<?php /** * @package Joomla.Administrator * @subpackage com_config * * @copyright (C) 2013 Open Source Matters, Inc. <https://www.joomla.org> * @license GNU General Public License version 2 or later; see LICENSE.txt */ namespace Joomla\Component\Config\Administrator\Model; use Joomla\CMS\Access\Access; use Joomla\CMS\Access\Rules; use Joomla\CMS\Cache\Exception\CacheConnectingException; use Joomla\CMS\Cache\Exception\UnsupportedCacheException; use Joomla\CMS\Component\ComponentHelper; use Joomla\CMS\Factory; use Joomla\CMS\Filesystem\File; use Joomla\CMS\Filesystem\Folder; use Joomla\CMS\Filesystem\Path; use Joomla\CMS\Filter\OutputFilter; use Joomla\CMS\Http\HttpFactory; use Joomla\CMS\Language\Text; use Joomla\CMS\Log\Log; use Joomla\CMS\Mail\Exception\MailDisabledException; use Joomla\CMS\Mail\MailTemplate; use Joomla\CMS\MVC\Model\FormModel; use Joomla\CMS\Table\Asset; use Joomla\CMS\Table\Table; use Joomla\CMS\Uri\Uri; use Joomla\CMS\User\UserHelper; use Joomla\Database\DatabaseDriver; use Joomla\Database\ParameterType; use Joomla\Registry\Registry; use Joomla\Utilities\ArrayHelper; use PHPMailer\PHPMailer\Exception as phpMailerException; // phpcs:disable PSR1.Files.SideEffects \defined('_JEXEC') or die; // phpcs:enable PSR1.Files.SideEffects /** * Model for the global configuration * * @since 3.2 */ class ApplicationModel extends FormModel { /** * Array of protected password fields from the configuration.php * * @var array * @since 3.9.23 */ private $protectedConfigurationFields = array('password', 'secret', 'smtppass', 'redis_server_auth', 'session_redis_server_auth'); /** * Method to get a form object. * * @param array $data Data for the form. * @param boolean $loadData True if the form is to load its own data (default case), false if not. * * @return mixed A JForm object on success, false on failure * * @since 1.6 */ public function getForm($data = array(), $loadData = true) { // Get the form. $form = $this->loadForm('com_config.application', 'application', array('control' => 'jform', 'load_data' => $loadData)); if (empty($form)) { return false; } return $form; } /** * Method to get the configuration data. * * This method will load the global configuration data straight from * JConfig. If configuration data has been saved in the session, that * data will be merged into the original data, overwriting it. * * @return array An array containing all global config data. * * @since 1.6 */ public function getData() { // Get the config data. $config = new \JConfig(); $data = ArrayHelper::fromObject($config); // Get the correct driver at runtime $data['dbtype'] = $this->getDatabase()->getName(); // Prime the asset_id for the rules. $data['asset_id'] = 1; // Get the text filter data $params = ComponentHelper::getParams('com_config'); $data['filters'] = ArrayHelper::fromObject($params->get('filters')); // If no filter data found, get from com_content (update of 1.6/1.7 site) if (empty($data['filters'])) { $contentParams = ComponentHelper::getParams('com_content'); $data['filters'] = ArrayHelper::fromObject($contentParams->get('filters')); } // Check for data in the session. $temp = Factory::getApplication()->getUserState('com_config.config.global.data'); // Merge in the session data. if (!empty($temp)) { // $temp can sometimes be an object, and we need it to be an array if (is_object($temp)) { $temp = ArrayHelper::fromObject($temp); } $data = array_merge($temp, $data); } // Correct error_reporting value, since we removed "development", the "maximum" should be set instead // @TODO: This can be removed in 5.0 if (!empty($data['error_reporting']) && $data['error_reporting'] === 'development') { $data['error_reporting'] = 'maximum'; } return $data; } /** * Method to validate the db connection properties. * * @param array $data An array containing all global config data. * * @return array|boolean Array with the validated global config data or boolean false on a validation failure. * * @since 4.0.0 */ public function validateDbConnection($data) { // Validate database connection encryption options if ((int) $data['dbencryption'] === 0) { // Reset unused options if (!empty($data['dbsslkey'])) { $data['dbsslkey'] = ''; } if (!empty($data['dbsslcert'])) { $data['dbsslcert'] = ''; } if ((bool) $data['dbsslverifyservercert'] === true) { $data['dbsslverifyservercert'] = false; } if (!empty($data['dbsslca'])) { $data['dbsslca'] = ''; } if (!empty($data['dbsslcipher'])) { $data['dbsslcipher'] = ''; } } else { // Check localhost if (strtolower($data['host']) === 