<?php
/*
 * @package 	RSFirewall!
 * @copyright 	(c) 2009 - 2024 RSJoomla!
 * @link 		https://www.rsjoomla.com/joomla-extensions/joomla-security.html
 * @license 	GNU General Public License https://www.gnu.org/licenses/gpl-3.0.en.html
 */

defined('_JEXEC') or die;

use Joomla\CMS\Factory;

class RSFirewallProtectionPagebuilderck extends RSFirewallProtection
{
	protected $reason = 'COM_RSFIREWALL_PHP_CODE_DETECTED';
	protected $code = 'PAGEBUILDERCK_INJECTION_ATTEMPT';

	public function isInjection()
	{
		$app = Factory::getApplication();
		if ($app->isClient('site') && $this->getOption() === 'com_pagebuilderck' && isset($_REQUEST['task']))
		{
			$task = strtolower($_REQUEST['task']);
			$user = Factory::getUser();

			if ($task === 'browse.ajaxcreatefolder')
			{
				if ($user->guest || !$user->authorise('core.edit', 'com_pagebuilderck') || !$user->authorise('core.create', 'com_media'))
				{
					$this->extra = 'task=' . $task;
					return true;
				}
			}
			elseif (in_array($task, array(
				'browse.ajaxaddpicture', 'browse.getfiles',
				'articles.import', 'articles.export',
				'categories.save', 'categories.apply',
				'contenttype.save', 'contenttype.apply', 'contenttype.ajaxloadfields', 'contenttype.ajaxaddfield', 'contenttype.ajaxgetfieldposition',
				'contenttypes.import', 'contenttypes.export', 'contenttypes.order',
				'element.apply', 'element.save', 'element.copy', 'element.delete',
				'elements.import', 'elements.export', 'elements.order',
				'fonts.save', 'fonts.delete', 'fonts.apply',
				'interface.load',
				'library.load', 'library.loadpreset',
				'links.ajaxshowarticles',
				'modules2.import', 'modules2.export',
				'page.save', 'page.apply', 'page.copy',
				'pages.import', 'pages.export', 'pages.checkin',
				'pixabay.upload',
				'style.save', 'style.apply', 'style.copy', 'style.cancel',
				'styles.import', 'styles.export', 'styles.checkin', 'styles.load')))
			{
				if ($user->guest || !$user->authorise('core.edit', 'com_pagebuilderck'))
				{
					if (isset($_FILES))
					{
						unset($_FILES);
					}
					$this->extra = 'task=' . $_REQUEST['task'];
					return true;
				}
			}
		}

		return false;
	}
}