Skip to content

Commit 7152030

Browse files
bembelimenbembelimen
committed
Merge branch '4.0-dev' of github.com:joomla/joomla-cms into 4.1-dev
# Conflicts: # libraries/src/Version.php # modules/mod_breadcrumbs/tmpl/default.php
2 parents 125b2d7 + 4000aed commit 7152030

File tree

133 files changed

+1046
-1056
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

133 files changed

+1046
-1056
lines changed

‎administrator/components/com_actionlogs/src/Helper/ActionlogsHelper.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -237,12 +237,13 @@ public static function getHumanReadableLogMessage($log, $generateLinks = true)
237237
* @param string $contentType
238238
* @param integer $id
239239
* @param string $urlVar
240+
* @param JObject $object
240241
*
241242
* @return string Link to the content item
242243
*
243244
* @since 3.9.0
244245
*/
245-
public static function getContentTypeLink($component, $contentType, $id, $urlVar = 'id')
246+
public static function getContentTypeLink($component, $contentType, $id, $urlVar = 'id', $object = null)
246247
{
247248
// Try to find the component helper.
248249
$eName = str_replace('com_', '', $component);
@@ -257,7 +258,7 @@ public static function getContentTypeLink($component, $contentType, $id, $urlVar
257258

258259
if (class_exists($cName) && is_callable(array($cName, 'getContentTypeLink')))
259260
{
260-
return $cName::getContentTypeLink($contentType, $id);
261+
return $cName::getContentTypeLink($contentType, $id, $object);
261262
}
262263
}
263264

‎administrator/components/com_admin/script.php‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1460,7 +1460,6 @@ public function deleteUnexistingFiles($dryRun = false, $suppressOutput = false)
14601460
'/administrator/components/com_media/controllers/file.json.php',
14611461
'/administrator/components/com_media/controllers/file.php',
14621462
'/administrator/components/com_media/controllers/folder.php',
1463-
'/administrator/components/com_media/helpers/media.php',
14641463
'/administrator/components/com_media/layouts/toolbar/deletemedia.php',
14651464
'/administrator/components/com_media/layouts/toolbar/newfolder.php',
14661465
'/administrator/components/com_media/layouts/toolbar/uploadmedia.php',
@@ -3874,9 +3873,11 @@ public function deleteUnexistingFiles($dryRun = false, $suppressOutput = false)
38743873
'/libraries/vendor/leafo/lessphp/lessify',
38753874
'/libraries/vendor/leafo/lessphp/lessify.inc.php',
38763875
'/libraries/vendor/leafo/lessphp/plessc',
3876+
'/libraries/vendor/paragonie/random_compat/LICENSE',
38773877
'/libraries/vendor/paragonie/random_compat/lib/byte_safe_strings.php',
38783878
'/libraries/vendor/paragonie/random_compat/lib/cast_to_int.php',
38793879
'/libraries/vendor/paragonie/random_compat/lib/error_polyfill.php',
3880+
'/libraries/vendor/paragonie/random_compat/lib/random.php',
38803881
'/libraries/vendor/paragonie/random_compat/lib/random_bytes_com_dotnet.php',
38813882
'/libraries/vendor/paragonie/random_compat/lib/random_bytes_dev_urandom.php',
38823883
'/libraries/vendor/paragonie/random_compat/lib/random_bytes_libsodium.php',
@@ -5423,6 +5424,8 @@ public function deleteUnexistingFiles($dryRun = false, $suppressOutput = false)
54235424
'/libraries/vendor/ozdemirburak/iris/src/Traits/HsTrait.php',
54245425
'/libraries/vendor/ozdemirburak/iris/src/Traits/HslTrait.php',
54255426
'/libraries/vendor/ozdemirburak/iris/src/Traits/RgbTrait.php',
5427+
'/libraries/vendor/paragonie/random_compat/dist/random_compat.phar.pubkey',
5428+
'/libraries/vendor/paragonie/random_compat/dist/random_compat.phar.pubkey.asc',
54265429
'/libraries/vendor/psr/http-factory/.pullapprove.yml',
54275430
'/libraries/vendor/spomky-labs/cbor-php/.php_cs.dist',
54285431
'/libraries/vendor/spomky-labs/cbor-php/CODE_OF_CONDUCT.md',
@@ -5843,6 +5846,19 @@ public function deleteUnexistingFiles($dryRun = false, $suppressOutput = false)
58435846
'/templates/cassiopeia/scss/tools/mixins/_margin.scss',
58445847
'/templates/cassiopeia/scss/tools/mixins/_visually-hidden.scss',
58455848
'/templates/system/js/error-locales.js',
5849+
// 4.0 from RC 1 to RC 2
5850+
'/administrator/components/com_fields/tmpl/field/modal.php',
5851+
'/administrator/templates/atum/scss/pages/_com_admin.scss',
5852+
'/administrator/templates/atum/scss/pages/_com_finder.scss',
5853+
'/administrator/templates/atum/scss/pages/_com_joomlaupdate.scss',
5854+
'/libraries/src/Error/JsonApi/InstallLanguageExceptionHandler.php',
5855+
'/libraries/src/MVC/Controller/Exception/InstallLanguage.php',
5856+
'/media/com_fields/js/admin-field-edit-modal-es5.js',
5857+
'/media/com_fields/js/admin-field-edit-modal-es5.min.js',
5858+
'/media/com_fields/js/admin-field-edit-modal-es5.min.js.gz',
5859+
'/media/com_fields/js/admin-field-edit-modal.js',
5860+
'/media/com_fields/js/admin-field-edit-modal.min.js',
5861+
'/media/com_fields/js/admin-field-edit-modal.min.js.gz',
58465862
);
58475863