'localhost') { Factory::getApplication()->enqueueMessage(Text::_('COM_CONFIG_ERROR_DATABASE_ENCRYPTION_LOCALHOST'), 'error'); return false; } // Check CA file and folder depending on database type if server certificate verification if ((bool) $data['dbsslverifyservercert'] === true) { if (empty($data['dbsslca'])) { Factory::getApplication()->enqueueMessage( Text::sprintf( 'COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_EMPTY', Text::_('COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_LABEL') ), 'error' ); return false; } if (!File::exists(Path::clean($data['dbsslca']))) { Factory::getApplication()->enqueueMessage( Text::sprintf( 'COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_BAD', Text::_('COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CA_LABEL') ), 'error' ); return false; } } else { // Reset unused option if (!empty($data['dbsslca'])) { $data['dbsslca'] = ''; } } // Check key and certificate if two-way encryption if ((int) $data['dbencryption'] === 2) { if (empty($data['dbsslkey'])) { Factory::getApplication()->enqueueMessage( Text::sprintf( 'COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_EMPTY', Text::_('COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_LABEL') ), 'error' ); return false; } if (!File::exists(Path::clean($data['dbsslkey']))) { Factory::getApplication()->enqueueMessage( Text::sprintf( 'COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_BAD', Text::_('COM_CONFIG_FIELD_DATABASE_ENCRYPTION_KEY_LABEL') ), 'error' ); return false; } if (empty($data['dbsslcert'])) { Factory::getApplication()->enqueueMessage( Text::sprintf( 'COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_EMPTY', Text::_('COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_LABEL') ), 'error' ); return false; } if (!File::exists(Path::clean($data['dbsslcert']))) { Factory::getApplication()->enqueueMessage( Text::sprintf( 'COM_CONFIG_ERROR_DATABASE_ENCRYPTION_FILE_FIELD_BAD', Text::_('COM_CONFIG_FIELD_DATABASE_ENCRYPTION_CERT_LABEL') ), 'error' ); return false; } } else { // Reset unused options if (!empty($data['dbsslkey'])) { $data['dbsslkey'] = ''; } if (!empty($data['dbsslcert'])) { $data['dbsslcert'] = ''; } } } return $data; } /** * Method to save the configuration data. * * @param array $data An array containing all global config data. * * @return boolean True on success, false on failure. * * @since 1.6 */ public function save($data) { $app = Factory::getApplication(); // Try to load the values from the configuration file foreach ($this->protectedConfigurationFields as $fieldKey) { if (!isset($data[$fieldKey])) { $data[$fieldKey] = $app->get($fieldKey, ''); } } // Check that we aren't setting wrong database configuration $options = array( 'driver' => $data['dbtype'], 'host' => $data['host'], 'user' => $data['user'], 'password' => $data['password'], 'database' => $data['db'], 'prefix' => $data['dbprefix'], ); if ((int) $data['dbencryption'] !== 0) { $options['ssl'] = [ 'enable' => true, 'verify_server_cert' => (bool) $data['dbsslverifyservercert'], ]; foreach (['cipher', 'ca', 'key', 'cert'] as $value) { $confVal = trim($data['dbssl' . $value]); if ($confVal !== '') { $options['ssl'][$value] = $confVal; } } } try { $revisedDbo = DatabaseDriver::getInstance($options); $revisedDbo->getVersion(); } catch (\Exception $e) { $app->enqueueMessage(Text::sprintf('COM_CONFIG_ERROR_DATABASE_NOT_AVAILABLE', $e->getCode(), $e->getMessage()), 'error'); return false; } if ((int) $data['dbencryption'] !== 0 && empty($revisedDbo->getConnectionEncryption())) { if ($revisedDbo->isConnectionEncryptionSupported()) { Factory::getApplication()->enqueueMessage(Text::_('COM_CONFIG_ERROR_DATABASE_ENCRYPTION_CONN_NOT_ENCRYPT'), 'error'); } else { Factory::getApplication()->enqueueMessage(Text::_('COM_CONFIG_ERROR_DATABASE_ENCRYPTION_SRV_NOT_SUPPORTS'), 'error'); } return false; } // Check if we can set the Force SSL option if ((int) $data['force_ssl'] !== 0 && (int) $data['force_ssl'] !