www_archline_hu/overrides/plugins/quickicon/phpversioncheck/phpversioncheck.php
imre.agent 61d176fb5e feat(archlinexp.eu): add clean deployable baseline on Joomla 3.9.2
Build the archlinexp.eu/www baseline from clean sources on a dedicated
site branch, per the web-baseline deploy model: vanilla Joomla 3.9.2 core
plus the developer-sourced own-code plus a vetted module layer, with the
Cadline core delta applied on the 3.9.2 base. The generator is reused
unchanged: build-baseline.sh is site-agnostic, only the content differs.

Layers:
- core/      vanilla Joomla 3.9.2 official package (installer removed)
- cadline/   own-code from the developer source (beiratkozas, maintenance,
             mod_al_*, mod_alusers, mod_course_list) plus 11 assets that
             the developer source lacks
- deployed/  third-party module slugs taken from live, vetted
- overrides/ the 5 genuine Cadline core modifications, on the 3.9.2 base

The live core carried 31 stale com_users files: the updater skipped the
customized ones, so the version string said 3.9.2 while the code did not.
Taking vanilla 3.9.2 plus the 2 real deltas fixes that silently.

Vetting caught two items that content-based YARA did not flag. Both come
from a structural rule: an extra file on a core-component path that is
not a template override is not a module -- it is a leftover or a plant.
Both are excluded through malware-iocs.paths:
- components/com_mailto/mail.php: an unauthenticated file-write webshell
  (POST save_file + file_content -> fopen/fwrite, no auth check at all),
  present on live since 2021-07-26
- administrator/components/com_joomlaupdate/restoration.php: an Akeeba
  Kickstart leftover carrying a security password (known RCE vector)

Verification: build-baseline.sh -> out/ = 12284 files; YARA (16 rules) on
every source layer and on the built tree = 0 hits; none of the 291 IOC
paths present; no disguised .json dropper; core verified as 3.9.2; the
only extra file left on a core path is the legit Google reCAPTCHA library.

