WooYun.org

function initupload($module, $catid,$args, $userid, $groupid = '8', $isadmin = '0',$userid_flash='0'){


        $grouplist = getcache('grouplist','member');


        if($isadmin==0 && !$grouplist[$groupid]['allowattachment']) return false;


        extract(getswfinit($args));


        $siteid = param::get_cookie('siteid');


        $site_setting = get_site_setting($siteid);


        $file_size_limit = $site_setting['upload_maxsize'];


        $sess_id = SYS_TIME;


        $admin_url = pc_base::load_config('system','admin_url');


        $upload_path = empty($admin_url) ? APP_PATH : 'http://'.$admin_url.'/';


        $swf_auth_key = md5(pc_base::load_config('system','auth_key').$sess_id);


        $init =  'var swfu = \'\';


        $(document).ready(function(){


        swfu = new SWFUpload({


            flash_url:"'.JS_PATH.'swfupload/swfupload.swf?"+Math.random(),


            upload_url:"'.$upload_path.'index.php?m=attachment&c=attachments&a=swfupload&dosubmit=1",


            file_post_name : "Filedata",


            post_params:{"SWFUPLOADSESSID":"'.$sess_id.'","module":"'.$module.'","catid":"'.$_GET['catid'].'","userid":"'.$userid.'","siteid":"'.$siteid.'","dosubmit":"1","thumb_width":"'.$thumb_width.'","thumb_height":"'.$thumb_height.'","watermark_enable":"'.$watermark_enable.'","filetype_post":"'.$file_types_post.'","swf_auth_key":"'.$swf_auth_key.'","isadmin":"'.$isadmin.'","groupid":"'.$groupid.'","userid_flash":"'.$userid_flash.'"},


            file_size_limit:"'.$file_size_limit.'",


            file_types:"'.$file_types.'",


            file_types_description:"All Files",


            file_upload_limit:"'.$file_upload_limit.'",


            custom_settings : {progressTarget : "fsUploadProgress",cancelButtonId : "btnCancel"},


     


            button_image_url: "",


            button_width: 75,


            button_height: 28,


            button_placeholder_id: "buttonPlaceHolder",


            button_text_style: "",


            button_text_top_padding: 3,


            button_text_left_padding: 12,


            button_window_mode: SWFUpload.WINDOW_MODE.TRANSPARENT,


            button_cursor: SWFUpload.CURSOR.HAND,





            file_dialog_start_handler : fileDialogStart,


            file_queued_handler : fileQueued,


            file_queue_error_handler:fileQueueError,


            file_dialog_complete_handler:fileDialogComplete,


            upload_progress_handler:uploadProgress,


            upload_error_handler:uploadError,


            upload_success_handler:uploadSuccess,


            upload_complete_handler:uploadComplete


            });


        })';


        return $init;


    }

<?php echo initupload($_GET['module'],$_GET['catid'],$args,$this->userid,$this->groupid,$this->isadmin,$userid_flash)?>

public function download() {


        $a_k = trim($_GET['a_k']);


        if(empty($_SERVER['HTTP_USER_AGENT'])){


            $pc_auth_key = md5(pc_base::load_config('system','auth_key').'down');


        }else{


            $pc_auth_key = md5(pc_base::load_config('system','auth_key').$_SERVER['HTTP_USER_AGENT']);//修改UA为$sess_id


        }


        $a_k = sys_auth($a_k, 'DECODE', $pc_auth_key);//$pc_auth_key为前面获取到的$swf_auth_key


        if(empty($a_k)) showmessage(L('illegal_parameters'));


        unset($i,$m,$f,$t,$ip);


        parse_str($a_k);        


        if(isset($i)) $downid = intval($i);


        if(!isset($m)) showmessage(L('illegal_parameters'));


        if(!isset($modelid)) showmessage(L('illegal_parameters'));


        if(empty($f)) showmessage(L('url_invalid'));


        if(!$i || $m<0) showmessage(L('illegal_parameters'));


        if(!isset($t)) showmessage(L('illegal_parameters'));


        if(!isset($ip)) showmessage(L('illegal_parameters'));


        $starttime = intval($t);


        if(preg_match('/(php|phtml|php3|php4|jsp|dll|asp|cer|asa|shtml|shtm|aspx|asax|cgi|fcgi|pl)(\.|$)/i',$f) || strpos($f, ":\\")!==FALSE || strpos($f,'..')!==FALSE) showmessage(L('url_error'));


        $fileurl = trim($f);


        if(!$downid || empty($fileurl) || !preg_match("/[0-9]{10}/", $starttime) || !preg_match("/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/", $ip) || $ip != ip()) showmessage(L('illegal_parameters'));    


        $endtime = SYS_TIME - $starttime;


        if($endtime > 3600) showmessage(L('url_invalid'));


        if($m) $fileurl = trim($s).trim($fileurl);//对$s没有过滤，可以将路径拆成两部分来绕过检查


        //远程文件


        if(strpos($fileurl, ':/') && (strpos($fileurl, pc_base::load_config('system','upload_url')) === false)) { 


            header("Location: $fileurl");


        } else {


            if($d == 0) {


                header("Location: ".$fileurl);


            } else {


                $fileurl = str_replace(array(pc_base::load_config('system','upload_url'),'/'), array(pc_base::load_config('system','upload_path'),DIRECTORY_SEPARATOR), $fileurl);


                $filename = basename($fileurl);


                //处理中文文件


                if(preg_match("/^([\s\S]*?)([\x81-\xfe][\x40-\xfe])([\s\S]*?)/", $fileurl)) {


                    $filename = str_replace(array("%5C", "%2F", "%3A"), array("\\", "/", ":"), urlencode($fileurl));


                    $filename = urldecode(basename($filename));


                }


                $ext = fileext($filename);


                $filename = date('Ymd_his').random(3).'.'.$ext;


                file_down($fileurl, $filename);//readfile读取文件输出


            }


        }


    }