bug: $_GET superglobal mutation is redundant and fragile #93

Closed
opened 2026-05-22 03:29:51 +00:00 by jmiller · 1 comment
Owner

Description

In MokoJoomTOS.php:124, the plugin sets $_GET['tmpl'] = 'component' after already calling $input->set('tmpl', 'component'). The $_GET superglobal is not consulted after Joomla's Input object is initialized, making this redundant. It could also conflict with third-party code that re-reads $_GET.

Fix

Remove the $_GET['tmpl'] line. The $input->set() call is sufficient.

Files

  • src/src/Extension/MokoJoomTOS.php:124
  • src/mokojoomtos.php:108 (legacy dead code)
## Description In `MokoJoomTOS.php:124`, the plugin sets `$_GET['tmpl'] = 'component'` after already calling `$input->set('tmpl', 'component')`. The `$_GET` superglobal is not consulted after Joomla's Input object is initialized, making this redundant. It could also conflict with third-party code that re-reads `$_GET`. ## Fix Remove the `$_GET['tmpl']` line. The `$input->set()` call is sufficient. ## Files - `src/src/Extension/MokoJoomTOS.php:124` - `src/mokojoomtos.php:108` (legacy dead code)
jmiller added the joomlapriority: highbug labels 2026-05-22 03:29:51 +00:00
Author
Owner

Testing Steps -- superglobal removal

Setup

  1. Install the plugin on Joomla 5.x
  2. Set site offline, configure slug

Test

  1. Visit the configured slug in an incognito browser while offline
  2. Expected: Article renders in component-only view (no header/footer)
  3. View page source -- confirm no full template markup
  4. Expected: Identical behavior to before (the $_GET line was redundant)

Pass criteria

  • Component-only view still works without $_GET mutation
  • No template chrome visible on the bypassed page
## Testing Steps -- superglobal removal ### Setup 1. Install the plugin on Joomla 5.x 2. Set site offline, configure slug ### Test 1. Visit the configured slug in an incognito browser while offline 2. **Expected:** Article renders in component-only view (no header/footer) 3. View page source -- confirm no full template markup 4. **Expected:** Identical behavior to before (the `$_GET` line was redundant) ### Pass criteria - [ ] Component-only view still works without `$_GET` mutation - [ ] No template chrome visible on the bypassed page
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: MokoConsulting/MokoJoomTOS#93