<?php
/*
 * @package 	RSFirewall!
 * @copyright 	(c) 2009 - 2024 RSJoomla!
 * @link 		https://www.rsjoomla.com/joomla-extensions/joomla-security.html
 * @license 	GNU General Public License https://www.gnu.org/licenses/gpl-3.0.en.html
 */

defined('_JEXEC') or die;

use Joomla\CMS\Factory;
use Joomla\CMS\Language\Text;

class RSFirewallProtectionSession extends RSFirewallProtection
{
	protected $reason = 'COM_RSFIREWALL_MALWARE_DETECTED';
	protected $code = 'SESSION_INJECTION_ATTEMPT';
	protected $level = 'medium';

	public function isInjection()
	{
		$input = Factory::getApplication()->input;
		$isInjection = false;
		if ($value = $input->server->get('HTTP_X_FORWARDED_FOR', '', 'raw'))
		{
			if (filter_var($value, FILTER_VALIDATE_IP) === false && strpos($value, '{') !== false && strpos($value, '}') !== false)
			{
				$this->code = 'SESSION_INJECTION_ATTEMPT';
				$this->extra = $value;
				$isInjection = true;
			}
		}

		$agent 	 = $input->server->get('HTTP_USER_AGENT', '', 'raw');
		$pattern = '#JSimplepieFactory|JDatabaseDriver|disconnectHandlers|JFactory|assert|sanitize|feed\_url|preg\_|cache\_name\_function#i';
		if (preg_match($pattern, $agent, $match))
		{
			$this->code = 'DANGEROUS_USER_AGENT';
			$this->extra = Text::sprintf('COM_RSFIREWALL_USER_AGENT', $agent);
			$isInjection = true;
		}

		if ($isInjection)
		{
			// Stop session hijacking
			$session = Factory::getSession();

			// Just to be on the safe side in case destroying doesn't work.
			$session->set('session.client.forwarded', null);
			$session->set('session.client.browser', null);

			// Destroy it
			$session->destroy();
		}

		return $isInjection;
	}
}