shell bypass 403
<?php /** * @package Joomla.Administrator * @subpackage com_installer * * @copyright (C) 2019 Open Source Matters, Inc. <https://www.joomla.org> * @license GNU General Public License version 2 or later; see LICENSE.txt */ namespace Joomla\Component\Installer\Administrator\View\Updatesite; use Joomla\CMS\Factory; use Joomla\CMS\Form\Form; use Joomla\CMS\Helper\ContentHelper; use Joomla\CMS\Language\Text; use Joomla\CMS\MVC\View\GenericDataException; use Joomla\CMS\Toolbar\Toolbar; use Joomla\CMS\Toolbar\ToolbarHelper; use Joomla\Component\Installer\Administrator\Helper\InstallerHelper; use Joomla\Component\Installer\Administrator\Model\UpdatesiteModel; use Joomla\Component\Installer\Administrator\View\Installer\HtmlView as InstallerViewDefault; // phpcs:disable PSR1.Files.SideEffects \defined('_JEXEC') or die; // phpcs:enable PSR1.Files.SideEffects /** * View to edit an update site. * * @since 4.0.0 */ class HtmlView extends InstallerViewDefault { /** * The Form object * * @var Form * * @since 4.0.0 */ protected $form; /** * The active item * * @var object * * @since 4.0.0 */ protected $item; /** * Display the view. * * @param string $tpl The name of the template file to parse; automatically searches through the template paths. * * @return void * * @since 4.0.0 * * @throws \Exception */ public function display($tpl = null): void { /** @var UpdatesiteModel $model */ $model = $this->getModel(); $this->form = $model->getForm(); $this->item = $model->getItem(); // Remove the extra_query field if it's a free download extension $dlidSupportingSites = InstallerHelper::getDownloadKeySupportedSites(false); $update_site_id = $this->item->get('update_site_id'); if (!in_array($update_site_id, $dlidSupportingSites)) { $this->form->removeField('extra_query'); } // Check for errors. if (count($errors = $model->getErrors())) { throw new GenericDataException(implode("\n", $errors), 500); } parent::display($tpl); } /** * Add the page title and toolbar. * * @return void * * @since 4.0.0 * * @throws \Exception */ protected function addToolbar(): void { $toolbar = Toolbar::getInstance(); $app = Factory::getApplication(); $app->getInput()->set('hidemainmenu', true); $user = $app->getIdentity(); $userId = $user->id; $checkedOut = !(is_null($this->item->checked_out) || $this->item->checked_out === $userId); // Since we don't track these assets at the item level, use the category id. $canDo = ContentHelper::getActions('com_installer', 'updatesite'); ToolbarHelper::title(Text::_('COM_INSTALLER_UPDATESITE_EDIT_TITLE'), 'address contact'); // Since it's an existing record, check the edit permission, or fall back to edit own if the owner. $itemEditable = $canDo->get('core.edit'); // Can't save the record if it's checked out and editable if (!$checkedOut && $itemEditable && $this->form->getField('extra_query')) { $saveGroup = $toolbar->dropdownButton('save-group'); $saveGroup->configure( function (Toolbar $childBar) { $childBar->apply('updatesite.apply'); $childBar->save('updatesite.save'); } ); } $toolbar->cancel('updatesite.cancel'); $toolbar->help('Edit_Update_Site'); } }