cadline_web/www_archline_hu
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
323e93c51c
www_archline_hu/overrides/components/com_users/controllers/registration.php
LÁZÁR Imre AI Agent 9c8669a76f feat(overrides): add Cadline core modifications (live versions) 
The ~24 legit Cadline customizations on the Joomla core (audit sec.16.1):
reCAPTCHA anti-spam (registration/reset/remind/login flow, captcha rule),
content view tweaks, mod_login template, phpversioncheck. build-baseline.sh
overlays these live versions onto the official-package core so the baseline
matches live for the legit mods, while the 3 trojanized core files stay clean.
NOTE: com_users/controllers/registration.php carries a hardcoded reCAPTCHA
secret (redacted; rotate on cleanup) — see malware-iocs.md.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 11:32:07 +02:00

385 lines
12 KiB
PHP
Raw Blame History

<?php
/**
* @package Joomla.Site
* @subpackage com_users
*
* @copyright Copyright (C) 2005 - 2018 Open Source Matters, Inc. All rights reserved.
* @license GNU General Public License version 2 or later; see LICENSE.txt
*/
defined('_JEXEC') or die;
JLoader::register('UsersController', JPATH_COMPONENT . '/controller.php');
/**
* Registration controller class for Users.
*
* @since 1.6
*/
class UsersControllerRegistration extends UsersController
{
/**
* Method to activate a user.
*
* @return boolean True on success, false on failure.
*
* @since 1.6
*/
public function activate()
{
$user = JFactory::getUser();
$input = JFactory::getApplication()->input;
$uParams = JComponentHelper::getParams('com_users');
// Check for admin activation. Don't allow non-super-admin to delete a super admin
if ($uParams->get('useractivation') != 2 && $user->get('id')) {
$this->setRedirect('index.php');
return true;
}
// If user registration or account activation is disabled, throw a 403.
if ($uParams->get('useractivation') == 0 || $uParams->get('allowUserRegistration') == 0) {
JError::raiseError(403, JText::_('JLIB_APPLICATION_ERROR_ACCESS_FORBIDDEN'));
return false;
}
$model = $this->getModel('Registration', 'UsersModel');
$token = $input->getAlnum('token');
// Check that the token is in a valid format.
if ($token === null || strlen($token) !== 32) {
JError::raiseError(403, JText::_('JINVALID_TOKEN'));
return false;
}
// Attempt to activate the user.
$return = $model->activate($token);
// Check for errors.
if ($return === false) {
// Redirect back to the home page.
$this->setMessage(JText::sprintf('COM_USERS_REGISTRATION_SAVE_FAILED', $model->getError()), 'error');
$this->setRedirect('index.php');
return false;
}
$useractivation = $uParams->get('useractivation');
// Redirect to the login screen.
if ($useractivation == 0) {
$this->setMessage(JText::_('COM_USERS_REGISTRATION_SAVE_SUCCESS'));
$this->setRedirect(JRoute::_('index.php?option=com_users&view=login', false));
} elseif ($useractivation == 1) {
$this->setMessage(JText::_('COM_USERS_REGISTRATION_ACTIVATE_SUCCESS'));
$this->setRedirect(JRoute::_('index.php?option=com_users&view=login', false));
} elseif ($return->getParam('activate')) {
$this->setMessage(JText::_('COM_USERS_REGISTRATION_VERIFY_SUCCESS'));
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration&layout=complete', false));
} else {
$this->setMessage(JText::_('COM_USERS_REGISTRATION_ADMINACTIVATE_SUCCESS'));
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration&layout=complete', false));
}
return true;
}
public function testReg()
{
// Check for request forgeries.
$this->checkToken();
// If registration is disabled - Redirect to login page.
if (JComponentHelper::getParams('com_users')->get('allowUserRegistration') == 0) {
$this->setRedirect(JRoute::_('index.php?option=com_users&view=login', false));
return false;
}
$app = JFactory::getApplication();
$model = $this->getModel('Registration', 'UsersModel');
// Get the user data.
$requestData = $this->input->post->get('jform', array(), 'array');
// Validate the posted data.
