<?php
/*
 * @package 	RSFirewall!
 * @copyright 	(c) 2009 - 2024 RSJoomla!
 * @link 		https://www.rsjoomla.com/joomla-extensions/joomla-security.html
 * @license 	GNU General Public License https://www.gnu.org/licenses/gpl-3.0.en.html
 */

defined('_JEXEC') or die;

class RSFirewallProtectionSourcerer extends RSFirewallProtection
{
	protected $reason = 'COM_RSFIREWALL_PHP_CODE_DETECTED';
	protected $code = 'SOURCERER_INJECTION_ATTEMPT';

	public function isInjection()
	{
		if (!empty($_GET))
		{
			$string = strtolower(urldecode(http_build_query($_GET)));
			if (strpos($string, '{source}') !== false || strpos($string, '[[?php') !== false)
			{
				return true;
			}
		}

		if (!empty($_POST))
		{
			$string = strtolower(urldecode(http_build_query($_POST)));
			$option = $this->getOption();
			if (($option === 'com_finder' || $option === 'com_search') && (strpos($string, '{source}') !== false || strpos($string, '[[?php') !== false))
			{
				return true;
			}
		}

		return false;
	}
}