OKLite 1.2.25 几处getshell审计分析

final public function get($id,$type="safe",$ext="")
{
$val = isset($_POST[$id]) ? $_POST[$id] : (isset($_GET[$id]) ? $_GET[$id] : (isset($_COOKIE[$id]) ? $_COOKIE[$id] : ''));
if($val == ''){
if($type == 'int' || $type == 'intval' || $type == 'float' || $type == 'floatval'){
return 0;
}else{
return '';
}
}
//判断内容是否有转义，所有未转义的数据都直接转义
$addslashes = false;
if(function_exists("get_magic_quotes_gpc") && get_magic_quotes_gpc()){
$addslashes = true;
}
if(!$addslashes){
$val = $this->_addslashes($val);
}
return $this->format($val,$type,$ext);
}

//...省略

private function _addslashes($val)
{
if(is_array($val)){
foreach($val AS $key=>$value){
$val[$key] = $this->_addslashes($value);
}
}else{
$val = addslashes($val);
}
return $val;
}

final public function format($msg,$type="safe",$ext="")
{
if($msg == ""){
return '';
}
if(is_array($msg)){
foreach($msg AS $key=>$value){
if(!is_numeric($key)){
$key2 = $this->format($key);
if($key2 == '' || in_array($key2,array('#','&','%'))){
unset($msg[$key]);
continue;
}
}
$msg[$key] = $this->format($value,$type,$ext);
}
if($msg && count($msg)>0){
return $msg;
}
return false;
}
if($type == 'html_js' || ($type == 'html' && $ext)){
$msg = stripslashes($msg);
if($this->app_id != 'admin'){
$msg = $this->lib('string')->xss_clean($msg);
}
$msg = $this->lib('string')->clear_url($msg,$this->url);
return addslashes($msg);
}
$msg = stripslashes($msg);
//格式化处理内容
switch ($type){
case 'safe':$msg = str_replace(array("\\","'",'"',"<",">"),array("\","'","&quot;","&lt;","&gt;"),$msg);break;
//...省略
}
if($msg){
$msg = addslashes($msg);
}
return $msg;
}

public function zip_f()
{
$rs = $this->lib('upload')->zipfile('upfile');
if($rs['status'] != 'ok'){
$this->json($rs['error']);
}
$this->json($rs['filename'],true);
}

public function zipfile($input,$folder='')
{
if(!$input){
return array('status'=>'error','content'=>P_Lang('未指定表单名称'));
}
//如果未指定存储文件夹，则使用
if(!$folder){
$folder = 'data/cache/';
}
$this->cateid = 0;
$this->set_dir($folder);
$this->set_type('zip');
$this->cate = array('id'=>0,'filemax'=>104857600,'root'=>$folder,'folder'=>'/','filetypes'=>'zip');
if(isset($_FILES[$input])){
$rs = $this->_upload($input);
}else{
$rs = $this->_save($input);
}
if($rs['status'] != 'ok'){
return $rs;
}
$rs['cate'] = $this->cate;
return $rs;
}

public function import_f()
{
$zipfile = $this->get('zipfile');

if(!$zipfile){
$this->lib('form')->cssjs(array('form_type'=>'upload'));
$this->addjs('js/webuploader/admin.upload.js');
$this->view('module_import');
}

if(strpos($zipfile,'..') !== false){
$this->json(P_Lang('不支持带..上级路径'));
}
if(!file_exists($this->dir_root.$zipfile)){
$this->json(P_Lang('ZIP文件不存在'));
}

$this->lib('phpzip')->unzip($this->dir_root.$zipfile,$this->dir_root.'data/cache/');

if(!file_exists($this->dir_root.'data/cache/module.xml')){
$this->json(P_Lang('导入模块失败，请检查解压缩是否成功'));
}

$rs = $info = $this->lib('xml')->read($this->dir_root.'data/cache/module.xml',true);
if(!$rs){
$this->json(P_Lang('XML内容解析异常'));
}
$tmp = $rs;
if(isset($tmp['_fields'])){
unset($tmp['_fields']);
}

$insert_id = $this->model('module')->save($tmp);
if(!$insert_id){
$this->json(P_Lang('模块导入失败，保存模块基本信息错误'));
}
$this->model('module')->create_tbl($insert_id);
$tbl_exists = $this->model('module')->chk_tbl_exists($insert_id);
if(!$tbl_exists){
$this->model('module')->delete($insert_id);
$this->json(P_Lang('创建模块表失败'));
}
if(isset($rs['_fields']) && $rs['_fields']){
foreach($rs['_fields'] as $key=>$value){
if($value['ext'] && is_array($value['ext'])){
$value['ext'] = serialize($value['ext']);
}
$value['module_id'] = $insert_id;
$this->model('module')->fields_save($value);
$this->model('module')->create_fields($insert_id,$value);
}
}
$this->lib('file')->rm($this->dir_root.'data/cache/module.xml');
$this->lib('file')->rm($this->dir_root.$zipfile);
$this->json(true);
}