== (int) $app->get('force_ssl', '0')) { try { // Make an HTTPS request to check if the site is available in HTTPS. $host = Uri::getInstance()->getHost(); $options = new Registry(); $options->set('userAgent', 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0'); // Do not check for valid server certificate here, leave this to the user, moreover disable using a proxy if any is configured. $options->set( 'transport.curl', array( CURLOPT_SSL_VERIFYPEER => false, CURLOPT_SSL_VERIFYHOST => false, CURLOPT_PROXY => null, CURLOPT_PROXYUSERPWD => null, ) ); $response = HttpFactory::getHttp($options)->get('https://' . $host . Uri::root(true) . '/', array('Host' => $host), 10); // If available in HTTPS check also the status code. if (!in_array($response->code, array(200, 503, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 401), true)) { throw new \RuntimeException(Text::_('COM_CONFIG_ERROR_SSL_NOT_AVAILABLE_HTTP_CODE')); } } catch (\RuntimeException $e) { $data['force_ssl'] = 0; // Also update the user state $app->setUserState('com_config.config.global.data.force_ssl', 0); // Inform the user $app->enqueueMessage(Text::sprintf('COM_CONFIG_ERROR_SSL_NOT_AVAILABLE', $e->getMessage()), 'warning'); } } // Save the rules if (isset($data['rules'])) { $rules = new Rules($data['rules']); // Check that we aren't removing our Super User permission // Need to get groups from database, since they might have changed $myGroups = Access::getGroupsByUser(Factory::getUser()->get('id')); $myRules = $rules->getData(); $hasSuperAdmin = $myRules['core.admin']->allow($myGroups); if (!$hasSuperAdmin) { $app->enqueueMessage(Text::_('COM_CONFIG_ERROR_REMOVING_SUPER_ADMIN'), 'error'); return false; } $asset = Table::getInstance('asset'); if ($asset->loadByName('root.1')) { $asset->rules = (string) $rules; if (!$asset->check() || !$asset->store()) { $app->enqueueMessage($asset->getError(), 'error'); return false; } } else { $app->enqueueMessage(Text::_('COM_CONFIG_ERROR_ROOT_ASSET_NOT_FOUND'), 'error'); return false; } unset($data['rules']); } // Save the text filters if (isset($data['filters'])) { $registry = new Registry(array('filters' => $data['filters'])); $extension = Table::getInstance('extension'); // Get extension_id $extensionId = $extension->find(array('name' => 'com_config')); if ($extension->load((int) $extensionId)) { $extension->params = (string) $registry; if (!$extension->check() || !$extension->store()) { $app->enqueueMessage($extension->getError(), 'error'); return false; } } else { $app->enqueueMessage(Text::_('COM_CONFIG_ERROR_CONFIG_EXTENSION_NOT_FOUND'), 'error'); return false; } unset($data['filters']); } // Get the previous configuration. $prev = new \JConfig(); $prev = ArrayHelper::fromObject($prev); // Merge the new data in. We do this to preserve values that were not in the form. $data = array_merge($prev, $data); /* * Perform miscellaneous options based on configuration settings/changes. */ // Escape the offline message if present. if (isset($data['offline_message'])) { $data['offline_message'] = OutputFilter::ampReplace($data['offline_message']); } // Purge the database session table if we are changing to the database handler. if ($prev['session_handler'] != 'database' && $data['session_handler'] == 'database') { $db = $this->getDatabase(); $query = $db->getQuery(true) ->delete($db->quoteName('#__session')) ->where($db->quoteName('time') . ' < ' . (time() - 1)); $db->setQuery($query); $db->execute(); } // Purge the database session table if we are disabling session metadata if ($prev['session_metadata'] == 1 && $data['session_metadata'] == 0) { try { // If we are are using the session handler, purge the extra columns, otherwise truncate the whole session table if ($data['session_handler'] === 'database') { $revisedDbo->setQuery( $revisedDbo->getQuery(true) ->update('#__session') ->set( [ $revisedDbo->quoteName('client_id') . ' = 0', $revisedDbo->quoteName('guest') . ' = NULL', $revisedDbo->quoteName('userid') . ' = NULL', $revisedDbo->quoteName('username') . ' = NULL', ] ) )->execute(); } else { $revisedDbo->truncateTable('#__session'); } } catch (\RuntimeException $e) { /* * The database API logs errors on failures so we don't need to add any error handling mechanisms here. * Also, this data won't be added or checked anymore once the configuration is saved, so it'll purge itself * through normal garbage collection anyway or if not using the database handler someone can purge the * table on their own. Either way, carry on Soldier! */ } } // Ensure custom session file path exists or try to create it if changed if (!empty($data['session_filesystem_path'])) { $currentPath = $prev['session_filesystem_path'] ?? null; if ($currentPath) { $currentPath = Path::clean($currentPath); } $data['session_filesystem_path'] = Path::clean($data['session_filesystem_path']); if ($currentPath !