<?php
/*
 * @package 	RSFirewall!
 * @copyright 	(c) 2009 - 2024 RSJoomla!
 * @link 		https://www.rsjoomla.com/joomla-extensions/joomla-security.html
 * @license 	GNU General Public License https://www.gnu.org/licenses/gpl-3.0.en.html
 */

defined('_JEXEC') or die;

use Joomla\CMS\Factory;
use Joomla\CMS\Session\Session;

class RSFirewallProtectionSppb extends RSFirewallProtection
{
	protected $reason = 'COM_RSFIREWALL_PHP_CODE_DETECTED';
	protected $code = 'SPPB_INJECTION_ATTEMPT';

	public function isInjection()
	{
		if ($this->getOption() === 'com_sppagebuilder' && isset($_REQUEST['task']) && in_array(strtolower($_REQUEST['task']), array('asset.uploadcustomicon', 'asset.deletecustomicon', 'asset.changecustomiconstatus')))
		{
			$user = Factory::getUser();
			$authorised = $user->authorise('core.admin', 'com_sppagebuilder') || $user->authorise('core.manage', 'com_sppagebuilder');

			if (!$authorised || !$user->id || !Session::checkToken())
			{
				if (isset($_FILES))
				{
					unset($_FILES);
				}
				return true;
			}
		}

		return false;
	}
}