2.4.0

Use IpHelper to determine ip address sql : use prepared statements
conseilgouz · Aug 4, 2023 · 91b0dd7 · 91b0dd7
1 parent 986b8c5
commit 91b0dd7
Show file tree

Hide file tree

Showing 13 changed files with 45 additions and 34 deletions.
diff --git a/cgsecureinstaller.xml b/cgsecureinstaller.xml
@@ -2,12 +2,12 @@
 <extension version="4.0" type="plugin" group="system" method="upgrade">
 	<name>plgcgsecureinstaller</name>
 	<author>ConseilGouz</author>
-	<creationDate>2023-07-24</creationDate>
+	<creationDate>2023-08-04</creationDate>
 	<copyright>(C)2023 ConseilGouz. All rights reserved.</copyright>
 	<license>GNU General Public License version 2 or later; see LICENSE.txt</license>
 	<authorEmail>pascal.leconte@conseilgouz.com</authorEmail>
 	<authorUrl>www.conseilgouz.com</authorUrl>
-	<version>2.3.5</version>
+	<version>2.4.0</version>
 	<license>GNU General Public License version 2 or later; see LICENSE.txt</license>
 	<description>CG Secure</description>
 	<scriptfile>script.install.php</scriptfile>

diff --git a/com_cgsecure_changelog.xml b/com_cgsecure_changelog.xml
@@ -1,4 +1,17 @@
 <changelogs>
+	<changelog>
+		<element>com_cgsecure</element>
+		<type>package</type>
+		<version>2.4.0</version>
+        <note>
+            <item>Update : 04/08/2023</item>
+        </note>
+		<change>
+			<item>Use IpHelper to determine ip address</item>
+			<item>sql : use prepared statements</item>
+		</change>
+	</changelog>
+
 	<changelog>
 		<element>com_cgsecure</element>
 		<type>package</type>

diff --git a/packages/com_cgsecure/admin/cgsecure.xml b/packages/com_cgsecure/admin/cgsecure.xml
@@ -1,13 +1,13 @@
 <?xml version="1.0" encoding="utf-8"?>
 <extension type="component" version="4.0" method="upgrade">
 	<name>COM_CGSECURE</name>
-	<creationDate>2023-03-28</creationDate>
+	<creationDate>2023-08-04</creationDate>
 	<author>ConseilGouz</author>
 	<authorEmail>pascal.leconte@conseilgouz.com</authorEmail>
 	<authorUrl>www.conseilgouz.com</authorUrl>
 	<copyright>Copyright (C) 2023 ConseilGouz.com. All Rights Reserved</copyright>
 	<license>GNU/GPL Version 2 or later - http://www.gnu.org/licenses/gpl-2.0.html</license>
-	<version>2.2.8</version>
+	<version>2.4.0</version>
 	<namespace path="src">ConseilGouz\Component\CGSecure</namespace>
 	<description>COM_CGSECURE_XML_DESCRIPTION</description>
     <install>

diff --git a/packages/com_cgsecure/admin/src/Field/VersionField.php b/packages/com_cgsecure/admin/src/Field/VersionField.php
@@ -41,7 +41,8 @@ function getInput()
 		$query
 			->select($db->quoteName('manifest_cache'))
 			->from($db->quoteName('#__extensions'))
-			->where($db->quoteName('element') . '=' . $db->Quote($extension));
+			->where($db->quoteName('element') . '= :ext')
+			->bind(':ext',$extension,\Joomla\Database\ParameterType::STRING);
 		$db->setQuery($query, 0, 1);
 		$row = $db->loadAssoc();
 		$tmp = json_decode($row['manifest_cache']);

diff --git a/packages/com_cgsecure/admin/src/Table/ConfigTable.php b/packages/com_cgsecure/admin/src/Table/ConfigTable.php
@@ -60,7 +60,8 @@ public function store($key = 'config')
             $db->getQuery(true)
                 ->select('COUNT(*)')
                 ->from($db->quoteName($this->_tbl))
-                ->where($db->quoteName('name') . ' = ' . $db->quote($key))
+                ->where($db->quoteName('name') . ' = :key')
+				->bind(':key',$key,\Joomla\Database\ParameterType::STRING)
         )->loadResult();
 
