AnonymousFox

/home/develito/www/plugins/system/bfnetwork/bfnetwork/bfExtensions.php

<?php
/**
 * @package   Blue Flame Network (bfNetwork)
 * @copyright Copyright (C) 2011, 2012, 2013, 2014, 2015, 2016 Blue Flame IT Ltd. All rights reserved.
 * @license   GNU General Public License version 3 or later
 * @link      https://myJoomla.com/
 * @author    Phil Taylor / Blue Flame IT Ltd.
 *
 * bfNetwork is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * bfNetwork is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this package.  If not, see http://www.gnu.org/licenses/
 */

/**
 * If we have not already included bfEncrypt then this must be a direct call, and
 * so we need to decrypt the incoming request.
 */
if (!class_exists('bfEncrypt')) {
    require 'bfEncrypt.php';
}

/**
 * Ok so this is stupid, but we are dealing with XML Parsing on crappy servers on sites with 100+ extensions installed - gulp!
 * 5 Mins! GULP - Most well configured servers will probably not honour this, but in our live tests on crappy servers this seems to work
 */
@set_time_limit(60 * 5);

/**
 * If we have got here then we have already passed through decrypting
 * the encrypted header and so we are sure we are now secure and no one
 * else cannot run the code below.
 */
final class bfExtensions
{
    /**
     * @var JDatabase|JDatabaseDriver|object
     */
    protected $db;

/**
     * Incoming decrypted vars from the request
     * @var stdClass
     */
    private $_dataObj;

/**
     * We pass the command to run as a simple integer in our encrypted
     * request this is mainly to speed up the decryption process, plus its a
     * single digit(or 2) rather than a huge string to remember :-)
     */
    private $_methods = array(
        1 => 'getExtensions'
    );

/**
     * PHP 5 Constructor,
     * I inject the request to the object
     *
     * @param stdClass $dataObj
     */
    public function __construct($dataObj = NULL)
    {
        // init Joomla
        require 'bfInitJoomla.php';

// Set the request vars
        $this->_dataObj = $dataObj;
    }

/**
     * I'm the controller - I run methods based on the request integer
     */
    public function run()
    {
        if (property_exists($this->_dataObj, 'c')) {

$c = ( int )$this->_dataObj->c;
            if (array_key_exists($c, $this->_methods)) {

// call the right method
                $this->{$this->_methods [$c]} ();
            } else {

// Die if an unknown function
                bfEncrypt::reply('error', 'No Such method #err1 - ' . $c);
            }
        } else {

// Die if an unknown function
            bfEncrypt::reply('error', 'No Such method #err2');
        }
    }

/**
     * Get a JSON formatted list of installed extensions
     * Needs to be public so we can call it from the audit.
     *
     * @return string
     */
    public function getExtensions()
    {
        // connect/get the Joomla db object
        $this->db = JFactory::getDbo();

// crazy way of handling Joomla 1.5.x legacy :-(
        $one5 = FALSE;

// Get Joomla 2.0+ Extensions
        $this->db->setQuery('SELECT e.extension_id, e.name, e.type, e.element, e.enabled, e.folder,
                                (
                                 SELECT title
                                 FROM #__menu AS m
                                 WHERE m.component_id = e.extension_id
                                 AND parent_id = 1
                                 ORDER BY ID ASC LIMIT 1
                                 )
                                 AS title
                                FROM #__extensions AS e
                                WHERE protected = 0');
        $installedExtensions = $this->db->loadObjectList();

// ok if we have none maybe we are Joomla < 1.5.26
        if (!$installedExtensions) {

// Yooo hoo I'm on a crap old, out of date, probably hackable Joomla version!
            $one5 = TRUE;

// Get the extensions - used to be called components
            $this->db->setQuery('SELECT "component" as "type", name, `option` as "element", enabled FROM #__components WHERE iscore != 1 and parent = 0');
            $components = $this->db->loadObjectList();

// Get the plugins
            $this->db->setQuery('SELECT "plugin" as "type", name, element, folder, published as enabled FROM #__plugins WHERE iscore != 1');
            $plugins = $this->db->loadObjectList();