== $data['session_filesystem_path']) { if (!Folder::exists($data['session_filesystem_path']) && !Folder::create($data['session_filesystem_path'])) { try { Log::add( Text::sprintf( 'COM_CONFIG_ERROR_CUSTOM_SESSION_FILESYSTEM_PATH_NOTWRITABLE_USING_DEFAULT', $data['session_filesystem_path'] ), Log::WARNING, 'jerror' ); } catch (\RuntimeException $logException) { $app->enqueueMessage( Text::sprintf( 'COM_CONFIG_ERROR_CUSTOM_SESSION_FILESYSTEM_PATH_NOTWRITABLE_USING_DEFAULT', $data['session_filesystem_path'] ), 'warning' ); } $data['session_filesystem_path'] = $currentPath; } } } // Set the shared session configuration if (isset($data['shared_session'])) { $currentShared = $prev['shared_session'] ?? '0'; // Has the user enabled shared sessions? if ($data['shared_session'] == 1 && $currentShared == 0) { // Generate a random shared session name $data['session_name'] = UserHelper::genRandomPassword(16); } // Has the user disabled shared sessions? if ($data['shared_session'] == 0 && $currentShared == 1) { // Remove the session name value unset($data['session_name']); } } // Set the shared session configuration if (isset($data['shared_session'])) { $currentShared = $prev['shared_session'] ?? '0'; // Has the user enabled shared sessions? if ($data['shared_session'] == 1 && $currentShared == 0) { // Generate a random shared session name $data['session_name'] = UserHelper::genRandomPassword(16); } // Has the user disabled shared sessions? if ($data['shared_session'] == 0 && $currentShared == 1) { // Remove the session name value unset($data['session_name']); } } if (empty($data['cache_handler'])) { $data['caching'] = 0; } /* * Look for a custom cache_path * First check if a path is given in the submitted data, then check if a path exists in the previous data, otherwise use the default */ if (!empty($data['cache_path'])) { $path = $data['cache_path']; } elseif (!empty($prev['cache_path'])) { $path = $prev['cache_path']; } else { $path = JPATH_CACHE; } // Give a warning if the cache-folder can not be opened if ($data['caching'] > 0 && $data['cache_handler'] == 'file' && @opendir($path) == false) { $error = true; // If a custom path is in use, try using the system default instead of disabling cache if ($path !== JPATH_CACHE && @opendir(JPATH_CACHE) != false) { try { Log::add( Text::sprintf('COM_CONFIG_ERROR_CUSTOM_CACHE_PATH_NOTWRITABLE_USING_DEFAULT', $path, JPATH_CACHE), Log::WARNING, 'jerror' ); } catch (\RuntimeException $logException) { $app->enqueueMessage( Text::sprintf('COM_CONFIG_ERROR_CUSTOM_CACHE_PATH_NOTWRITABLE_USING_DEFAULT', $path, JPATH_CACHE), 'warning' ); } $path = JPATH_CACHE; $error = false; $data['cache_path'] = ''; } if ($error) { try { Log::add(Text::sprintf('COM_CONFIG_ERROR_CACHE_PATH_NOTWRITABLE', $path), Log::WARNING, 'jerror'); } catch (\RuntimeException $exception) { $app->enqueueMessage(Text::sprintf('COM_CONFIG_ERROR_CACHE_PATH_NOTWRITABLE', $path), 'warning'); } $data['caching'] = 0; } } // Did the user remove their custom cache path? Don't save the variable to the config if (empty($data['cache_path'])) { unset($data['cache_path']); } // Clean the cache if disabled but previously enabled or changing cache handlers; these operations use the `$prev` data already in memory if ((!$data['caching'] && $prev['caching']) || $data['cache_handler'] !== $prev['cache_handler']) { try { Factory::getCache()->clean(); } catch (CacheConnectingException $exception) { try { Log::add(Text::_('COM_CONFIG_ERROR_CACHE_CONNECTION_FAILED'), Log::WARNING, 'jerror'); } catch (\RuntimeException $logException) { $app->enqueueMessage(Text::_('COM_CONFIG_ERROR_CACHE_CONNECTION_FAILED'), 'warning'); } } catch (UnsupportedCacheException $exception) { try { Log::add(Text::_('COM_CONFIG_ERROR_CACHE_DRIVER_UNSUPPORTED'), Log::WARNING, 'jerror'); } catch (\RuntimeException $logException) { $app->enqueueMessage(Text::_('COM_CONFIG_ERROR_CACHE_DRIVER_UNSUPPORTED'), 'warning'); } } } /* * Look for a custom tmp_path * First check if a path is given in the submitted data, then check if a path exists in the previous data, otherwise use the default */ $defaultTmpPath = JPATH_ROOT . '/tmp'; if (!empty($data['tmp_path'])) { $path = $data['tmp_path']; } elseif (!empty($prev['tmp_path'])) { $path = $prev['tmp_path']; } else { $path = $defaultTmpPath; } $path = Path::clean($path); // Give a warning if the tmp-folder is not valid or not writable if (!is_dir($path) || !is_writable($path)) { $error = true; // If a custom path is in use, try using the system default tmp path if ($path !