         $exists = $result > 0 ? true : false;
@@ -102,7 +103,8 @@ public function getSecureParams() {
 	        $db->getQuery(true)
 	        ->select('*')
 	        ->from($db->quoteName($this->_tbl))
-	        ->where($db->quoteName('name') . ' = ' . $db->quote($key))
+	        ->where($db->quoteName('name') . ' = :key')
+			->bind(':key',$key,\Joomla\Database\ParameterType::STRING)
 	        )->loadObject();
 
 	    $this->resaparams = $result;

diff --git a/packages/com_cgsecure/cgsecure.xml b/packages/com_cgsecure/cgsecure.xml
@@ -1,13 +1,13 @@
 <?xml version="1.0" encoding="utf-8"?>
 <extension type="component" version="4.0" method="upgrade">
 	<name>COM_CGSECURE</name>
-	<creationDate>2023-07-24</creationDate>
+	<creationDate>2023-08-04</creationDate>
 	<author>ConseilGouz</author>
 	<authorEmail>pascal.leconte@conseilgouz.com</authorEmail>
 	<authorUrl>www.conseilgouz.com</authorUrl>
 	<copyright>Copyright (C) 2023 ConseilGouz.com. All Rights Reserved</copyright>
 	<license>GNU/GPL Version 2 or later - http://www.gnu.org/licenses/gpl-2.0.html</license>
-	<version>2.3.5</version>
+	<version>2.4.0</version>
 	<namespace path="src">ConseilGouz\Component\CGSecure</namespace>
 	<description>COM_CGSECURE_XML_DESCRIPTION</description>
     <install>

diff --git a/packages/library_cgsecure/cgsecure.xml b/packages/library_cgsecure/cgsecure.xml
@@ -3,8 +3,8 @@
 	<name>CGSecure Library</name>
 	<libraryname>cgsecure</libraryname>
 	<author>ConseilGouz</author>
-	<version>2.3.5</version>
-	<creationDate>2023-07-24</creationDate>
+	<version>2.4.0</version>
+	<creationDate>2023-08-04</creationDate>
 	<copyright>(C)2023 ConseilGouz. All rights reserved.</copyright>
 	<license>GNU General Public License version 2 or later; see LICENSE.txt</license>
 	<authorEmail>pascal.leconte@conseilgouz.com</authorEmail>