public function unzip($file,$to='')
{
if(class_exists('ZipArchive')){
$zip = new ZipArchive;
$zip->open($file);
$zip->extractTo($to);
$zip->close();
return true;
}
if(function_exists('zip_open') && function_exists('zip_close')){
$zip = zip_open($file);
if($zip){
while ($zip_entry = zip_read($zip)) {
$file = basename(zip_entry_name($zip_entry));
$fp = fopen($to.basename($file), "w+");
if (zip_entry_open($zip, $zip_entry, "r")) {
$buf = zip_entry_read($zip_entry, zip_entry_filesize($zip_entry));
zip_entry_close($zip_entry);
}
fwrite($fp, $buf);
fclose($fp);
}
zip_close($zip);
return true;
}
}
return $this->Extract($file,$to);
}

public function unzip_f()
{
$id = $this->get('id','int');
$rs = $this->model('res')->get_one($id);
if(!$rs){
$this->json(P_Lang('附件不存在'));
}
if($rs['ext'] != 'zip'){
$this->json(P_Lang('非ZIP文件不支持在线解压'));
}
if(!file_exists($this->dir_root.$rs['filename'])){
$this->json(P_Lang('文件不存在'));
}
$info = $this->lib('phpzip')->zip_info($this->dir_root.$rs['filename']);
$info = current($info);
if(!$info['filename']){
$this->json(P_Lang('插件有异常'));
}
$info = explode('/',$info['filename']);
if(!$info[0]){
$this->json(P_Lang('插件有异常'));
}
if(file_exists($this->dir_root.'plugins/'.$info[0])){
$this->json(P_Lang('插件已存在，不允许重复解压'));
}
if(!$info[1]){
$this->json(P_Lang('插件打包模式有问题'));
}
$this->lib('phpzip')->unzip($this->dir_root.$rs['filename'],$this->dir_root.'plugins/');
$this->json(true);
}

//附件上传
public function save_f()
{
if(!$this->site['upload_guest']){
$this->json(P_Lang('系统已禁止游客上传，请联系管理员'));
}
$cateid = $this->get('cateid','int');
$rs = $this->upload_base('upfile',$cateid);
if(!$rs || $rs['status'] != 'ok'){
$this->json($rs['error']);
}
unset($rs['status']);
$rs['uploadtime'] = date("Y-m-d H:i:s",$rs['addtime']);
$this->json($rs,true);
}

private function upload_base($input_name='upfile',$cateid=0)
{
$rs = $this->lib('upload')->getfile($input_name,$cateid);
if($rs["status"] != "ok"){
return $rs;
}
$array = array();
$array["cate_id"] = $rs['cate']['id'];
$array["folder"] = $rs['folder'];
$array["name"] = basename($rs['filename']);
$array["ext"] = $rs['ext'];
$array["filename"] = $rs['filename'];
$array["addtime"] = $this->time;
$array["title"] = $rs['title'];
$array['session_id'] = $this->session->sessid();
$arraylist = array("jpg","gif","png","jpeg");
if(in_array($rs["ext"],$arraylist)){
$img_ext = getimagesize($this->dir_root.$rs['filename']);
$my_ext = array("width"=>$img_ext[0],"height"=>$img_ext[1]);
$array["attr"] = serialize($my_ext);
}
$id = $this->model('res')->save($array);
if(!$id){
$this->lib('file')->rm($this->dir_root.$rs['filename']);
return array('status'=>'error','error'=>P_Lang('图片存储失败'));
}
$this->model('res')->gd_update($id);
$rs = $this->model('res')->get_one($id);
$rs["status"] = "ok";
return $rs;
}

public function getfile($input='upfile',$cateid=0)
{
if(!$input){
return array('status'=>'error','content'=>P_Lang('未指定表单名称'));
}
$this->_cate($cateid); //获取一个文件分类的预设 表名res_cate
if(isset($_FILES[$input])){
$rs = $this->_upload($input);
}else{
$rs = $this->_save($input);
}
if($rs['status'] != 'ok'){
return $rs;
}
$rs['cate'] = $this->cate;
return $rs;
}

