| @@ -62,9 +62,9 @@ | ||
| 62 | 62 | |
| 63 | 63 | // create default attachments extension filters |
| 64 | 64 | $this->supportedFiles = implode(',', [ |
| 65 | 65 | // images |
| 66 | - 'png,apng,bmp,gif,ico,jpg,jpeg,svg,heic,webp', | |
| 66 | + 'png,apng,bmp,gif,ico,jpg,jpeg,heic,webp', | |
| 67 | 67 | // videos |
| 68 | 68 | 'mp4,mov,ogm,webm,3gp,asf,avi,divx,flv,mkv,mpg,mpeg,wmv,xvid', |
| 69 | 69 | // audios |
| 70 | 70 | 'aac,m4a,mp3,ogg,opus,wav,wave,ac3,aiff,flac,mid,midi,wma', |
| @@ -94,8 +94,22 @@ | ||
| 94 | 94 | // auto-bind the sender only if not provided |
| 95 | 95 | if (JFactory::getApplication()->isClient('administrator')) { |
| 96 | 96 | // authenticate as administrator |
| 97 | 97 | $user = new VBOChatUserAdmin; |
| 98 | + } else if (class_exists('VCMAppFramework') && ($appUser = VCMAppFramework::getUser())) { | |
| 99 | + /** | |
| 100 | + * The user authenticated via APP. | |
| 101 | + * Create a chat account accordingly. | |
| 102 | + * | |
| 103 | + * @since 1.18.16 (J) - 1.8.16 (WP) | |
| 104 | + */ | |
| 105 | + if ($appUser['admin']) { | |
| 106 | + // authenticate as administrator | |
| 107 | + $user = new VBOChatUserAdmin(new JUser($appUser['id'])); | |
| 108 | + } else { | |
| 109 | + // authenticate as operator | |
| 110 | + $user = new VBOChatUserOperator($appUser['id']); | |
| 111 | + } | |
| 98 | 112 | } else { |
| 99 | 113 | // fetch details of the logged in operator |
| 100 | 114 | $operator = VikBooking::getOperatorInstance()->getOperatorAccount(); |
| 101 | 115 | |
| @@ -266,9 +280,29 @@ | ||
| 266 | 280 | if (!$attachment->exists()) { |
| 267 | 281 | return false; |
| 268 | 282 | } |
| 269 | 283 | |
| 270 | - return JFile::delete($attachment->getPath()); | |
| 284 | + $filePath = $attachment->getPath(); | |
| 285 | + | |
| 286 | + /** | |
| 287 | + * Resolve traversal segments before comparing the received path | |
| 288 | + * against the allowed folder. | |
| 289 | + * | |
| 290 | + * @since 1.18.11 (J) - 1.8.11 (WP) | |
| 291 | + */ | |
| 292 | + $filePath = realpath($filePath); | |
| 293 | + | |
| 294 | + /** | |
| 295 | + * Make sure the file is located under the registered attachments path | |
| 296 | + * to prevent arbitrary file deletion. | |
| 297 | + * | |
| 298 | + * @since 1.18.10 (J) - 1.8.10 (WP) | |
| 299 | + */ | |
| 300 | + if (!$filePath || strpos($filePath, $this->attachmentsPath) !== 0) { | |
| 301 | + return false; | |
| 302 | + } | |
| 303 | + | |
| 304 | + return JFile::delete($filePath); | |
| 271 | 305 | } |
| 272 | 306 | |
| 273 | 307 | /** |
| 274 | 308 | * Reads all the messages under the specified context for the currently logged in user. |
| @@ -374,9 +408,9 @@ | ||
| 374 | 408 | if (!class_exists($classname)) { |
| 375 | 409 | throw new RuntimeException('The class [' . $classname . '] does not exist.', 404); |
| 376 | 410 | } |
| 377 | 411 | |
| 378 | - // instantiate class by inject the provided ID | |
| 412 | + // instantiate class by injecting the provided ID | |
| 379 | 413 | return new $classname($id); |
| 380 | 414 | } |
| 381 | 415 | |
| 382 | 416 | /** |
