diff --git a/source/packages/com_mokosuiteclient/admin/src/Controller/DisplayController.php b/source/packages/com_mokosuiteclient/admin/src/Controller/DisplayController.php index a5d16acf..5aeb97f0 100644 --- a/source/packages/com_mokosuiteclient/admin/src/Controller/DisplayController.php +++ b/source/packages/com_mokosuiteclient/admin/src/Controller/DisplayController.php @@ -204,7 +204,7 @@ class DisplayController extends BaseController CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT => 15, CURLOPT_FOLLOWLOCATION => true, - CURLOPT_SSL_VERIFYPEER => false, + CURLOPT_SSL_VERIFYPEER => true, ]); $response = curl_exec($ch); diff --git a/source/packages/com_mokosuiteclient/admin/src/Model/DashboardModel.php b/source/packages/com_mokosuiteclient/admin/src/Model/DashboardModel.php index 59647ecc..48c28a7d 100644 --- a/source/packages/com_mokosuiteclient/admin/src/Model/DashboardModel.php +++ b/source/packages/com_mokosuiteclient/admin/src/Model/DashboardModel.php @@ -277,7 +277,9 @@ class DashboardModel extends BaseDatabaseModel ->select([$db->quoteName('element'), $db->quoteName('protected')]) ->from($db->quoteName('#__extensions')) ->where($db->quoteName('extension_id') . ' = ' . $extensionId) - ->where($db->quoteName('type') . ' = ' . $db->quote('plugin')); + ->where($db->quoteName('type') . ' = ' . $db->quote('plugin')) + ->where('(' . $db->quoteName('element') . ' = ' . $db->quote('mokosuiteclient') + . ' OR ' . $db->quoteName('element') . ' LIKE ' . $db->quote('mokosuiteclient\\_%') . ')'); $db->setQuery($query); $ext = $db->loadObject(); @@ -568,7 +570,7 @@ class DashboardModel extends BaseDatabaseModel $db->setQuery( "SELECT DATE(" . $db->quoteName('created') . ") AS day, COUNT(*) AS total" . " FROM " . $db->quoteName('#__mokosuiteclient_waf_log') - . " WHERE " . $db->quoteName('created') . " >= DATE_SUB(NOW(), INTERVAL $days DAY)" + . " WHERE " . $db->quoteName('created') . " >= DATE_SUB(NOW(), INTERVAL " . (int) $days . " DAY)" . " GROUP BY day ORDER BY day" ); $rows = $db->loadObjectList() ?: []; @@ -609,7 +611,7 @@ class DashboardModel extends BaseDatabaseModel "SELECT DATE(" . $db->quoteName('log_date') . ") AS day, COUNT(*) AS total" . " FROM " . $db->quoteName('#__action_logs') . " WHERE " . $db->quoteName('message_language_key') . " = 'PLG_ACTIONLOG_JOOMLA_USER_LOGGED_IN'" - . " AND " . $db->quoteName('log_date') . " >= DATE_SUB(NOW(), INTERVAL $days DAY)" + . " AND " . $db->quoteName('log_date') . " >= DATE_SUB(NOW(), INTERVAL " . (int) $days . " DAY)" . " GROUP BY day ORDER BY day" ); $rows = $db->loadObjectList() ?: []; diff --git a/source/packages/plg_system_mokosuiteclient_devtools/src/Extension/DevTools.php b/source/packages/plg_system_mokosuiteclient_devtools/src/Extension/DevTools.php index d92bfe78..46f00076 100644 --- a/source/packages/plg_system_mokosuiteclient_devtools/src/Extension/DevTools.php +++ b/source/packages/plg_system_mokosuiteclient_devtools/src/Extension/DevTools.php @@ -58,21 +58,8 @@ class DevTools extends CMSPlugin implements SubscriberInterface $config->set('offline', 1); } - // Suppress hit recording - try - { - $db = Factory::getDbo(); - $db->setQuery( - $db->getQuery(true) - ->update($db->quoteName('#__content')) - ->set($db->quoteName('hits') . ' = 0') - ->where($db->quoteName('hits') . ' > 0') - )->execute(); - } - catch (\Throwable $e) - { - // Silent - } + // Suppress hit recording by disabling the content hit counter + $config->set('record_hits', 0); } /** diff --git a/source/packages/plg_system_mokosuiteclient_firewall/src/Field/CurrentIpField.php b/source/packages/plg_system_mokosuiteclient_firewall/src/Field/CurrentIpField.php index 8c6870f6..956e2202 100644 --- a/source/packages/plg_system_mokosuiteclient_firewall/src/Field/CurrentIpField.php +++ b/source/packages/plg_system_mokosuiteclient_firewall/src/Field/CurrentIpField.php @@ -20,23 +20,29 @@ class CurrentIpField extends FormField protected function getInput(): string { - $ip = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? ''; + $ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0'; + $forwarded = ''; - if (!empty($ip)) + if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) { - $ip = trim(explode(',', $ip)[0]); + $candidate = trim(explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])[0]); + if (filter_var($candidate, FILTER_VALIDATE_IP)) + { + $forwarded = $candidate; + } } - if (empty($ip)) - { - $ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0'; - } - - return '
'
. htmlspecialchars($ip)
. ''
- . ''
- . '' . htmlspecialchars($forwarded) . '';
+ }
+
+ return $html . '