diff --git a/packages/library_cgsecure/ipcheck.php b/packages/library_cgsecure/ipcheck.php
@@ -1,7 +1,7 @@
 <?php
 /**
  * @component      CG Secure
- * Version		   2.2.6
+ * Version		   2.4.0
  * @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL
  * @copyright (c) 2023 ConseilGouz. All Rights Reserved.
  * @author ConseilGouz 
@@ -90,8 +90,8 @@ public static function check_ip($plugin, $context) {
 		self::$errtype = $plugin->errtype;
 		self::$context = $context;
         self::$latest_rejected = self::get_rejected();
-		// $ip = IpHelper::getIp(); 
-		$ip = $_SERVER['REMOTE_ADDR'];
+		$ip = IpHelper::getIp(); 
+		// $ip = $_SERVER['REMOTE_ADDR'];
  // $ip = '218.92.1.534'; // test hackeur chinois 
  // $ip = '54.36.148.179'; // in abuseip whitelist
 		if (self::whiteList($ip)) return true; 
@@ -181,7 +181,8 @@ public static function check_spammer($plugin, $context) {
 		self::$caller = $plugin->myname;
 		self::$message = $plugin->mymessage;
 		self::$context = $context;
-		$ip = $_SERVER['REMOTE_ADDR'];
+		$ip = IpHelper::getIp(); 
+		// $ip = $_SERVER['REMOTE_ADDR'];
         if (self::$context  != 'SystemCGSecure') { // no test when system, otherwise, you'll loose your admin....
  // $ip = '222.186.42.7'; // test hackeur chinois 
 		}
@@ -215,7 +216,7 @@ public static function check_spammer($plugin, $context) {
 	}
 	// Check IP in whitelist or local
     public static function whiteList($ip = NULL) {
-		if (!$ip) $ip = $_SERVER['REMOTE_ADDR'];
+		if (!$ip) $ip = IpHelper::getIp();  // $ip = $_SERVER['REMOTE_ADDR'];
 		$whitelist = self::$params->whitelist;
 		$arr_whitelist = explode(',',$whitelist);
 		if ( in_array($ip, $arr_whitelist) || ($ip == '::1') || ($ip == '127.0.0.1')) { // dans liste ou local
@@ -286,7 +287,8 @@ private static function check_hacker($errtype,$ip) {
 		$query = $db->getQuery(true);
         $query->select($db->quoteName('errtype'))
 	            ->from($db->quoteName('#__cg_rejected_ip'))
-	            ->where($db->quoteName('ip').'="'.$ip.'"');
+	            ->where($db->quoteName('ip').'= :ip')
+				->bind(':ip',$ip,\Joomla\Database\ParameterType::STRING);
         $db->setQuery($query);
         try {
 	        $type = $db->loadResult();
@@ -312,11 +314,6 @@ private static function redir_out() {
 	        $mainframe->redirect(self::$params->redir_ext);
 	    }
 	}
-	// from https://stackoverflow.com/questions/3003145/how-to-get-the-client-ip-address-in-php
-	private static function get_ip() {
-	    if (($_SERVER['REMOTE_ADDR'] == '::1') ||  ($_SERVER['REMOTE_ADDR'] == '127.0.0.1')) return '::1';
-		return $_SERVER['HTTP_CLIENT_IP'] ?? $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR'];
-	}
 // curl request function
 	private static function abuseIPDBrequest($path, $method, $data) {
 		$key = self::$params->api_key;

diff --git a/packages/plg_authentication_cgsecure/cgsecure.xml b/packages/plg_authentication_cgsecure/cgsecure.xml
@@ -2,12 +2,12 @@
 <extension version="4.0" type="plugin" group="authentication" method="upgrade">
 	<name>PLG_AUTH_COUNTRY</name>
 	<author>ConseilGouz</author>
-	<creationDate>2023/07/24</creationDate>
+	<creationDate>2023/08/04</creationDate>
 	<copyright>(C)2023 ConseilGouz. All rights reserved.</copyright>
 	<license>GNU General Public License version 2 or later; see LICENSE.txt</license>
 	<authorEmail>pascal.leconte@conseilgouz.com</authorEmail>
 	<authorUrl>www.conseilgouz.com</authorUrl>
-	<version>2.3.5</version>
+	<version>2.4.0</version>
 	<description>PLG_AUTH_COUNTRY_XML_DESCRIPTION</description>
 	<files>
 		<filename plugin="cgsecure">cgsecure.php</filename>

diff --git a/packages/plg_system_cgsecure/cgsecure.xml b/packages/plg_system_cgsecure/cgsecure.xml
@@ -2,12 +2,12 @@
 <extension type="plugin" group="system" method="upgrade" version="4.0">
 	<name>System - CG Secure</name>
 	<author>conseilgouz</author>
-	<creationDate>2023/07/24</creationDate>
+	<creationDate>2023/08/04</creationDate>
 	<copyright>This plugin is released under the GNU/GPL License</copyright>
 	<license>GNU General Public License</license>
 	<authorEmail>pascal.leconte@conseilgouz.com</authorEmail>
 	<authorUrl>www.conseilgouz.com</authorUrl>
-	<version>2.3.5</version>
+	<version>2.4.0</version>
 	<description>CG_SECURE_DESC</description>
 	<files>
 		<filename plugin="cgsecure">cgsecure.php</filename>