$form = $model->getForm();
if (!$form) {
JError::raiseError(500, $model->getError());
return false;
}
$datetime = new \DateTime('');
$date = $datetime->format('c');
$ip = $_SERVER['REMOTE_ADDR'];
$browser = $_SERVER['HTTP_USER_AGENT'];
if (isset($_POST['g-recaptcha-response']) && !empty($_POST['g-recaptcha-response'])) {
$api_url = 'https://www.google.com/recaptcha/api/siteverify';
$resq_data = array(
'secret' => '6Le1o70lAAAAAE125nVz9KQYBX1h2-o5kmlx4tJw',
'response' => $_POST['g-recaptcha-response'],
'remoteip' => $_SERVER['REMOTE_ADDR']
);
$curlConfig = array(
CURLOPT_URL => $api_url,
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POSTFIELDS => $resq_data
);
$ch = curl_init();
curl_setopt_array($ch, $curlConfig);
$response = curl_exec($ch);
curl_close($ch);
$responseData = json_decode($response);
if (!$responseData->success) {
$log = "{$date} capchaID: 'web-registration-v3' verdict: 'FAILURE' IP: '{$ip}' Browser: '{$browser}'" . PHP_EOL;
error_log($log, 3, $_SERVER['DOCUMENT_ROOT'] . '/logs/captchaErrorLog.log');
$app->enqueueMessage('Captcha failed', 'error');
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration', false));
return false;
}
$log = "{$date} capchaID: 'web-registration-v3' verdict: 'SUCCESS' IP: '{$ip}' Browser: '{$browser}'" . PHP_EOL;
error_log($log, 3, $_SERVER['DOCUMENT_ROOT'] . '/logs/captchaErrorLog.log');
} else {
$log = "{$date} capchaID: 'web-registration-v3' verdict: 'FAILURE' IP: '{$ip}' Browser: '{$browser}'" . PHP_EOL;
error_log($log, 3, $_SERVER['DOCUMENT_ROOT'] . '/logs/captchaErrorLog.log');
$error = $_SERVER['HTTP_HOST'] == 'www.archlinexp.com' ? 'Please complete the CAPTCHA.' : 'Kérjük, töltse ki a CAPTCHA-t.';
$app->enqueueMessage($error, 'error');
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration', false));
return false;
}
$data = $model->validate($form, $requestData);
// Check for validation errors.
if ($data === false) {
// Get the validation messages.
$errors = $model->getErrors();
// Push up to three validation messages out to the user.
for ($i = 0, $n = count($errors); $i < $n && $i < 3; $i++) {
if ($errors[$i] instanceof Exception) {
$app->enqueueMessage($errors[$i]->getMessage(), 'error');
} else {
$app->enqueueMessage($errors[$i], 'error');
}
}
// Save the data in the session.
$app->setUserState('com_users.registration.data', $requestData);
// Redirect back to the registration screen.
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration', false));
return false;
}
// Attempt to save the data.
$return = $model->register($data);
// Check for errors.
if ($return === false) {
// Save the data in the session.
$app->setUserState('com_users.registration.data', $data);
// Redirect back to the edit screen.
$this->setMessage($model->getError(), 'error');
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration', false));
return false;
}
// Flush the data from the session.
$app->setUserState('com_users.registration.data', null);
// Redirect to the profile screen.
if ($return === 'adminactivate') {
$this->setMessage(JText::_('COM_USERS_REGISTRATION_COMPLETE_VERIFY'));
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration&layout=complete', false));
} elseif ($return === 'useractivate') {
$this->setMessage(JText::_('COM_USERS_REGISTRATION_COMPLETE_ACTIVATE'));
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration&layout=complete', false));
} else {
$this->setMessage(JText::_('COM_USERS_REGISTRATION_SAVE_SUCCESS'));
$this->setRedirect(JRoute::_('index.php?option=com_users&view=login', false));
}
return true;
}
/**
* Method to register a user.
*
* @return boolean True on success, false on failure.
*
* @since 1.6
*/
public function register()
{
// Check for request forgeries.
$this->checkToken();
// If registration is disabled - Redirect to login page.
if (JComponentHelper::getParams('com_users')->get('allowUserRegistration') == 0) {
$this->setRedirect(JRoute::_('index.php?option=com_users&view=login', false));
return false;
}
$app = JFactory::getApplication();
$model = $this->getModel('Registration', 'UsersModel');
// Get the user data.
$requestData = $this->input->post->get('jform', array(), 'array');
// Validate the posted data.
