From c147c57763730e07d14b64901519bdc4f8af90df Mon Sep 17 00:00:00 2001 From: AntonV1211 Date: Thu, 1 Oct 2026 15:35:30 +0700 Subject: [PATCH 1/4] Fix. Code. Checking before manipulating super global variables --- cleantalk/antispam/acp/main_module.php | 38 +++++++++++++++++--- cleantalk/antispam/event/main_listener.php | 40 ++++++++++++++++++---- 2 files changed, 68 insertions(+), 10 deletions(-) diff --git a/cleantalk/antispam/acp/main_module.php b/cleantalk/antispam/acp/main_module.php index d0d4aa9..662104e 100644 --- a/cleantalk/antispam/acp/main_module.php +++ b/cleantalk/antispam/acp/main_module.php @@ -421,6 +421,8 @@ function sfw_update($access_key = null) require_once($autoload_path); } + $super_globals_were_disabled = $this->super_globals_disabled($request); + try { $api_key = $access_key ?: $config['cleantalk_antispam_apikey']; @@ -434,7 +436,7 @@ function sfw_update($access_key = null) $result = $firewall->getUpdater()->update(); - $request->disable_super_globals(); + $this->restore_super_globals($request, $super_globals_were_disabled); if (empty($result['error'])) { $config->set('cleantalk_antispam_sfw_update_last_gc', time()); @@ -442,7 +444,7 @@ function sfw_update($access_key = null) return $result; } catch (\Exception $e) { - $request->disable_super_globals(); + $this->restore_super_globals($request, $super_globals_were_disabled); error_log('CleanTalk SFW update error: ' . $e->getMessage()); return array('error' => $e->getMessage()); } @@ -457,6 +459,8 @@ function sfw_send_logs($access_key) require_once($autoload_path); } + $super_globals_were_disabled = $this->super_globals_disabled($request); + try { $request->enable_super_globals(); @@ -467,7 +471,7 @@ function sfw_send_logs($access_key) $result = $firewall->sendLogs(); - $request->disable_super_globals(); + $this->restore_super_globals($request, $super_globals_were_disabled); if (!isset($result['error'])) { $config->set('cleantalk_antispam_sfw_logs_send_last_gc', time()); @@ -475,9 +479,35 @@ function sfw_send_logs($access_key) return $result; } catch (\Exception $e) { - $request->disable_super_globals(); + $this->restore_super_globals($request, $super_globals_were_disabled); error_log('CleanTalk SFW send logs error: ' . $e->getMessage()); return array('error' => $e->getMessage()); } } + + /** + * Current state of phpBB superglobals. + * Another integration (phpBB embedded into Joomla, etc.) may have enabled them intentionally. + * + * @param \phpbb\request\request $request + * @return bool + */ + private function super_globals_disabled($request) + { + return !method_exists($request, 'super_globals_disabled') || $request->super_globals_disabled(); + } + + /** + * Restores the superglobals state captured before CleanTalk processing + * + * @param \phpbb\request\request $request + * @param bool $were_disabled + */ + private function restore_super_globals($request, $were_disabled) + { + if ($were_disabled) + { + $request->disable_super_globals(); + } + } } diff --git a/cleantalk/antispam/event/main_listener.php b/cleantalk/antispam/event/main_listener.php index 88f6f28..1bdeb7f 100644 --- a/cleantalk/antispam/event/main_listener.php +++ b/cleantalk/antispam/event/main_listener.php @@ -132,6 +132,8 @@ public function sfw_check($event) return; } + $super_globals_were_disabled = $this->super_globals_disabled(); + try { $api_key = $this->config['cleantalk_antispam_apikey']; @@ -155,12 +157,36 @@ public function sfw_check($event) $firewall->run(); - $this->request->disable_super_globals(); + $this->restore_super_globals($super_globals_were_disabled); } catch (\Exception $e) { - $this->request->disable_super_globals(); + $this->restore_super_globals($super_globals_were_disabled); error_log('CleanTalk