<?php
/*
 * @package 	RSFirewall!
 * @copyright 	(c) 2009 - 2024 RSJoomla!
 * @link 		https://www.rsjoomla.com/joomla-extensions/joomla-security.html
 * @license 	GNU General Public License https://www.gnu.org/licenses/gpl-3.0.en.html
 */

defined('_JEXEC') or die;

use Joomla\CMS\Factory;
use Joomla\CMS\Component\ComponentHelper;

class RSFirewallProtectionIcagenda extends RSFirewallProtection
{
	protected $reason = 'COM_RSFIREWALL_PHP_CODE_DETECTED';
	protected $code = 'SPPB_INJECTION_ATTEMPT';

	public function isInjection()
	{
		if ($this->getOption() === 'com_icagenda' && isset($_REQUEST['task']) && strtolower($_REQUEST['task']) === 'submit.submit')
		{
			$app    = Factory::getApplication();
			$user   = Factory::getUser();
			$menuID = $app->input->getInt('itemID', 0);
			$menu   = $app->getMenu()->getItem($menuID);

			// Check Access Levels to the form
			$userLevels   = $user->getAuthorisedViewLevels();
			$user_id      = $user->get('id');
			$submitAccess = ComponentHelper::getComponent('com_icagenda')->getParams()->get('submitAccess', array('2'));
			$isInjection  = false;

			if (!$user_id && ! \in_array('1', $submitAccess ))
			{
				$isInjection = true;
			}
			else if (!array_intersect($userLevels, $submitAccess))
			{
				$isInjection = true;
			}

			if (!$menuID)
			{
				$isInjection = true;
			}
			else if (!$menu)
			{
				$isInjection = true;
			}
			else if ($menu->link !== 'index.php?option=com_icagenda&view=submit')
			{
				$isInjection = true;
			}

			if ($isInjection)
			{
				if (isset($_FILES))
				{
					unset($_FILES);
				}
				return true;
			}
		}

		return false;
	}
}