LÁZÁR Imre AI Agent
bd30fd6bd8
The ~24 legit Cadline customizations on the Joomla core (audit sec.16.1): reCAPTCHA anti-spam (registration/reset/remind/login flow, captcha rule), content view tweaks, mod_login template, phpversioncheck. build-baseline.sh overlays these live versions onto the official-package core so the baseline matches live for the legit mods, while the 3 trojanized core files stay clean. NOTE: com_users/controllers/registration.php carries a hardcoded reCAPTCHA secret (redacted; rotate on cleanup) — see malware-iocs.md. Signed-off-by: LÁZÁR Imre <imre@illusion.hu> Assisted-by: claude-code@claude-opus-4-8
91 lines
2.4 KiB
PHP
91 lines
2.4 KiB
PHP
<?php
|
|
|
|
/**
|
|
* @package Joomla.Site
|
|
* @subpackage com_users
|
|
*
|
|
* @copyright Copyright (C) 2005 - 2018 Open Source Matters, Inc. All rights reserved.
|
|
* @license GNU General Public License version 2 or later; see LICENSE.txt
|
|
*/
|
|
|
|
defined('_JEXEC') or die;
|
|
|
|
JLoader::register('UsersController', JPATH_COMPONENT . '/controller.php');
|
|
|
|
/**
|
|
* Reset controller class for Users.
|
|
*
|
|
* @since 1.6
|
|
*/
|
|
class UsersControllerRemind extends UsersController
|
|
{
|
|
/**
|
|
* Method to request a username reminder.
|
|
*
|
|
* @return boolean
|
|
*
|
|
* @since 1.6
|
|
*/
|
|
public function remind()
|
|
{
|
|
// Check the request token.
|
|
$this->checkToken('post');
|
|
|
|
$model = $this->getModel('Remind', 'UsersModel');
|
|
$data = $this->input->post->get('jform', array(), 'array');
|
|
|
|
$captchaError = 'Captcha failed';
|
|
|
|
if (isset($_POST['g-recaptcha-response']) && !empty($_POST['g-recaptcha-response'])) {
|
|
$api_url = 'https://www.google.com/recaptcha/api/siteverify';
|
|
$resq_data = array(
|
|
'secret' => '6Le1o70lAAAAAE125nVz9KQYBX1h2-o5kmlx4tJw',
|
|
'response' => $_POST['g-recaptcha-response'],
|
|
'remoteip' => $_SERVER['REMOTE_ADDR']
|
|
);
|
|
|
|
$curlConfig = array(
|
|
CURLOPT_URL => $api_url,
|
|
CURLOPT_POST => true,
|
|
CURLOPT_RETURNTRANSFER => true,
|
|
CURLOPT_POSTFIELDS => $resq_data
|
|
);
|
|
|
|
$ch = curl_init();
|
|
curl_setopt_array($ch, $curlConfig);
|
|
$response = curl_exec($ch);
|
|
curl_close($ch);
|
|
|
|
$responseData = json_decode($response);
|
|
|
|
if (!$responseData->success) {
|
|
$this->setRedirect(JRoute::_('index.php?option=com_users&view=remind', false), $captchaError, 'error');
|
|
return false;
|
|
}
|
|
} else {
|
|
$this->setRedirect(JRoute::_('index.php?option=com_users&view=remind', false), $captchaError, 'error');
|
|
return false;
|
|
}
|
|
|
|
// Submit the password reset request.
|
|
$return = $model->processRemindRequest($data);
|
|
|
|
// Check for a hard error.
|
|
if ($return == false) {
|
|
// The request failed.
|
|
// Go back to the request form.
|
|
$message = JText::sprintf('COM_USERS_REMIND_REQUEST_FAILED', $model->getError());
|
|
$this->setRedirect(JRoute::_('index.php?option=com_users&view=remind', false), $message, 'notice');
|
|
|
|
return false;
|
|
} else {
|
|
// The request succeeded.
|
|
// Proceed to step two.
|
|
$message = JText::_('COM_USERS_REMIND_REQUEST_SUCCESS');
|
|
$this->setRedirect(JRoute::_('index.php?option=com_users&view=login', false), $message);
|
|
|
|
return true;
|
|
}
|
|
}
|
|
}
|