== $defaultTmpPath && is_dir($defaultTmpPath) && is_writable($defaultTmpPath)) { try { Log::add( Text::sprintf('COM_CONFIG_ERROR_CUSTOM_TEMP_PATH_NOTWRITABLE_USING_DEFAULT', $path, $defaultTmpPath), Log::WARNING, 'jerror' ); } catch (\RuntimeException $logException) { $app->enqueueMessage( Text::sprintf('COM_CONFIG_ERROR_CUSTOM_TEMP_PATH_NOTWRITABLE_USING_DEFAULT', $path, $defaultTmpPath), 'warning' ); } $error = false; $data['tmp_path'] = $defaultTmpPath; } if ($error) { try { Log::add(Text::sprintf('COM_CONFIG_ERROR_TMP_PATH_NOTWRITABLE', $path), Log::WARNING, 'jerror'); } catch (\RuntimeException $exception) { $app->enqueueMessage(Text::sprintf('COM_CONFIG_ERROR_TMP_PATH_NOTWRITABLE', $path), 'warning'); } } } /* * Look for a custom log_path * First check if a path is given in the submitted data, then check if a path exists in the previous data, otherwise use the default */ $defaultLogPath = JPATH_ADMINISTRATOR . '/logs'; if (!empty($data['log_path'])) { $path = $data['log_path']; } elseif (!empty($prev['log_path'])) { $path = $prev['log_path']; } else { $path = $defaultLogPath; } $path = Path::clean($path); // Give a warning if the log-folder is not valid or not writable if (!is_dir($path) || !is_writable($path)) { $error = true; // If a custom path is in use, try using the system default log path if ($path !== $defaultLogPath && is_dir($defaultLogPath) && is_writable($defaultLogPath)) { try { Log::add( Text::sprintf('COM_CONFIG_ERROR_CUSTOM_LOG_PATH_NOTWRITABLE_USING_DEFAULT', $path, $defaultLogPath), Log::WARNING, 'jerror' ); } catch (\RuntimeException $logException) { $app->enqueueMessage( Text::sprintf('COM_CONFIG_ERROR_CUSTOM_LOG_PATH_NOTWRITABLE_USING_DEFAULT', $path, $defaultLogPath), 'warning' ); } $error = false; $data['log_path'] = $defaultLogPath; } if ($error) { try { Log::add(Text::sprintf('COM_CONFIG_ERROR_LOG_PATH_NOTWRITABLE', $path), Log::WARNING, 'jerror'); } catch (\RuntimeException $exception) { $app->enqueueMessage(Text::sprintf('COM_CONFIG_ERROR_LOG_PATH_NOTWRITABLE', $path), 'warning'); } } } // Create the new configuration object. $config = new Registry($data); // Overwrite webservices cors settings $app->set('cors', $data['cors']); $app->set('cors_allow_origin', $data['cors_allow_origin']); $app->set('cors_allow_headers', $data['cors_allow_headers']); $app->set('cors_allow_methods', $data['cors_allow_methods']); // Clear cache of com_config component. $this->cleanCache('_system'); $result = $app->triggerEvent('onApplicationBeforeSave', array($config)); // Store the data. if (in_array(false, $result, true)) { throw new \RuntimeException(Text::_('COM_CONFIG_ERROR_UNKNOWN_BEFORE_SAVING')); } // Write the configuration file. $result = $this->writeConfigFile($config); // Trigger the after save event. $app->triggerEvent('onApplicationAfterSave', array($config)); return $result; } /** * Method to unset the root_user value from configuration data. * * This method will load the global configuration data straight from * JConfig and remove the root_user value for security, then save the configuration. * * @return boolean True on success, false on failure. * * @since 1.6 */ public function removeroot() { $app = Factory::getApplication(); // Get the previous configuration. $prev = new \JConfig(); $prev = ArrayHelper::fromObject($prev); // Create the new configuration object, and unset the root_user property unset($prev['root_user']); $config = new Registry($prev); $result = $app->triggerEvent('onApplicationBeforeSave', array($config)); // Store the data. if (in_array(false, $result, true)) { throw new \RuntimeException(Text::_('COM_CONFIG_ERROR_UNKNOWN_BEFORE_SAVING')); } // Write the configuration file. $result = $this->writeConfigFile($config); // Trigger the after save event. $app->triggerEvent('onApplicationAfterSave', array($config)); return $result; } /** * Method to write the configuration to a file. * * @param Registry $config A Registry object containing all global config data. * * @return boolean True on success, false on failure. * * @since 2.5.4 * @throws \RuntimeException */ private function writeConfigFile(Registry $config) { // Set the configuration file path. $file = JPATH_CONFIGURATION . '/configuration.php'; $app = Factory::getApplication(); // Attempt to make the file writeable. if (Path::isOwner($file) && !Path::setPermissions($file, '0644')) { $app->enqueueMessage(Text::_('COM_CONFIG_ERROR_CONFIGURATION_PHP_NOTWRITABLE'), 'notice'); } // Attempt to write the configuration file as a PHP class named JConfig. $configuration = $config->toString('PHP', array('class' => 'JConfig', 'closingtag' => false)); if (!File::write($file, $configuration)) { throw new \RuntimeException(Text::_('COM_CONFIG_ERROR_WRITE_FAILED')); } // Attempt to make the file unwriteable. if (Path::isOwner($file) && !Path::setPermissions($file, '0444')) { $app->enqueueMessage(Text::_('COM_CONFIG_ERROR_CONFIGURATION_PHP_NOTUNWRITABLE'), 