// get the modules
            $this->db->setQuery('SELECT  "module" as "type", module, module as name, client_id, published as enabled FROM #__modules WHERE iscore != 1');
            $modules = $this->db->loadObjectList();

/**
             * Get the templates - I n Joomla 1.5.x the templates are not in the
             * db unless published so we need to read the folders from the /templates folders
             * Note in Joomla 1.5.x there was no such think as admin templates
             */
            $folders   = array_merge(scandir(JPATH_BASE . '/templates'), scandir(JPATH_ADMINISTRATOR . '/templates'));
            $templates = array();
            foreach ($folders as $templateFolder) {
                $f = JPATH_BASE . '/templates/' . trim($templateFolder);
                $a = JPATH_ADMINISTRATOR . '/templates/' . trim($templateFolder);

// We dont want index.html etc...
                if (!is_dir($f) && !is_dir($a) || ($templateFolder == '.' || $templateFolder == '..')) {
                    continue;
                }

if (is_dir($a)) {
                    $client_id = 1;
                } else {
                    $client_id = 0;
                }

// make it look like we want like Joomla 2.5+ would
                $template = array(
                    'type'      => 'template',
                    'template'  => $templateFolder,
                    'client_id' => $client_id,
                    'enabled'   => 1
                );

// Convert to an obj
                $templates[] = json_decode(json_encode($template));
            }

// Merge all the "extensions" we have found all over the place
            $installedExtensions = array_merge($components, $plugins, $modules, $templates);
        }

$lang = JFactory::getLanguage();

// Load all the language strings up front incase any strings are shared
        foreach ($installedExtensions as $k => $ext) {

$lang->load(strtolower($ext->element) . ".sys", JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load(strtolower($ext->element) . ".sys", JPATH_SITE, 'en-GB', TRUE);
            $lang->load(strtolower($ext->name) . ".sys", JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load(strtolower($ext->name) . ".sys", JPATH_SITE, 'en-GB', TRUE);
            $lang->load(strtolower($ext->title) . ".sys", JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load(strtolower($ext->title) . ".sys", JPATH_SITE, 'en-GB', TRUE);

$lang->load(strtolower($ext->element), JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load(strtolower($ext->element), JPATH_SITE, 'en-GB', TRUE);
            $lang->load(strtolower($ext->name), JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load(strtolower($ext->name), JPATH_SITE, 'en-GB', TRUE);
            $lang->load(strtolower($ext->title), JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load(strtolower($ext->title), JPATH_SITE, 'en-GB', TRUE);

$element = str_replace('_TITLE', '', strtoupper($ext->element));
            $name    = str_replace('_TITLE', '', strtoupper($ext->name));
            $title   = str_replace('_TITLE', '', strtoupper($ext->title));

$lang->load(strtolower($element) . ".sys", JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load(strtolower($element) . ".sys", JPATH_SITE, 'en-GB', TRUE);
            $lang->load(strtolower($name) . ".sys", JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load(strtolower($name) . ".sys", JPATH_SITE, 'en-GB', TRUE);
            $lang->load(strtolower($title) . ".sys", JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load(strtolower($title) . ".sys", JPATH_SITE, 'en-GB', TRUE);

$lang->load(strtolower($element), JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load(strtolower($element), JPATH_SITE, 'en-GB', TRUE);
            $lang->load(strtolower($name), JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load(strtolower($name), JPATH_SITE, 'en-GB', TRUE);
            $lang->load(strtolower($title), JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load(strtolower($title), JPATH_SITE, 'en-GB', TRUE);

// templates
            $lang->load('tpl_' . strtolower($name), JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load('tpl_' . strtolower($name), JPATH_SITE, 'en-GB', TRUE);

// Joomla 1.5.x modules
            $lang->load('mod_' . strtolower($name), JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            $lang->load('mod_' . strtolower($name), JPATH_SITE, 'en-GB', TRUE);

// tut tut Akeeba - bad naming!
            $lang->load(strtolower('PLG_SYSTEM_SRP'), JPATH_ADMINISTRATOR, 'en-GB', TRUE); // should be plg_srp
            $lang->load(strtolower('PLG_SYSTEM_ONECLICKACTION'), JPATH_SITE, 'en-GB', TRUE); // should be plg_oneclickaction
            $lang->load(strtolower('PLG_SYSTEM_ONECLICKACTION'), JPATH_ADMINISTRATOR, 'en-GB', TRUE); // should be plg_oneclickaction