$form = $model->getForm();
if (!$form) {
JError::raiseError(500, $model->getError());
return false;
}
$datetime = new \DateTime('');
$date = $datetime->format('c');
$ip = $_SERVER['REMOTE_ADDR'];
$browser = $_SERVER['HTTP_USER_AGENT'];
if (isset($_POST['g-recaptcha-response']) && !empty($_POST['g-recaptcha-response'])) {
$api_url = 'https://www.google.com/recaptcha/api/siteverify';
$resq_data = array(
'secret' => '6Le1o70lAAAAAE125nVz9KQYBX1h2-o5kmlx4tJw',
'response' => $_POST['g-recaptcha-response'],
'remoteip' => $_SERVER['REMOTE_ADDR']
);
$curlConfig = array(
CURLOPT_URL => $api_url,
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POSTFIELDS => $resq_data
);
$ch = curl_init();
curl_setopt_array($ch, $curlConfig);
$response = curl_exec($ch);
curl_close($ch);
$responseData = json_decode($response);
if (!$responseData->success) {
$log = "{$date} capchaID: 'web-registration-v3' verdict: 'FAILURE' IP: '{$ip}' Browser: '{$browser}'" . PHP_EOL;
error_log($log, 3, $_SERVER['DOCUMENT_ROOT'] . '/logs/captchaErrorLog.log');
$app->enqueueMessage('Captcha failed', 'error');
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration', false));
return false;
}
$log = "{$date} capchaID: 'web-registration-v3' verdict: 'SUCCESS' IP: '{$ip}' Browser: '{$browser}'" . PHP_EOL;
error_log($log, 3, $_SERVER['DOCUMENT_ROOT'] . '/logs/captchaErrorLog.log');
} else {
$log = "{$date} capchaID: 'web-registration-v3' verdict: 'FAILURE' IP: '{$ip}' Browser: '{$browser}'" . PHP_EOL;
error_log($log, 3, $_SERVER['DOCUMENT_ROOT'] . '/logs/captchaErrorLog.log');
$error = $_SERVER['HTTP_HOST'] == 'www.archlinexp.com' ? 'Please complete the CAPTCHA.' : 'Kérjük, töltse ki a CAPTCHA-t.';
$app->enqueueMessage($error, 'error');
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration', false));
return false;
}
$data = $model->validate($form, $requestData);
// Check for validation errors.
if ($data === false) {
// Get the validation messages.
$errors = $model->getErrors();
// Push up to three validation messages out to the user.
for ($i = 0, $n = count($errors); $i < $n && $i < 3; $i++) {
if ($errors[$i] instanceof Exception) {
$app->enqueueMessage($errors[$i]->getMessage(), 'error');
} else {
$app->enqueueMessage($errors[$i], 'error');
}
}
// Save the data in the session.
$app->setUserState('com_users.registration.data', $requestData);
// Redirect back to the registration screen.
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration', false));
return false;
}
// Attempt to save the data.
$return = $model->register($data);
// Check for errors.
if ($return === false) {
// Save the data in the session.
$app->setUserState('com_users.registration.data', $data);
// Redirect back to the edit screen.
$this->setMessage($model->getError(), 'error');
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration', false));
return false;
}
// Flush the data from the session.
$app->setUserState('com_users.registration.data', null);
// Redirect to the profile screen.
if ($return === 'adminactivate') {
$this->setMessage(JText::_('COM_USERS_REGISTRATION_COMPLETE_VERIFY'));
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration&layout=complete', false));
} elseif ($return === 'useractivate') {
$this->setMessage(JText::_('COM_USERS_REGISTRATION_COMPLETE_ACTIVATE'));
$this->setRedirect(JRoute::_('index.php?option=com_users&view=registration&layout=complete', false));
} else {
$this->setMessage(JText::_('COM_USERS_REGISTRATION_SAVE_SUCCESS'));
$this->setRedirect(JRoute::_('index.php?option=com_users&view=login', false));
}
return true;
}
public function registerWithARCHLine()
{
$response = array();
$model = $this->getModel('Registration', 'UsersModel');
$message = '';
$return = $model->registerWithARCHLine($_POST, $message);
if ($return === false) $response['error'] = true;
$response['msg'] = $message;
echo json_encode($response);
die();
}
}
Reference in New Issue View Git Blame Copy Permalink