'notice'); } return true; } /** * Method to store the permission values in the asset table. * * This method will get an array with permission key value pairs and transform it * into json and update the asset table in the database. * * @param string $permission Need an array with Permissions (component, rule, value and title) * * @return array|bool A list of result data or false on failure. * * @since 3.5 */ public function storePermissions($permission = null) { $app = Factory::getApplication(); $user = Factory::getUser(); if (is_null($permission)) { // Get data from input. $permission = array( 'component' => $app->input->Json->get('comp'), 'action' => $app->input->Json->get('action'), 'rule' => $app->input->Json->get('rule'), 'value' => $app->input->Json->get('value'), 'title' => $app->input->Json->get('title', '', 'RAW') ); } // We are creating a new item so we don't have an item id so don't allow. if (substr($permission['component'], -6) === '.false') { $app->enqueueMessage(Text::_('JLIB_RULES_SAVE_BEFORE_CHANGE_PERMISSIONS'), 'error'); return false; } // Check if the user is authorized to do this. if (!$user->authorise('core.admin', $permission['component'])) { $app->enqueueMessage(Text::_('JERROR_ALERTNOAUTHOR'), 'error'); return false; } $permission['component'] = empty($permission['component']) ? 'root.1' : $permission['component']; // Current view is global config? $isGlobalConfig = $permission['component'] === 'root.1'; // Check if changed group has Super User permissions. $isSuperUserGroupBefore = Access::checkGroup($permission['rule'], 'core.admin'); // Check if current user belongs to changed group. $currentUserBelongsToGroup = in_array((int) $permission['rule'], $user->groups) ? true : false; // Get current user groups tree. $currentUserGroupsTree = Access::getGroupsByUser($user->id, true); // Check if current user belongs to changed group. $currentUserSuperUser = $user->authorise('core.admin'); // If user is not Super User cannot change the permissions of a group it belongs to. if (!$currentUserSuperUser && $currentUserBelongsToGroup) { $app->enqueueMessage(Text::_('JLIB_USER_ERROR_CANNOT_CHANGE_OWN_GROUPS'), 'error'); return false; } // If user is not Super User cannot change the permissions of a group it belongs to. if (!$currentUserSuperUser && in_array((int) $permission['rule'], $currentUserGroupsTree)) { $app->enqueueMessage(Text::_('JLIB_USER_ERROR_CANNOT_CHANGE_OWN_PARENT_GROUPS'), 'error'); return false; } // If user is not Super User cannot change the permissions of a Super User Group. if (!$currentUserSuperUser && $isSuperUserGroupBefore && !$currentUserBelongsToGroup) { $app->enqueueMessage(Text::_('JLIB_USER_ERROR_CANNOT_CHANGE_SUPER_USER'), 'error'); return false; } // If user is not Super User cannot change the Super User permissions in any group it belongs to. if ($isSuperUserGroupBefore && $currentUserBelongsToGroup && $permission['action'] === 'core.admin') { $app->enqueueMessage(Text::_('JLIB_USER_ERROR_CANNOT_DEMOTE_SELF'), 'error'); return false; } try { /** @var Asset $asset */ $asset = Table::getInstance('asset'); $result = $asset->loadByName($permission['component']); if ($result === false) { $data = array($permission['action'] => array($permission['rule'] => $permission['value'])); $rules = new Rules($data); $asset->rules = (string) $rules; $asset->name = (string) $permission['component']; $asset->title = (string) $permission['title']; // Get the parent asset id so we have a correct tree. /** @var Asset $parentAsset */ $parentAsset = Table::getInstance('Asset'); if (strpos($asset->name, '.') !== false) { $assetParts = explode('.', $asset->name); $parentAsset->loadByName($assetParts[0]); $parentAssetId = $parentAsset->id; } else { $parentAssetId = $parentAsset->getRootId(); } /** * @todo: incorrect ACL stored * When changing a permission of an item that doesn't have a row in the asset table the row a new row is created. * This works fine for item <-> component <-> global config scenario and component <-> global config scenario. * But doesn't work properly for item <-> section(s) <-> component <-> global config scenario, * because a wrong parent asset id (the component) is stored. * Happens when there is no row in the asset table (ex: deleted or not created on update). */ $asset->setLocation($parentAssetId, 'last-child'); } else { // Decode the rule settings. $temp = json_decode($asset->rules, true); // Check if a new value is to be set. if (isset($permission['value'])) { // Check if we already have an action entry. if (!isset($temp[$permission['action']])) { $temp[$permission['action']] = array(); } // Check if we already have a rule entry. if (!isset($temp[$permission['action']][$permission['rule']])) { $temp[$permission['action']][$permission['rule']] = array(); } // Set the new permission. $temp[$permission['action']][$permission['rule']] = (int) $permission['value']; // Check if we have an inherited setting. if ($permission['value'] === '') { unset($temp[$permission['action']][$permission['rule']]); } // Check if we have any rules. if (!