shell bypass 403
<?php /** * @package admintools * @copyright Copyright (c)2010-2024 Nicholas K. Dionysopoulos / Akeeba Ltd * @license GNU General Public License version 3, or later */ namespace Akeeba\Component\AdminTools\Administrator\Model; defined('_JEXEC') or die; use Joomla\CMS\Factory; use Joomla\CMS\MVC\Factory\MVCFactoryInterface; use Joomla\CMS\MVC\Model\ListModel; use Joomla\Database\ParameterType; #[\AllowDynamicProperties] class TempsuperusersModel extends ListModel { public function __construct($config = [], MVCFactoryInterface $factory = null) { $config['filter_fields'] = $config['filter_fields'] ?? []; $config['filter_fields'] = $config['filter_fields'] ?: [ 'search', 'user_id', 't.user_id', 'expiration', 't.expiration', 'u.username', ]; parent::__construct($config, $factory); } protected function populateState($ordering = 't.expiration', $direction = 'desc') { $app = Factory::getApplication(); $search = $app->getUserStateFromRequest($this->context . 'filter.search', 'filter_search', '', 'string'); $this->setState('filter.search', $search); $user_id = $app->getUserStateFromRequest($this->context . 'filter.user_id', 'filter_user_id', '', 'string'); $this->setState('filter.user_id', ($user_id === '') ? $user_id : (int) $user_id); parent::populateState($ordering, $direction); } protected function getStoreId($id = '') { $id .= ':' . $this->getState('filter.search'); $id .= ':' . $this->getState('filter.user_id'); return parent::getStoreId($id); } protected function getListQuery() { $db = $this->getDatabase(); $query = $db->getQuery(true) ->select([ $db->quoteName('t') . '.*', $db->quoteName('u.name'), $db->quoteName('u.username'), $db->quoteName('u.email'), $db->quoteName('u.block'), $db->quoteName('u.registerDate'), $db->quoteName('u.lastvisitDate'), ]) ->from($db->quoteName('#__admintools_tempsupers', 't')) ->join('LEFT', $db->quoteName('#__users', 'u'), $db->quoteName('u.id') . ' = ' . $db->quoteName('t.user_id') ); // Search (username or ID) and user_id filters. $search = $this->getState('filter.search'); $userId = $this->getState('filter.user_id'); // -- If search begins with 'id:' we will look for that user ID, ignoring the user_id filter. if (!empty($search)) { if (stripos($search, 'id:') === 0) { $userId = (int) substr($search, 3); } if (!empty($userId)) { $search = null; } } if (!empty($search)) { $search = '%' . $search . '%'; $query ->where($db->quoteName('u.username') . ' LIKE :username', 'OR') ->where($db->quoteName('u.email') . ' LIKE :email', 'OR') ->bind(':username', $search); } if (!empty($userId)) { $query->where($db->quoteName('t.user_id') . ' = :user_id') ->bind(':user_id', $userId, ParameterType::INTEGER); } // List ordering clause $orderCol = $this->state->get('list.ordering', 't.expiration'); $orderDirn = $this->state->get('list.direction', 'DESC'); $ordering = $db->escape($orderCol) . ' ' . $db->escape($orderDirn); $query->order($ordering); return $query; } }