SFW error: ' . $e->getMessage()); } } + + /** + * Current state of phpBB superglobals. + * Another integration (phpBB embedded into Joomla, etc.) may have enabled them intentionally. + * + * @return bool + */ + private function super_globals_disabled() + { + return !method_exists($this->request, 'super_globals_disabled') || $this->request->super_globals_disabled(); + } + + /** + * Restores the superglobals state captured before CleanTalk processing + * + * @param bool $were_disabled + */ + private function restore_super_globals($were_disabled) + { + if ($were_disabled) + { + $this->request->disable_super_globals(); + } + } /** * Fills tamplate variable by generated JS-code with unique hash * @@ -372,6 +398,8 @@ public function ccf_check($event) // Remote calls via Common library $api_key = $this->config['cleantalk_antispam_apikey']; if ($api_key) { + $super_globals_were_disabled = $this->super_globals_disabled(); + try { // Enable superglobals BEFORE RC check — RemoteCalls::check() reads $_GET/$_REQUEST $this->request->enable_super_globals(); @@ -384,17 +412,17 @@ public function ccf_check($event) $remote_calls = new $rc_class($api_key, new $storage_handler_class()); try { $rc_result = $remote_calls->process(); - $this->request->disable_super_globals(); + $this->restore_super_globals($super_globals_were_disabled); die($rc_result); } catch (\Cleantalk\Common\RemoteCalls\Exceptions\RemoteCallsException $exception) { - $this->request->disable_super_globals(); + $this->restore_super_globals($super_globals_were_disabled); error_log('CleanTalk RC error: ' . $exception->getMessage()); die('FAIL ' . json_encode(array('error' => $exception->getMessage()))); } } - $this->request->disable_super_globals(); + $this->restore_super_globals($super_globals_were_disabled); } catch (\Exception $e) { - $this->request->disable_super_globals(); + $this->restore_super_globals($super_globals_were_disabled); error_log('CleanTalk RC init error: ' . $e->getMessage()); } } From ce239efd940ce63545701f1302df2b7b3c55e3c7 Mon Sep 17 00:00:00 2001 From: AntonV1211 Date: Thu, 1 Oct 2026 15:35:39 +0700 Subject: [PATCH 2/4] Fix. Code. Checking before manipulating super global variables --- cleantalk/antispam/acp/main_module.php | 39 ++++---------------- cleantalk/antispam/event/main_listener.php | 40 +++++--------------- cleantalk/antispam/model/SuperGlobals.php | 43 ++++++++++++++++++++++ 3 files changed, 59 insertions(+), 63 deletions(-) create mode 100644 cleantalk/antispam/model/SuperGlobals.php diff --git a/cleantalk/antispam/acp/main_module.php b/cleantalk/antispam/acp/main_module.php index 662104e..e7fbf09 100644 --- a/cleantalk/antispam/acp/main_module.php +++ b/cleantalk/antispam/acp/main_module.php @@ -12,6 +12,7 @@ use Cleantalk\Common\Api\Api; use Cleantalk\Custom\Errors; +use cleantalk\antispam\model\SuperGlobals; class main_module { @@ -421,7 +422,7 @@ function sfw_update($access_key = null) require_once($autoload_path); } - $super_globals_were_disabled = $this->super_globals_disabled($request); + $super_globals_were_disabled = SuperGlobals::areDisabled($request); try { $api_key = $access_key ?: $config['cleantalk_antispam_apikey']; @@ -436,7 +437,7 @@ function sfw_update($access_key = null) $result = $firewall->getUpdater()->update(); - $this->restore_super_globals($request, $super_globals_were_disabled); + SuperGlobals::restore($request, $super_globals_were_disabled); if (empty($result['error'])) { $config->set('cleantalk_antispam_sfw_update_last_gc', time()); @@ -444,7 +445,7 @@ function sfw_update($access_key = null) return $result; } catch (\Exception $e) { - $this->restore_super_globals($request, $super_globals_were_disabled); + SuperGlobals::restore($request, $super_globals_were_disabled); error_log('CleanTalk SFW update error: ' . $e->getMessage()); return array('error' => $e->getMessage()); } @@ -459,7 +460,7 @@ function sfw_send_logs($access_key) require_once($autoload_path); } - $super_globals_were_disabled = $this->super_globals_disabled($request); + $super_globals_were_disabled = SuperGlobals::areDisabled($request); try { $request->enable_super_globals(); @@ -471,7 +472,7 @@ function sfw_send_logs($access_key) $result = $firewall->sendLogs(); - $this->restore_super_globals($request, $super_globals_were_disabled); + SuperGlobals::restore($request, $super_globals_were_disabled); if (!isset($result['error'])) { $config->set('cleantalk_antispam_sfw_logs_send_last_gc', time()); @@ -479,35 +480,9 @@ function sfw_send_logs($access_key) return $result; } catch (\Exception $e) { - $this->restore_super_globals($request, $super_globals_were_disabled); + SuperGlobals::restore($request, $super_globals_were_disabled); error_log('CleanTalk SFW send logs error: ' . $e->getMessage()); return array('error' => $e->getMessage()); } } - - /** - * Current state of phpBB superglobals. - * Another integration (phpBB embedded into Joomla, etc.) may have enabled them intentionally. - * - * @param \phpbb\request\request $request - * @return bool - */ - private function super_globals_disabled($request) - { - return !method_exists($request, 'super_globals_disabled') || $request->super_globals_disabled(); - } - - /** - * Restores the superglobals state captured before CleanTalk processing - * - * @param \phpbb\request\request $request - * @param bool $were_disabled - */ - private function restore_super_globals($request, $were_disabled) - { - if ($were_disabled) - { - $request->disable_super_globals(); - } - } } diff --git a/cleantalk/antispam/event/main_listener.php b/cleantalk/antispam/event/main_listener.php index 1bdeb7f..63cd633 100644 --- a/cleantalk/antispam/event/main_listener.php +++ b/cleantalk/antispam/event/main_listener.php @@ -18,6 +18,7 @@ use phpbb\user; use phpbb\db\driver\driver_interface; use cleantalk\antispam\model\main_model; +use cleantalk\antispam\model\SuperGlobals; use phpbb\symfony_request; /** @@ -132,7 +133,7 @@ public function sfw_check($event) return; } - $super_globals_were_disabled = $this->super_globals_disabled(); + $super_globals_were_disabled = SuperGlobals::areDisabled($this->request); try { $api_key = $this->config['cleantalk_antispam_apikey']; @@ -157,36 +158,13 @@ public function sfw_check($event) $firewall->run(); - $this->restore_super_globals($super_globals_were_disabled); + SuperGlobals::restore($this->request, $super_globals_were_disabled); } catch (\Exception $e) { - $this->restore_super_globals($super_globals_were_disabled); + SuperGlobals::restore($this->request, $super_globals_were_disabled); error_log('CleanTalk SFW error: ' . $e->getMessage()); } } - /** - * Current state of phpBB superglobals. - * Another integration (phpBB embedded into Joomla, etc.) may have enabled them intentionally. - * - * @return bool - */ - private function super_globals_disabled() - { - return !method_exists($this->request, 'super_globals_disabled') || $this->request->super_globals_disabled(); - } - - /** - * Restores the superglobals state captured before CleanTalk processing - * - * @param bool $were_disabled - */ - private function restore_super_globals($were_disabled) - { - if ($were_disabled) - { - $this->request->disable_super_globals(); - } - } /** * Fills tamplate variable by generated JS-code with unique hash * @@ -398,7 +376,7 @@ public function ccf_check($event) // Remote calls via Common library $api_key = $this->config['cleantalk_antispam_apikey']; if ($api_key) { - $super_globals_were_disabled = $this->super_globals_disabled(); + $super_globals_were_disabled = SuperGlobals::areDisabled($this->request); try { // Enable superglobals BEFORE RC check — RemoteCalls::check() reads $_GET/$_REQUEST @@ -412,17 +390,17 @@ public function ccf_check($event) $remote_calls = new $rc_class($api_key, new $storage_handler_class()); try { $rc_result = $remote_calls->process(); - $this->restore_super_globals($super_globals_were_disabled); + SuperGlobals::restore($this->request, $super_globals_were_disabled); die($rc_result); } catch (\Cleantalk\Common\RemoteCalls\Exceptions\RemoteCallsException $exception) { - $this->restore_super_globals($super_globals_were_disabled); + SuperGlobals::restore($this->request, $super_globals_were_disabled); error_log('CleanTalk RC error: ' . $exception->getMessage()); die('FAIL ' . json_encode(array('error' => $exception->getMessage()))); } } - $this->restore_super_globals($super_globals_were_disabled); + SuperGlobals::restore($this->request, $super_globals_were_disabled); } catch (\Exception $e) { - $this->restore_super_globals($super_globals_were_disabled); + SuperGlobals::restore($this->request, $super_globals_were_disabled); error_log('CleanTalk RC init error: ' . $e->getMessage()); } } diff --git a/cleantalk/antispam/model/SuperGlobals.php b/cleantalk/antispam/model/SuperGlobals.php new file mode 100644 index 0000000..af15ae3 --- /dev/null +++ b/cleantalk/antispam/model/SuperGlobals.php @@ -0,0 +1,43 @@ +super_globals_disabled(); + } + + /** + * Restores the superglobals state captured before CleanTalk processing + * + * @param \phpbb\request\request $request + * @param bool $were_disabled + */ + static public function restore($request, $were_disabled) + { + if ($were_disabled) + { + $request->disable_super_globals(); + } + } +} From 45aeb6e8e2cfdbabfeea35525b0a67c2ec2fd243 Mon Sep 17 00:00:00 2001 From: AntonV1211 Date: Mon, 5 Oct 2026 18:23:42 +0700 Subject: [PATCH 3/4] Fix. SuperGlobal. Is object check --- cleantalk/antispam/model/SuperGlobals.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/cleantalk/antispam/model/SuperGlobals.php b/cleantalk/antispam/model/SuperGlobals.php index af15ae3..225d977 100644 --- a/cleantalk/antispam/model/SuperGlobals.php +++ b/cleantalk/antispam/model/SuperGlobals.php @@ -18,13 +18,16 @@ class SuperGlobals /** * Current state of phpBB superglobals. * Another integration (phpBB embedded into Joomla, etc.) may have enabled them intentionally. + * Returns false for an unusable request object, so nothing gets changed afterwards. * * @param \phpbb\request\request $request * @return bool */ static public function areDisabled($request) { - return !method_exists($request, 'super_globals_disabled') || $request->super_globals_disabled(); + return is_object($request) + && method_exists($request, 'super_globals_disabled') + && $request->super_globals_disabled(); } /** From 3e06e9f21f8b41b892cd9b08885d9cc55084fa9a Mon Sep 17 00:00:00 2001 From: AntonV1211 Date: Mon, 5 Oct 2026 18:25:40 +0700 Subject: [PATCH 4/4] Fix. SuperGlobal. Is object check --- cleantalk/antispam/model/SuperGlobals.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cleantalk/antispam/model/SuperGlobals.php b/cleantalk/antispam/model/SuperGlobals.php index 225d977..0170b0b 100644 --- a/cleantalk/antispam/model/SuperGlobals.php +++ b/cleantalk/antispam/model/SuperGlobals.php @@ -38,7 +38,7 @@ static public function areDisabled($request) */ static public function restore($request, $were_disabled) { - if ($were_disabled) + if ($were_disabled && is_object($request) && method_exists($request, 'disable_super_globals')) { $request->disable_super_globals(); }