$temp[$permission['action']]) { unset($temp[$permission['action']]); } } else { // There is no value so remove the action as it's not needed. unset($temp[$permission['action']]); } $asset->rules = json_encode($temp, JSON_FORCE_OBJECT); } if (!$asset->check() || !$asset->store()) { $app->enqueueMessage(Text::_('JLIB_UNKNOWN'), 'error'); return false; } } catch (\Exception $e) { $app->enqueueMessage($e->getMessage(), 'error'); return false; } // All checks done. $result = array( 'text' => '', 'class' => '', 'result' => true, ); // Show the current effective calculated permission considering current group, path and cascade. try { // The database instance $db = $this->getDatabase(); // Get the asset id by the name of the component. $query = $db->getQuery(true) ->select($db->quoteName('id')) ->from($db->quoteName('#__assets')) ->where($db->quoteName('name') . ' = :component') ->bind(':component', $permission['component']); $db->setQuery($query); $assetId = (int) $db->loadResult(); // Fetch the parent asset id. $parentAssetId = null; /** * @todo: incorrect info * When creating a new item (not saving) it uses the calculated permissions from the component (item <-> component <-> global config). * But if we have a section too (item <-> section(s) <-> component <-> global config) this is not correct. * Also, currently it uses the component permission, but should use the calculated permissions for a child of the component/section. */ // If not in global config we need the parent_id asset to calculate permissions. if (!$isGlobalConfig) { // In this case we need to get the component rules too. $query->clear() ->select($db->quoteName('parent_id')) ->from($db->quoteName('#__assets')) ->where($db->quoteName('id') . ' = :assetid') ->bind(':assetid', $assetId, ParameterType::INTEGER); $db->setQuery($query); $parentAssetId = (int) $db->loadResult(); } // Get the group parent id of the current group. $rule = (int) $permission['rule']; $query->clear() ->select($db->quoteName('parent_id')) ->from($db->quoteName('#__usergroups')) ->where($db->quoteName('id') . ' = :rule') ->bind(':rule', $rule, ParameterType::INTEGER); $db->setQuery($query); $parentGroupId = (int) $db->loadResult(); // Count the number of child groups of the current group. $query->clear() ->select('COUNT(' . $db->quoteName('id') . ')') ->from($db->quoteName('#__usergroups')) ->where($db->quoteName('parent_id') . ' = :rule') ->bind(':rule', $rule, ParameterType::INTEGER); $db->setQuery($query); $totalChildGroups = (int) $db->loadResult(); } catch (\Exception $e) { $app->enqueueMessage($e->getMessage(), 'error'); return false; } // Clear access statistics. Access::clearStatics(); // After current group permission is changed we need to check again if the group has Super User permissions. $isSuperUserGroupAfter = Access::checkGroup($permission['rule'], 'core.admin'); // Get the rule for just this asset (non-recursive) and get the actual setting for the action for this group. $assetRule = Access::getAssetRules($assetId, false, false)->allow($permission['action'], $permission['rule']); // Get the group, group parent id, and group global config recursive calculated permission for the chosen action. $inheritedGroupRule = Access::checkGroup($permission['rule'], $permission['action'], $assetId); if (!empty($parentAssetId)) { $inheritedGroupParentAssetRule = Access::checkGroup($permission['rule'], $permission['action'], $parentAssetId); } else { $inheritedGroupParentAssetRule = null; } $inheritedParentGroupRule = !empty($parentGroupId) ? Access::checkGroup($parentGroupId, $permission['action'], $assetId) : null; // Current group is a Super User group, so calculated setting is "Allowed (Super User)". if ($isSuperUserGroupAfter) { $result['class'] = 'badge bg-success'; $result['text'] = '<span class="icon-lock icon-white" aria-hidden="true"></span>' . Text::_('JLIB_RULES_ALLOWED_ADMIN'); } else { // Not super user. // First get the real recursive calculated setting and add (Inherited) to it. // If recursive calculated setting is "Denied" or null. Calculated