// Joomla 1.5 plugins
            if ($ext->type == 'plugin') {
                $plg = 'plg_' . $ext->folder . '_' . $ext->element;
                $lang->load(strtolower($plg), JPATH_SITE, 'en-GB', TRUE);
                $lang->load(strtolower($plg), JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            }

if ($ext->type == 'template') {
                $plg = 'tpl_' . $ext->name;
                $lang->load(strtolower($plg), JPATH_SITE, 'en-GB', TRUE);
                $lang->load(strtolower($plg), JPATH_ADMINISTRATOR, 'en-GB', TRUE);
            }
        }

// ok now we have the extensions - get the xml for further offline crunching
        foreach ($installedExtensions as $k => $ext) {

// remove not supported types :-(
            if ($ext->type == 'file' || $ext->type == 'package') {
                unset($installedExtensions[$k]);
                continue;
            }
            $ext->xmlFile = $this->findManifest($ext);

try {
                if ($ext->xmlFile !== FALSE) {
                    $parts = explode('/', $ext->xmlFile);
                    array_pop($parts);
                    $ext->path = implode('/', $parts);
                    bfLog::log('Loading XML file = ' . str_replace(JPATH_BASE, '', $ext->xmlFile));
                    $xml   = trim(file_get_contents($ext->xmlFile));
                    $myXML = new SimpleXMLElement($xml);
                    if (property_exists($myXML, 'description')) {
                        $ext->desc = $myXML->description;
                    }
                    $ext->xmlFileContents = base64_encode(gzcompress($xml));
                    $ext->xmlFileCreated  = filemtime($ext->xmlFile);
                } else {
                    $ext->MANIFESTERROR = TRUE;
                }
            } catch (Exception $e) {
                bfLog::log('EXCEPTION = ' . $ext->xmlFile . ' ' . $e->getMessage());
                die('Could not process XML file at: ' . str_replace(JPATH_BASE, '', $ext->xmlFile));
            }

$ext->name  = JText::_($ext->name);
            $ext->title = JText::_($ext->title);
            $ext->desc  = base64_encode(gzcompress(JText::_($ext->desc)));

// remove base paths - we dont want to leak data :)
            $ext->xmlFile = $this->removeBase($ext->xmlFile);
            $ext->path    = $this->removeBase($ext->path);

// Sort so its pretty - not that anyone sees, but debugging is easier
            $ext = (array)$ext;
            ksort($ext);

// push to the result
            $installedExtensions[$k] = $ext;
        }

return json_encode($installedExtensions);
    }

/**
     * Find the XML file to parse
     *
     * @param $ext stdClass
     *
     * @return bool
     */
    private function findManifest($ext)
    {

$prefixes = array('com_',
                          'ext_',
                          'plg_content_',
                          'plg_system_',
                          'plg_user_',
                          'plg_authentication_',
                          'plg_authentication_',
                          'plg_captcha_',
                          'plg_content_',
                          'plg_editors_',
                          'plg_editors-xtd_',
                          'plg_extension_',
                          'plg_finder_',
                          'plg_quickicon_',
                          'plg_search_',
                          'plg_system_',
                          'plg_twofactorauth_',
                          'plg_user_',
                          'plg_',
        );

if (property_exists($ext, 'element')) {
            $shortName = str_replace($prefixes, '', strtolower($ext->element));
        } else {
            $shortName = str_replace($prefixes, '', strtolower($ext->option));
        }

$try = array();

