瑞友天翼应用虚拟化系统<=7.0.5.1 漏洞测试

public function index()    {        if (!$this->checklogin()) return;跟进checklogin()函数
private function checklogin()    {//        if (!array_key_exists('LonginSucceed', $_SESSION)) //if (!$_SESSION['LonginSucceed'])//        $mUser = M('cuser');//        $cuser = $mUser->where("name='{$UName}' and is_group=0 AND is_admin !=1")->find();        $mUser = M('cuser');        $sessionpath = session_save_path();        $pathName = $this->openpath($sessionpath);        $path = $_REQUEST['sessId'] ? ($sessionpath . "/sess_" . $_REQUEST['sessId']) : ($sessionpath . "/" . $pathName['name'][0]);    var_dump($path);        $content = file_get_contents($path);        $tmp = explode("|", $content);        $tmp3 = unserialize($tmp[3]);        $userId = $tmp3['user_id'];        $cuser = $mUser->where("user_id='{$userId}' AND is_group=0 AND is_admin !=1")->find();        if (sizeof($cuser) > 0) {            $_SESSION['UserInfo'] = $cuser;            $_SESSION['sessId'] = $_REQUEST['sessId'];            $this->assign('sessId', $_REQUEST['sessId']);            return true;        }        if ($_SESSION['LonginSucceed'] == false) { //尚未登录            $this->login(); //$this->redirect('index');            return false;        } else {            return true;        }    }