58485864
$folders = array(
@@ -6167,6 +6183,7 @@ public function deleteUnexistingFiles($dryRun = false, $suppressOutput = false)
61676183
'/libraries/vendor/simplepie/simplepie',
61686184
'/libraries/vendor/simplepie',
61696185
'/libraries/vendor/phpmailer/phpmailer/extras',
6186+
'/libraries/vendor/paragonie/random_compat/lib',
61706187
'/libraries/vendor/leafo/lessphp',
61716188
'/libraries/vendor/leafo',
61726189
'/libraries/vendor/joomla/session/Joomla/Session/Storage',
@@ -6797,7 +6814,6 @@ public function deleteUnexistingFiles($dryRun = false, $suppressOutput = false)
67976814
'/administrator/components/com_media/views/images',
67986815
'/administrator/components/com_media/views',
67996816
'/administrator/components/com_media/models',
6800-
'/administrator/components/com_media/helpers',
68016817
'/administrator/components/com_media/controllers',
68026818
'/administrator/components/com_login/views/login/tmpl',
68036819
'/administrator/components/com_login/views/login',
@@ -7051,6 +7067,8 @@ public function deleteUnexistingFiles($dryRun = false, $suppressOutput = false)
70517067
'/media/vendor/punycode/js',
70527068
'/media/templates/atum/js',
70537069
'/media/templates/atum',
7070+
'/libraries/vendor/paragonie/random_compat/dist',
7071+
'/libraries/vendor/paragonie/random_compat',
70547072
'/libraries/vendor/ozdemirburak/iris/src/Traits',
70557073
'/libraries/vendor/ozdemirburak/iris/src/Helpers',
70567074
'/libraries/vendor/ozdemirburak/iris/src/Exceptions',

‎administrator/components/com_admin/src/Controller/DisplayController.php‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,28 @@
2020
*/
2121
class DisplayController extends BaseController
2222
{
23+
/**
24+
* View method
25+
*
26+
* @param boolean $cachable If true, the view output will be cached
27+
* @param array $urlparams An array of safe URL parameters and their variable types, for valid values see {@link \JFilterInput::clean()}.
28+
*
29+
* @return static Supports chaining.
30+
*
31+
* @since 3.9
32+
*/
33+
public function display($cachable = false, $urlparams = array())
34+
{
35+
$viewName = $this->input->get('view', $this->default_view);
36+
$format = $this->input->get('format', 'html');
2337

38+
// Check CSRF token for sysinfo export views
39+
if ($viewName === 'sysinfo' && ($format === 'text' || $format === 'json'))
40+
{
41+
// Check for request forgeries.
42+
$this->checkToken('GET');
43+
}
44+
45+
return parent::display($cachable, $urlparams);
46+
}
2447
}

‎administrator/components/com_admin/src/View/Sysinfo/HtmlView.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
use Joomla\CMS\Language\Text;
1818
use Joomla\CMS\MVC\View\HtmlView as BaseHtmlView;
1919
use Joomla\CMS\Router\Route;
20+
use Joomla\CMS\Session\Session;
2021
use Joomla\CMS\Toolbar\ToolbarHelper;
2122
use Joomla\Component\Admin\Administrator\Model\SysinfoModel;
2223

@@ -110,12 +111,12 @@ protected function addToolbar(): void
110111
{
111112
ToolbarHelper::title(Text::_('COM_ADMIN_SYSTEM_INFORMATION'), 'info-circle systeminfo');
112113
ToolbarHelper::link(
113-
Route::_('index.php?option=com_admin&view=sysinfo&format=text'),
114+
Route::_('index.php?option=com_admin&view=sysinfo&format=text&' . Session::getFormToken() . '=1'),
114115
'COM_ADMIN_DOWNLOAD_SYSTEM_INFORMATION_TEXT',
115116
'download'
116117
);
117118
ToolbarHelper::link(
118-
Route::_('index.php?option=com_admin&view=sysinfo&format=json'),
119+
Route::_('index.php?option=com_admin&view=sysinfo&format=json&' . Session::getFormToken() . '=1'),
119120
'COM_ADMIN_DOWNLOAD_SYSTEM_INFORMATION_JSON',
120121
'download'
121122
);

‎administrator/components/com_banners/forms/banner.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
<field
66
name="id"
7-
type="number"
7+
type="text"
88
label="JGLOBAL_FIELD_ID_LABEL"
99
default="0"
1010
readonly="true"

‎administrator/components/com_banners/src/Controller/TracksController.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,9 @@ public function display($cachable = false, $urlparams = array())
109109
// Get and render the view.
110110
if ($view = $this->getView($vName, 'raw'))
111111
{
112+
// Check for request forgeries.
113+
$this->checkToken('GET');
114+
112115
// Get the model for the view.
113116
/** @var \Joomla\Component\Banners\Administrator\Model\TracksModel $model */
114117
$model = $this->getModel($vName);

‎administrator/components/com_banners/src/Model/BannerModel.php‎

Lines changed: 6 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -210,6 +210,12 @@ public function getForm($data = array(), $loadData = true)
210210
$form->setFieldAttribute('sticky', 'filter', 'unset');
211211
}
212212

213+
// Don't allow to change the created_by user if not allowed to access com_users.
214+
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
215+
{
216+
$form->setFieldAttribute('created_by', 'filter', 'unset');
217+
}
218+
213219
return $form;
214220
}
215221

@@ -460,31 +466,4 @@ private function canCreateCategory()
460466
{
461467
return Factory::getUser()->authorise('core.create', 'com_banners');
462468
}
463-
464-
/**
465-
* Method to validate the form data.
466-
*
467-
* @param Form $form The form to validate against.
468-
* @param array $data The data to validate.
469-
* @param string $group The name of the field group to validate.
470-
*
471-
* @return array|boolean Array of filtered data if valid, false otherwise.
472-
*
473-
* @see JFormRule
474-
* @see JFilterInput
475-
* @since 3.9.25
476-
*/
477-
public function validate($form, $data, $group = null)
478-
{
479-
// Don't allow to change the users if not allowed to access com_users.
480-
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
481-
{
482-
if (isset($data['created_by']))
483-
{
484-
unset($data['created_by']);
485-
}
486-
}
487-
488-
return parent::validate($form, $data, $group);
489-
}
490469
}

‎administrator/components/com_banners/tmpl/download/default.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111

1212
use Joomla\CMS\HTML\HTMLHelper;
1313
use Joomla\CMS\Router\Route;
14+
use \Joomla\CMS\Session\Session;
1415

1516
/** @var \Joomla\Component\Banners\Administrator\View\Download\HtmlView $this */
1617

@@ -22,7 +23,7 @@
2223
class="form-horizontal form-validate"
2324
id="download-form"
2425
name="adminForm"
25-
action="<?php echo Route::_('index.php?option=com_banners&task=tracks.display&format=raw'); ?>"
26+
action="<?php echo Route::_('index.php?option=com_banners&task=tracks.display&format=raw&' . Session::getFormToken() . '=1'); ?>"
2627
method="post">
2728

2829
<?php foreach ($this->form->getFieldset() as $field) : ?>

‎administrator/components/com_categories/forms/category.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
<field
55
name="id"
6-
type="number"
6+
type="text"
77
label="JGLOBAL_FIELD_ID_LABEL"
88
default="0"
99
class="readonly"
@@ -12,7 +12,7 @@
1212

1313
<field
1414
name="hits"
15-
type="number"
15+
type="text"
1616
label="JGLOBAL_HITS"
1717
default="0"
1818
class="readonly"

‎administrator/components/com_categories/src/Model/CategoryModel.php‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,12 @@ public function getForm($data = array(), $loadData = true)
289289
$form->setFieldAttribute('published', 'filter', 'unset');
290290
}
291291

292+
// Don't allow to change the created_user_id user if not allowed to access com_users.
293+
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
294+
{
295+
$form->setFieldAttribute('created_user_id', 'filter', 'unset');
296+
}
297+
292298
return $form;
293299
}
294300

@@ -368,15 +374,6 @@ protected function loadFormData()
368374
*/
369375
public function validate($form, $data, $group = null)
370376
{
371-
// Don't allow to change the users if not allowed to access com_users.
372-
if (!Factory::getUser()->authorise('core.manage', 'com_users'))
373-
{
374-
if (isset($data['created_user_id']))
375-
{
376-
unset($data['created_user_id']);
377-
}
378-
}
379-
380377
if (!Factory::getUser()->authorise('core.admin', $data['extension']))
381378
{
382379
if (isset($data['rules']))

0 commit comments

Comments
 (0)