shell bypass 403
<?php /** * @package Joomla.Administrator * @subpackage mod_guidedtours * * @copyright (C) 2023 Open Source Matters, Inc. <https://www.joomla.org> * @license GNU General Public License version 2 or later; see LICENSE.txt */ namespace Joomla\Module\GuidedTours\Administrator\Helper; use Joomla\CMS\Application\AdministratorApplication; use Joomla\CMS\Language\Multilanguage; use Joomla\Registry\Registry; use Joomla\Uri\Uri; // phpcs:disable PSR1.Files.SideEffects \defined('_JEXEC') or die; // phpcs:enable PSR1.Files.SideEffects /** * Helper for mod_guidedtours * * @since 4.3.0 */ class GuidedToursHelper { /** * Get a list of tours from a specific context. * * @param Registry $params Object holding the module parameters * @param AdministratorApplication $app The application * * @return mixed * * @since 4.3.0 */ public function getTours(Registry $params, AdministratorApplication $app) { $factory = $app->bootComponent('com_guidedtours')->getMVCFactory(); $user = $app->getIdentity(); // Get an instance of the guided tour model $tourModel = $factory->createModel('Tours', 'Administrator', ['ignore_request' => true]); $tourModel->setState('filter.published', 1); $tourModel->setState('filter.access', $app->getIdentity()->getAuthorisedViewLevels()); if (Multilanguage::isEnabled()) { $tourModel->setState('filter.language', ['*', $app->getLanguage()->getTag()]); } $items = $tourModel->getItems(); foreach ($items as $key => $item) { // The user can only see the tours of extensions that are allowed. $uri = new Uri($item->url); if ($extension = $uri->getVar('option')) { if (!$user->authorise('core.manage', $extension)) { unset($items[$key]); } } } return $items; } }