private function _upload($input)
{
$basename = substr(md5(time().uniqid()),9,16);
$chunk = isset($_REQUEST["chunk"]) ? intval($_REQUEST["chunk"]) : 0;
$chunks = isset($_REQUEST["chunks"]) ? intval($_REQUEST["chunks"]) : 1;
$tmpname = $_FILES[$input]["name"];
$tmpid = 'u_'.md5($tmpname);
$ext = $this->file_ext($tmpname);
$out_tmpfile = $this->dir_root.'data/cache/'.$tmpid.'_'.$chunk;
if (!$out = @fopen($out_tmpfile.".parttmp", "wb")) {
return array('status'=>'error','error'=>P_Lang('无法打开输出流'));
}
$error_id = $_FILES[$input]['error'] ? $_FILES[$input]['error'] : 0;
if($error_id){
return array('status'=>'error','error'=>$this->up_error[$error_id]);
}
if(!is_uploaded_file($_FILES[$input]['tmp_name'])){
return array('status'=>'error','error'=>P_Lang('上传失败，临时文件无法写入'));
}
if(!$in = @fopen($_FILES[$input]["tmp_name"], "rb")) {
return array('status'=>'error','error'=>P_Lang('无法打开输入流'));
    }
    while ($buff = fread($in, 4096)) {
    fwrite($out, $buff);
}
@fclose($out);
@fclose($in);
$GLOBALS['app']->lib('file')->mv($out_tmpfile.'.parttmp',$out_tmpfile.'.part');
$index = 0;
$done = true;
for($index=0;$index<$chunks;$index++) {
    if (!file_exists($this->dir_root.'data/cache/'.$tmpid.'_'.$index.".part") ) {
        $done = false;
        break;
    }
}
if(!$done){
return array('status'=>'error','error'=>'上传的文件异常');
}
$outfile = $this->folder.$basename.'.'.$ext;
    if(!$out = @fopen($this->dir_root.$outfile,"wb")) {
    return array('status'=>'error','error'=>P_Lang('无法打开输出流'));
    }
    if(flock($out,LOCK_EX)){
        for($index=0;$index<$chunks;$index++) {
            if (!$in = @fopen($this->dir_root.'data/cache/'.$tmpid.'_'.$index.'.part','rb')){
                break;
            }
            while ($buff = fread($in, 4096)) {
                fwrite($out, $buff);
            }
            @fclose($in);
            $GLOBALS['app']->lib('file')->rm($this->dir_root.'data/cache/'.$tmpid."_".$index.".part");
        }
        flock($out,LOCK_UN);
    }
    @fclose($out);
    $tmpname = $GLOBALS['app']->lib('string')->to_utf8($tmpname);
    $title = str_replace(".".$ext,'',$tmpname);
    return array('title'=>$title,'ext'=>$ext,'filename'=>$outfile,'folder'=>$this->folder,'status'=>'ok');
}

private function file_ext($tmpname)
{
$ext = pathinfo($tmpname,PATHINFO_EXTENSION);
if(!$ext){
return false;
}
$ext = strtolower($ext);
$cate_exts = ($this->cate && $this->cate['filetypes']) ? explode(",",$this->cate['filetypes']) : array('jpg','gif','png');
if(!in_array($ext,$cate_exts)){
return false;
}
return $ext;
}

function save($data,$id=0)
{
if(!$data || !is_array($data)) return false;
if($id){
return $this->db->update_array($data,"res",array("id"=>$id));
}else{
return $this->db->insert_array($data,"res");
}
}

public function insert_array($data,$tbl,$type="insert")
{
if(!$tbl || !$data || !is_array($data)){
return false;
}
if(substr($tbl,0,strlen($this->prefix)) != $this->prefix){
$tbl = $this->prefix.$tbl;
}
$type = strtolower($type);
$sql = $type == 'insert' ? "INSERT" : "REPLACE";
$sql.= " INTO ".$tbl." ";
$sql_fields = array();
$sql_val = array();
foreach($data AS $key=>$value){
$sql_fields[] = "`".$key."`";
$sql_val[] = "'".$value."'";
}
$sql.= "(".(implode(",",$sql_fields)).") VALUES(".(implode(",",$sql_val)).")";
return $this->insert($sql);
}

public function replace_f()
{
if(!$this->site['upload_guest']){
$this->json(P_Lang('系统已禁止游客上传，请联系管理员'));
}
$id = $this->get("oldid",'int');
if(!$id)
{
$this->json(P_Lang('没有指定要替换的附件'));
}
$old_rs = $this->model('res')->get_one($id);
if(!$old_rs){
$this->json(P_Lang('资源不存在'));
}
$rs = $this->lib('upload')->upload('upfile');
if($rs["status"] != "ok")
{
$this->json(P_Lang('附件上传失败'));
}
$arraylist = array("jpg","gif","png","jpeg");
$my_ext = array();
if(in_array($rs["ext"],$arraylist))
{
$img_ext = getimagesize($rs["filename"]);
$my_ext["width"] = $img_ext[0];
$my_ext["height"] = $img_ext[1];
}
//替换资源
$this->lib('file')->mv($rs["filename"],$old_rs["filename"]);
$tmp = array("addtime"=>$this->time);
$tmp["attr"] = serialize($my_ext);
$this->model('res')->save($tmp,$id);
//更新附件扩展信息
$this->model('res')->gd_update($id);
$rs = $this->model('res')->get_one($id);
$this->json($rs,true);
}

/**
 * 文件移动操作
 * @参数 $old 旧文件（夹）
 * @参数 $new 新文件（夹）
 * @参数 $recover 是否覆盖
 * @返回 false/true
**/
public function mv($old,$new,$recover=true)
{
if(!file_exists($old)){
return false;
}
if(substr($new,-1) == "/"){
$this->make($new,"dir"); //创建文件夹
}else{
$this->make($new,"file"); //创建文件
}
if(file_exists($new)){
if($recover){
unlink($new);
}else{
return false;
}
}else{
$new = $new.basename($old);
}
rename($old,$new);
return true;
}