Assisted-by: claude-code@claude-opus-4-8
2026-07-17 12:18:26 +02:00

244 lines
5.5 KiB
PHP

<?php
/**
* @package Joomla.Plugin
* @subpackage Quickicon.phpversioncheck
*
* @copyright Copyright (C) 2005 - 2019 Open Source Matters, Inc. All rights reserved.
* @license GNU General Public License version 2 or later; see LICENSE.txt
*/
defined('_JEXEC') or die;
/**
* Plugin to check the PHP version and display a warning about its support status
*
* @since 3.7.0
*/
class PlgQuickiconPhpVersionCheck extends JPlugin
{
/**
* Constant representing the active PHP version being fully supported
*
* @var integer
* @since 3.7.0
*/
const PHP_SUPPORTED = 0;
/**
* Constant representing the active PHP version receiving security support only
*
* @var integer
* @since 3.7.0
*/
const PHP_SECURITY_ONLY = 1;
/**
* Constant representing the active PHP version being unsupported
*
* @var integer
* @since 3.7.0
*/
const PHP_UNSUPPORTED = 2;
/**
* Application object.
*
* @var JApplicationCms
* @since 3.7.0
*/
protected $app;
/**
* Load plugin language files automatically
*
* @var boolean
* @since 3.7.0
*/
protected $autoloadLanguage = true;
/**
* Check the PHP version after the admin component has been dispatched.
*
* @param string $context The calling context
*
* @return void
*
* @since 3.7.0
*/
public function onGetIcons($context)
{
if (!$this->shouldDisplayMessage())
{
return;
}
$supportStatus = $this->getPhpSupport();
if ($supportStatus['status'] !== self::PHP_SUPPORTED)
{
// Enqueue the notification message; set a warning if receiving security support or "error" if unsupported
switch ($supportStatus['status'])
{
case self::PHP_SECURITY_ONLY:
$this->app->enqueueMessage($supportStatus['message'], 'warning');
break;
case self::PHP_UNSUPPORTED:
$this->app->enqueueMessage($supportStatus['message'], 'error');
break;
}
}
}
/**
* Gets PHP support status.
*
* @return array Array of PHP support data
*
* @since 3.7.0
* @note The dates used in this method should correspond to the dates given on PHP.net
* @link https://secure.php.net/supported-versions.php
* @link https://secure.php.net/eol.php
*/
private function getPhpSupport()
{
$phpSupportData = array(
'5.3' => array(
'security' => '2013-07-11',
'eos' => '2014-08-14',
),
'5.4' => array(
'security' => '2014-09-14',
'eos' => '2015-09-14',
),
'5.5' => array(
'security' => '2015-07-10',
'eos' => '2016-07-21',
),
'5.6' => array(
'security' => '2017-01-19',
'eos' => '2018-12-31',
),
'7.0' => array(
'security' => '2017-12-03',
'eos' => '2018-12-03',
),
'7.1' => array(
'security' => '2018-12-01',
'eos' => '2019-12-01',
),
'7.2' => array(
'security' => '2019-11-30',
'eos' => '2020-11-30',
),
'7.3' => array(
'security' => '2020-12-06',
'eos' => '2021-12-06',
),
);
// Fill our return array with default values
$supportStatus = array(
'status' => self::PHP_SUPPORTED,
'message' => null,
);
// Check the PHP version's support status using the minor version
$activePhpVersion = PHP_MAJOR_VERSION . '.' . PHP_MINOR_VERSION;
// Do we have the PHP version's data?
if (isset($phpSupportData[$activePhpVersion]))
{
// First check if the version has reached end of support
$today = new JDate;
$phpEndOfSupport = new JDate($phpSupportData[$activePhpVersion]['eos']);
if ($phpNotSupported = $today > $phpEndOfSupport)
{
/*
* Find the oldest PHP version still supported that is newer than the current version,
* this is our recommendation for users on unsupported platforms
*/
foreach ($phpSupportData as $version => $versionData)
{
$versionEndOfSupport = new JDate($versionData['eos']);
if (version_compare($version, $activePhpVersion, 'ge') && ($today < $versionEndOfSupport))
{
$recommendedVersion = $version;
$recommendedVersionEndOfSupport = $versionEndOfSupport;
break;
}
}
$supportStatus['status'] = self::PHP_UNSUPPORTED;
/*$supportStatus['message'] = JText::sprintf(
'PLG_QUICKICON_PHPVERSIONCHECK_UNSUPPORTED',
PHP_VERSION,
$recommendedVersion,
$recommendedVersionEndOfSupport->format(JText::_('DATE_FORMAT_LC4'))
);*/
}
// If the version is still supported, check if it has reached eol minus 3 month
$securityWarningDate = clone $phpEndOfSupport;
$securityWarningDate->sub(new DateInterval('P3M'));
if (!$phpNotSupported && $today > $securityWarningDate)
{
$supportStatus['status'] = self::PHP_SECURITY_ONLY;
$supportStatus['message'] = JText::sprintf(
'PLG_QUICKICON_PHPVERSIONCHECK_SECURITY_ONLY', PHP_VERSION, $phpEndOfSupport->format(JText::_('DATE_FORMAT_LC4'))
);
}
}
return $supportStatus;
}
/**
* Determines if the message should be displayed
*
* @return boolean
*
* @since 3.7.0
*/
private function shouldDisplayMessage()
{
// Only on admin app
if (!$this->app->isClient('administrator'))
{
return false;
}
// Only if authenticated
if (JFactory::getUser()->guest)
{
return false;
}
// Only on HTML documents
if ($this->app->getDocument()->getType() !== 'html')
{
return false;
}
// Only on full page requests
if ($this->app->input->getCmd('tmpl', 'index') === 'component')
{
return false;
}
// Only to com_cpanel
if ($this->app->input->get('option') !== 'com_cpanel')
{
return false;
}
return true;
}
}