// Let the UGLY code begin
        switch ($ext->type) {
            case 'component':
                $try[]  = JPATH_ADMINISTRATOR . '/components/' . $ext->element . '/' . $shortName . '.xml';
                $last[] = JPATH_ADMINISTRATOR . '/components/' . $ext->element . '/';
                break;
            case 'module':
                $try[]  = JPATH_ADMINISTRATOR . '/modules/' . $ext->element . '/' . $shortName . '.xml';
                $try[]  = JPATH_BASE . '/modules/' . $ext->element . '/' . $shortName . '.xml';
                $try[]  = JPATH_ADMINISTRATOR . '/modules/' . $ext->module . '/' . $ext->module . '.xml';
                $try[]  = JPATH_BASE . '/modules/' . $ext->module . '/' . $ext->module . '.xml';
                $last[] = JPATH_ADMINISTRATOR . '/modules/' . $ext->module . '/';
                $last[] = JPATH_BASE . '/modules/' . $ext->module . '/';
                break;
            case 'template':

$try[] = JPATH_ADMINISTRATOR . '/templates/' . $ext->element . '/templateDetails.xml';
                $try[] = JPATH_BASE . '/templates/' . $ext->element . '/templateDetails.xml';
                if (property_exists($ext, 'template')) {
                    $try[] = JPATH_ADMINISTRATOR . '/templates/' . $ext->template . '/templateDetails.xml';
                    $try[] = JPATH_BASE . '/templates/' . $ext->template . '/templateDetails.xml';
                }
                if (property_exists($ext, 'name')) {
                    $try[] = JPATH_ADMINISTRATOR . '/templates/' . $ext->name . '/templateDetails.xml';
                    $try[] = JPATH_BASE . '/templates/' . $ext->name . '/templateDetails.xml';
                }
                break;
            case 'language':
                $try[] = JPATH_ADMINISTRATOR . '/language/' . $ext->element . '/' . $ext->element . '.xml';
                $try[] = JPATH_BASE . '/language/' . $ext->element . '/' . $ext->element . '.xml';
                break;
            case 'plugin':
                $try[] = JPATH_ADMINISTRATOR . '/plugins/' . $ext->element . '/' . $shortName . '.xml';
                $try[] = JPATH_BASE . '/plugins/' . $ext->folder . '/' . $ext->element . '/' . $shortName . '.xml';
                $try[] = JPATH_BASE . '/plugins/' . $ext->element . '/' . $shortName . '.xml';
                $try[] = JPATH_BASE . '/plugins/' . $ext->folder . '/' . $shortName . '.xml';
                $try[] = JPATH_BASE . '/plugins/' . $ext->option . '/' . $shortName . '.xml';

$last[] = JPATH_ADMINISTRATOR . '/plugins/' . $ext->element . '/';
                $last[] = JPATH_BASE . '/plugins/' . $ext->folder . '/' . $ext->element . '/';
                $last[] = JPATH_BASE . '/plugins/' . $ext->element . '/';
                $last[] = JPATH_BASE . '/plugins/' . $ext->folder . '/';
                $last[] = JPATH_BASE . '/plugins/' . $ext->option . '/';
                break;
        }

if (count($try)) {
            foreach ($try as $tryThisFile) {
                if (file_exists($tryThisFile)) {
                    return $tryThisFile;
                }
            }
        }

// argh! still no xml file! - ok lets get tough!
        foreach ($last as $tryThisFolder) {

$foldersAndFiles = scandir($tryThisFolder);
            foreach ($foldersAndFiles as $f) {
                if (preg_match('/\.xml/', $f)) {
                    $fileContents = file_get_contents($tryThisFolder . '/' . $f);
                    if (preg_match('/(\<install|\<extension )/', $fileContents)) {
                        return realpath($tryThisFolder . '/' . $f);
                    }
                }
            }
            // look for ANY xml files in this folder

// If you find an xml file - look inside it to see if its a manifest/install
        }

return FALSE;
    }

/**
     * Remove the JPATH_BASE from a file with path to prevent leaking absolute paths
     *
     * @param $path string The full path to a file
     *
     * @return string The absolute path to the file
     */
    private function removeBase($path)
    {
        return str_replace(JPATH_BASE, '', $path);
    }

/**
     * Updates an extension
     *
     * @param $extensionId
     */
    public function doUpdate($extensionId)
    {
        require JPATH_BASE . '/administrator/components/com_installer/models/update.php';

$model = new InstallerModelUpdate();

if ($res = $model->update(array($extensionId))) {
            $cache = JFactory::getCache('mod_menu');
            $cache->clean();
        }

return $model->getState('result');
    }
}