permission is "Not Allowed (Inherited)". if ($inheritedGroupRule === null || $inheritedGroupRule === false) { $result['class'] = 'badge bg-danger'; $result['text'] = Text::_('JLIB_RULES_NOT_ALLOWED_INHERITED'); } else { // If recursive calculated setting is "Allowed". Calculated permission is "Allowed (Inherited)". $result['class'] = 'badge bg-success'; $result['text'] = Text::_('JLIB_RULES_ALLOWED_INHERITED'); } // Second part: Overwrite the calculated permissions labels if there is an explicit permission in the current group. /** * @todo: incorrect info * If a component has a permission that doesn't exists in global config (ex: frontend editing in com_modules) by default * we get "Not Allowed (Inherited)" when we should get "Not Allowed (Default)". */ // If there is an explicit permission "Not Allowed". Calculated permission is "Not Allowed". if ($assetRule === false) { $result['class'] = 'badge bg-danger'; $result['text'] = Text::_('JLIB_RULES_NOT_ALLOWED'); } elseif ($assetRule === true) { // If there is an explicit permission is "Allowed". Calculated permission is "Allowed". $result['class'] = 'badge bg-success'; $result['text'] = Text::_('JLIB_RULES_ALLOWED'); } // Third part: Overwrite the calculated permissions labels for special cases. // Global configuration with "Not Set" permission. Calculated permission is "Not Allowed (Default)". if (empty($parentGroupId) && $isGlobalConfig === true && $assetRule === null) { $result['class'] = 'badge bg-danger'; $result['text'] = Text::_('JLIB_RULES_NOT_ALLOWED_DEFAULT'); } elseif ($inheritedGroupParentAssetRule === false || $inheritedParentGroupRule === false) { /** * Component/Item with explicit "Denied" permission at parent Asset (Category, Component or Global config) configuration. * Or some parent group has an explicit "Denied". * Calculated permission is "Not Allowed (Locked)". */ $result['class'] = 'badge bg-danger'; $result['text'] = '<span class="icon-lock icon-white" aria-hidden="true"></span>' . Text::_('JLIB_RULES_NOT_ALLOWED_LOCKED'); } } // If removed or added super user from group, we need to refresh the page to recalculate all settings. if ($isSuperUserGroupBefore != $isSuperUserGroupAfter) { $app->enqueueMessage(Text::_('JLIB_RULES_NOTICE_RECALCULATE_GROUP_PERMISSIONS'), 'notice'); } // If this group has child groups, we need to refresh the page to recalculate the child settings. if ($totalChildGroups > 0) { $app->enqueueMessage(Text::_('JLIB_RULES_NOTICE_RECALCULATE_GROUP_CHILDS_PERMISSIONS'), 'notice'); } return $result; } /** * Method to send a test mail which is called via an AJAX request * * @return boolean * * @since 3.5 */ public function sendTestMail() { // Set the new values to test with the current settings $app = Factory::getApplication(); $user = Factory::getUser(); $input = $app->input->json; $smtppass = $input->get('smtppass', null, 'RAW'); $app->set('smtpauth', $input->get('smtpauth')); $app->set('smtpuser', $input->get('smtpuser', '', 'STRING')); $app->set('smtphost', $input->get('smtphost')); $app->set('smtpsecure', $input->get('smtpsecure')); $app->set('smtpport', $input->get('smtpport')); $app->set('mailfrom', $input->get('mailfrom', '', 'STRING')); $app->set('fromname', $input->get('fromname', '', 'STRING')); $app->set('mailer', $input->get('mailer')); $app->set('mailonline', $input->get('mailonline')); // Use smtppass only if it was submitted if ($smtppass !== null) { $app->set('smtppass', $smtppass); } $mail = Factory::getMailer(); // Prepare email and try to send it $mailer = new MailTemplate('com_config.test_mail', $user->getParam('language', $app->get('language')), $mail); $mailer->addTemplateData( array( 'sitename' => $app->get('sitename'), 'method' => Text::_('COM_CONFIG_SENDMAIL_METHOD_' . strtoupper($mail->Mailer)) ) ); $mailer->addRecipient($app->get('mailfrom'), $app->get('fromname')); try { $mailSent = $mailer->send(); } catch (MailDisabledException | phpMailerException $e) { $app->enqueueMessage($e->getMessage(), 'error'); return false; } if ($mailSent === true) { $methodName = Text::_('COM_CONFIG_SENDMAIL_METHOD_' . strtoupper($mail->Mailer)); // If JMail send the mail using PHP Mail as fallback. if ($mail->Mailer !== $app->get('mailer')) { $app->enqueueMessage(Text::sprintf('COM_CONFIG_SENDMAIL_SUCCESS_FALLBACK', $app->get('mailfrom'), $methodName), 'warning'); } else { $app->enqueueMessage(Text::sprintf('COM_CONFIG_SENDMAIL_SUCCESS', $app->get('mailfrom'), $methodName), 'message'); } return true; } $app->enqueueMessage(Text::_('COM_CONFIG_SENDMAIL_ERROR'), 'error'); return false; } }
