Enabling user based access controls in Phoca Download

[Geraint]

Hi

I have made some changes to Phoca Download which I'd like to present for you consideration. I am the lead developer on the JEvents calendar and co-developer of Joomfish - for both projects we have created a special members club. The club benefits include access to exclusive member only download areas - we have been using RokDownloads for this but are a bit frustrated with the features and layouts.

I have taken a look at Phoca Download as an alternative and it looks very promising apart from the fact that we can't control access to sections/categories/files on a user type basis (i.e. bronze, silver or gold member access). In RokDownloads I was able to write a content and system plugin that enabled me to manipulate the files and folders that were available. In Phoca there is no equivalent mechanism possible.

I have made some simple changes to a test installation that makes this possible - this basically uses a plugin to inject additional contraints in the database queries.

For example in the section model method _getCategoryListQuery the code is changed to

Code: Select all

	function _getCategoryListQuery( $sectionId, $aid, $params ) {
		
		$wheres[]	= " cc.section= ".(int)$sectionId;
		if ($aid !== null) {
			$wheres[] = "cc.access <= " . (int) $aid;
		}
		$wheres[] = " cc.published = 1";
		
		$categoryOrdering = $this->_getCategoryOrdering();
		
		// GWE MOD - to allow for access restrictions
		JPluginHelper::importPlugin("phoca");
		$dispatcher	   =& JDispatcher::getInstance();
		$joins = array();
		$results = $dispatcher->trigger('onGetCategoryList', array (&$wheres, &$joins, $sectionId, $params));	
		// END GWE MOD
		
		$query = " SELECT  cc.id, cc.title, cc.alias, COUNT(c.id) AS numdoc"
				. " FROM #__phocadownload_categories AS cc"
				. " LEFT JOIN #__phocadownload AS c ON c.catid = cc.id AND c.published = 1 AND c.textonly = 0"
				. (count($joins)>0?( " LEFT JOIN " .implode( " LEFT JOIN ", $joins )):"") // GWE MOD
				. " WHERE " . implode( " AND ", $wheres )
				. " GROUP BY cc.id"
				. " ORDER BY cc.".$categoryOrdering;
				
		return $query;
	}

This then allows me to simple add a new where and join clause to the query.

Is there any chance this type of change could be adopted in the phoca code base so I don't need to maintain a separate version?

Geraint

[Jan]

Hi, I am able to add any customization so this then can help to use Phoca Download with more features. The problem for now I see is the security.

In fact that Phoca Download is open, such solution like this can make security problems as with such solution the gate for the sql query will be open and you can inject the sql query like you want

Please let me know your ideas.

Jan

[Geraint]

Hi Jan

The query could only be modified by an installed and enabled "phoca" group plugin.

In other words the only security risk is if a site admin installs such a plugin from a disreputable source. This is therefore no more of a risk than installing any module, plugin or component in Joomla.

An example of how this plugin architecture could be used include allowing downloads only for certain types of Community Builder or JomSocial users.

Geraint

[Jan]

Hi, yes the problem is, any other plugin called such name can access the sql code then. Of course other modules can access all data from every component in database but this is directly access to sql query. I will try to check if there cannot be injected the name of the plugin and process of plubin listeners in Joomla!

If you know all the places where this method should be used, please let me know.

Jan

[Geraint]

The only way for these SQL queries to be affected is by a phoca plugin called by the Joomla dispatcher - such a plugin would need to be installed on the Joomla site. Clearly an evil component could install such a plugin without the site admin knowing but that would be the least of the site admin's concerns if such an evil component was installed on their site.

I have a set of modified model files which I tried to attach (but I got an error message from PHPBB3 when I tried. As an alternative here is a link to the modified files.

http://www.jevents.net/images/stories/p ... els.tar.gz

Each change is marked by "GWE MOD" and "END GWE MOD" comments.

thanks

Geraint

[Jan]

I have implemented it into 1.3.0 stable. Before you can use it, you need to enable this support in parameters - Enable Plugin Query - parameter

Try it and let me know.

Jan

[Geraint]

Cool - will let you know how it goes.

Geraint

[Jan]

Ok