diff --git a/packages/plg_system_cgsecure/language/fr-FR/plg_system_cgsecure.ini b/packages/plg_system_cgsecure/language/fr-FR/plg_system_cgsecure.ini
@@ -1,4 +1,4 @@
-CG_SECURE_DESC="Plugin CG Secure,.<br>Une fois activé, CG Secure protège l'accès à /administrator par un mot de passe, après avoir vérifié le pays d'origine par rapport à votre adresse ip.<br />Comment accéder à votre administration une fois CG Secure activé :<ul><li><strong>HTTP Authentication</strong>: fenêtre standard Apache d'authentification. Vous devrez entrer mot de passe dans la zone &quot;Password&quot;. Vous pouvez laisser la zone &quot;Username&quot; vide, car elle n'est pas vérifiée.</li>	<li><strong>Compatibilité</strong>: Vous devez entrer http://www.yourwebsite.com/administrator?votremotdepasse &mdash; &quot;votremotdepasse&quot; étant remplacé par le mot de passe que vous avez paramétré dans le plugin CG Secure.</li></ul>"
+CG_SECURE_DESC="Plugin CG Secure.<br>Une fois activé, CG Secure protège l'accès à /administrator par un mot de passe, après avoir vérifié le pays d'origine par rapport à votre adresse ip.<br />Comment accéder à votre administration une fois CG Secure activé :<ul><li><strong>HTTP Authentication</strong>: fenêtre standard Apache d'authentification. Vous devrez entrer mot de passe dans la zone &quot;Password&quot;. Vous pouvez laisser la zone &quot;Username&quot; vide, car elle n'est pas vérifiée.</li>	<li><strong>Compatibilité</strong>: Vous devez entrer http://www.yourwebsite.com/administrator?votremotdepasse &mdash; &quot;votremotdepasse&quot; étant remplacé par le mot de passe que vous avez paramétré dans le plugin CG Secure.</li></ul>"
 CGSECURE_NOTE="Important"
 CGSECURE_NOTE_DESC="Ce plugin utilise les param&egrave;tres du <a href='index.php?option=com_cgsecure&view=config'>composant CG Secure</a>."
 CG_SECURE_LOGIN_CODE_ERROR="Erreur Login"

diff --git a/packages/plg_user_cgsecure/cgsecure.xml b/packages/plg_user_cgsecure/cgsecure.xml
@@ -2,12 +2,12 @@
 <extension version="4.0" type="plugin" group="user" method="upgrade">
 	<name>CG_COUNTRY</name>
 	<author>ConseilGouz</author>
-	<creationDate>2023/07/24</creationDate>
+	<creationDate>2023/08/04</creationDate>
 	<copyright>(C)2023 ConseilGouz. All rights reserved.</copyright>
 	<license>GNU General Public License version 2 or later; see LICENSE.txt</license>
 	<authorEmail>pascal.leconte@conseilgouz.com</authorEmail>
 	<authorUrl>www.conseilgouz.com</authorUrl>
-	<version>2.3.5</version>
+	<version>2.4.0</version>
 	<description>CG_COUNTRY_XML_DESCRIPTION</description>
 	<files>
 		<filename plugin="cgsecure">cgsecure.php</filename>

diff --git a/script.install.php b/script.install.php
@@ -2,7 +2,7 @@
 
 /**
  * @package    CG Secure
- * Version			: 2.3.3
+ * Version			: 2.4.0
  * @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL
  * @copyright (C) 2023 ConseilGouz. All Rights Reserved.
  * @author ConseilGouz 
@@ -18,6 +18,7 @@
 use Joomla\CMS\Table\Table;
 use Joomla\CMS\Version;
 use Joomla\CMS\Installer\Installer;
+use Joomla\CMS\Log\Log;
 
 class PlgSystemCgsecureInstallerInstallerScript
 {
@@ -335,9 +336,6 @@ private function getMajorVersionPart($string)
 
 	private function createExtensionRoot()
 	{
-		jimport('joomla.filesystem.folder');
-		jimport('joomla.filesystem.file');
-
 		$destination = JPATH_PLUGINS . '/system/' . $this->installerName;
 
 		Folder::create($destination);
@@ -417,7 +415,7 @@ private function installPackages() {
 	        $db->execute();
         }
         catch (RuntimeException $e) {
-            JLog::add('unable to enable Plugins CGSecure', JLog::ERROR, 'jerror');
+            Log::add('unable to enable Plugins CGSecure', Log::ERROR, 'jerror');
         }
 
 		return true;