }