1

I came across this on joomla.stackechange which has me concerned:

"define('_JEXEC', 1) is a bad for security in the module. It allows people to use this file as an alternative entry point for joomla."

I've created a css.php file as an adjunct to a custom Joomla 4 template. It uses define('_JEXEC', 1) to load some of the template's color parameters in the backend (a history of that can be found here)

Can anyone tell me if this file is a security risk:

<?php
define('_JEXEC', 1);
define('JPATH_BASE', __DIR__ . '/../../..');
require_once JPATH_BASE . '/includes/defines.php';
require_once JPATH_BASE . '/includes/framework.php';

// Boot the DI container.
$container = \Joomla\CMS\Factory::getContainer();

// alias the session service key to the web session service.
$container->alias('session.web', 'session.web.site')
    ->alias('session', 'session.web.site')
    ->alias('JSession', 'session.web.site')
    ->alias(\Joomla\CMS\Session\Session::class, 'session.web.site')
    ->alias(\Joomla\Session\Session::class, 'session.web.site')
    ->alias(\Joomla\Session\SessionInterface::class, 'session.web.site');

$app       = $container->get(\Joomla\CMS\Application\SiteApplication::class);
$template  = $app->getTemplate(true);
$params    = $template->params;

header("Content-Type:text/css; charset=UTF-8");
header("Cache-Control:must-revalidate");
?>
.bg01 {text-shadow: 0px 1px #000000; border-color: #495057; font-weight: bold; color:<?php echo $params->get('color01'); ?>; }
.bg02 {text-shadow: 0px 1px #000000; border-color: #495057; font-weight: bold; color:<?php echo $params->get('color02'); ?>; }
.bg03 {text-shadow: 0px 1px #000000; border-color: #495057; font-weight: bold; color:<?php echo $params->get('color03'); ?>; }
.bg04 {text-shadow: 0px 1px #000000; border-color: #495057; font-weight: bold; color:<?php echo $params->get('color04'); ?>; }
.btn-check:checked + .btn-outline-secondary.bg01 {text-shadow: 0px 1px #000000; color:#fff; background-color:<?php echo $params->get('color01'); ?>; }
.btn-check:checked + .btn-outline-secondary.bg02 {text-shadow: 0px 1px #000000; color:#fff; background-color:<?php echo $params->get('color02'); ?>; }
.btn-check:checked + .btn-outline-secondary.bg03 {text-shadow: 0px 1px #000000; color:#fff; background-color:<?php echo $params->get('color03'); ?>; }
.btn-check:checked + .btn-outline-secondary.bg04 {text-shadow: 0px 1px #000000; color:#fff; background-color:<?php echo $params->get('color04'); ?>; }
<!-- EOF -->

If I use a browser to navigate to the css.php file location, it displays only the CSS:

.bg01 {text-shadow: 0px 1px #000000; border-color: #495057; font-weight: bold; color: #9E9E9E; }
.bg02 {text-shadow: 0px 1px #000000; border-color: #495057; font-weight: bold; color: #607D8B; }
.bg03 {text-shadow: 0px 1px #000000; border-color: #495057; font-weight: bold; color: #3F51B5; }
.bg04 {text-shadow: 0px 1px #000000; border-color: #495057; font-weight: bold; color: #2196F3; }
.btn-check:checked + .btn-outline-secondary.bg01 {text-shadow: 0px 1px #000000; color:#fff; background-color: #9E9E9E; }
.btn-check:checked + .btn-outline-secondary.bg02 {text-shadow: 0px 1px #000000; color:#fff; background-color: #607D8B; }
.btn-check:checked + .btn-outline-secondary.bg03 {text-shadow: 0px 1px #000000; color:#fff; background-color: #3F51B5; }
.btn-check:checked + .btn-outline-secondary.bg04 {text-shadow: 0px 1px #000000; color:#fff; background-color: #2196F3; }

Is this a vulnerability? Can anyone recommend an alternative method for retrieving (color) parameters in admin? I've seen com_ajax mentioned but I don't enough about it or whether it's appropriate to use in this case.

(Reference to a working example would be ideal as I am very much a novice when it comes to Joomla PHP -- being able to step through existing pieces of code has been my best learning tool)

1
  • Regarding the quoted comment, this was before Joomla had com_ajax and using Ajax in a module without your own custom component wasn't possible (if I rightly remember)
    – Lodder
    Aug 26 '21 at 4:57
0

Constant check is used to prevent script execution when PHP files are accessed directly (e.g. in the browser). In your case this isn't an issue since your is essentially a separate application. It's a valid entry point.

There is an issue of your script not being a valid Joomla web application. It doesn't go over the standard request cycle which could cause some issues here and there. For instance, by adding Itemid[] parameter to the URL we can invoke a PHP warning:

Illegal offset type in isset or empty in C:\laragon\www\joomla-cms\libraries\src\Menu\AbstractMenu.php on line 148

If error reporting is disabled in Joomla, the warning won't appear. But the point is, some code may rely on application being executed properly.

I've seen com_ajax mentioned but I don't enough about it or whether it's appropriate to use in this case.

com_ajax is generally the right way to do something like this in Joomla. There are some faster options like caching the generated stylesheet to file. But arguably the best option for your case is using inline styles.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.