This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | //验证密码 |
||
4 | $password = "pwd"; |
||
5 | |||
6 | ?> |
||
7 | <html> |
||
8 | <head> |
||
9 | <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> |
||
10 | <title>在线ZIP解压程序</title> |
||
11 | <style type="text/css"> |
||
12 | <!-- |
||
13 | body, td { |
||
14 | font-size: 14px; |
||
15 | color: #000000; |
||
16 | } |
||
17 | |||
18 | a { |
||
19 | color: #000066; |
||
20 | text-decoration: none; |
||
21 | } |
||
22 | |||
23 | a:hover { |
||
24 | color: #FF6600; |
||
25 | text-decoration: underline; |
||
26 | } |
||
27 | |||
28 | --> |
||
29 | </style> |
||
30 | </head> |
||
31 | |||
32 | <body> |
||
33 | <form name="myform" method="post" action="<?= $_SERVER[PHP_SELF]; ?>" enctype="multipart/form-data" onSubmit="return check_uploadObject(this);"> |
||
34 | <? |
||
35 | if (!$_REQUEST["myaction"]): |
||
36 | ?> |
||
37 | |||
38 | <script language="javascript"> |
||
39 | function check_uploadObject(form) { |
||
40 | if (form.password.value == '') { |
||
41 | alert('请输入密码.'); |
||
42 | return false; |
||
43 | } |
||
44 | return true; |
||
45 | } |
||
46 | </script> |
||
47 | |||
48 | <table width="100%" border="0" cellspacing="0" cellpadding="4"> |
||
49 | <tr> |
||
50 | <td height="40" colspan="2" style="color:#FF9900"><p><font color="#FF0000">在线解压ZIP文件程序</font></p> |
||
51 | <p>使用方法:把zip文件通过FTP上传到本文件相同的目录下,选择zip文件;或直接点击“浏览...”上传zip文件。</p> |
||
52 | <p>解压的结果保留原来的目录结构。</p> |
||
53 | <p> </p></td> |
||
54 | </tr> |
||
55 | <tr> |
||
56 | <td width="11%">选择ZIP文件:</td> |
||
57 | <td width="89%"><select name="zipfile"> |
||
58 | <option value="" selected>- 请选择 -</option> |
||
59 | <? |
||
60 | $fdir = opendir('./'); |
||
61 | while ($file = readdir($fdir)) { |
||
62 | if (!is_file($file)) { |
||
63 | continue; |
||
64 | } |
||
65 | if (preg_match('/\.zip$/mis', $file)) { |
||
66 | echo "<option value='$file'>$file</option>\r\n"; |
||
67 | } |
||
68 | } |
||
69 | ?> |
||
70 | </select></td> |
||
71 | </tr> |
||
72 | <tr> |
||
73 | <td width="11%" nowrap>或上传文件:</td> |
||
74 | <td width="89%"><input name="upfile" type="file" id="upfile" size="20"></td> |
||
75 | </tr> |
||
76 | <tr> |
||
77 | <td>解压到目录:</td> |
||
78 | <td><input name="todir" type="text" id="todir" value="__unzipfiles__" size="15"> |
||
79 | (留空为本目录,必须有写入权限) |
||
80 | </td> |
||
81 | </tr> |
||
82 | <tr> |
||
83 | <td>验证密码:</td> |
||
84 | <td><input name="password" type="password" id="password" size="15"> |
||
85 | (源文件中设定的密码) |
||
86 | </td> |
||
87 | </tr> |
||
88 | <tr> |
||
89 | <td><input name="myaction" type="hidden" id="myaction" value="dounzip"></td> |
||
90 | <td><input type="submit" name="Submit" value=" 解 压 "></td> |
||
91 | </tr> |
||
92 | </table> |
||
93 | |||
94 | <? |
||
95 | |||
96 | elseif ($_REQUEST["myaction"] === "dounzip"): |
||
97 | |||
98 | /** |
||
99 | * Class zip |
||
100 | */ |
||
101 | class zip |
||
102 | { |
||
103 | |||
104 | var $total_files = 0; |
||
105 | var $total_folders = 0; |
||
106 | |||
107 | /** |
||
108 | * @param $zn |
||
109 | * @param $to |
||
110 | * @param array $index |
||
111 | * @return int |
||
112 | */ |
||
113 | function Extract($zn, $to, $index = Array(-1)) |
||
114 | { |
||
115 | $ok = 0; |
||
116 | $zip = @fopen($zn, 'rb'); |
||
117 | if (!$zip) { |
||
118 | return (-1); |
||
119 | } |
||
120 | $cdir = $this->ReadCentralDir($zip, $zn); |
||
121 | $pos_entry = $cdir['offset']; |
||
122 | |||
123 | if (!is_array($index)) { |
||
124 | $index = array($index); |
||
125 | } |
||
126 | for ($i = 0; $index[$i]; $i++) { |
||
127 | if ((int)($index[$i]) != $index[$i] || $index[$i] > $cdir['entries']) { |
||
128 | return (-1); |
||
129 | } |
||
130 | } |
||
131 | for ($i = 0; $i < $cdir['entries']; $i++) { |
||
132 | @fseek($zip, $pos_entry); |
||
133 | $header = $this->ReadCentralFileHeaders($zip); |
||
134 | $header['index'] = $i; |
||
135 | $pos_entry = ftell($zip); |
||
136 | @rewind($zip); |
||
137 | fseek($zip, $header['offset']); |
||
138 | if (in_array("-1", $index) || in_array($i, $index)) { |
||
139 | $stat[$header['filename']] = $this->ExtractFile($header, $to, $zip); |
||
140 | } |
||
141 | } |
||
142 | fclose($zip); |
||
143 | |||
144 | return $stat; |
||
145 | } |
||
146 | |||
147 | /** |
||
148 | * @param $zip |
||
149 | * @return mixed |
||
150 | */ |
||
151 | function ReadFileHeader($zip) |
||
152 | { |
||
153 | $binary_data = fread($zip, 30); |
||
154 | $data = unpack('vchk/vid/vversion/vflag/vcompression/vmtime/vmdate/Vcrc/Vcompressed_size/Vsize/vfilename_len/vextra_len', $binary_data); |
||
155 | |||
156 | $header['filename'] = fread($zip, $data['filename_len']); |
||
157 | View Code Duplication | if ($data['extra_len'] != 0) { |
|
0 ignored issues
–
show
|
|||
158 | $header['extra'] = fread($zip, $data['extra_len']); |
||
159 | } else { |
||
160 | $header['extra'] = ''; |
||
161 | } |
||
162 | |||
163 | $header['compression'] = $data['compression']; |
||
164 | $header['size'] = $data['size']; |
||
165 | $header['compressed_size'] = $data['compressed_size']; |
||
166 | $header['crc'] = $data['crc']; |
||
167 | $header['flag'] = $data['flag']; |
||
168 | $header['mdate'] = $data['mdate']; |
||
169 | $header['mtime'] = $data['mtime']; |
||
170 | |||
171 | View Code Duplication | if ($header['mdate'] && $header['mtime']) { |
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
172 | $hour = ($header['mtime'] & 0xF800) >> 11; |
||
173 | $minute = ($header['mtime'] & 0x07E0) >> 5; |
||
174 | $seconde = ($header['mtime'] & 0x001F) * 2; |
||
175 | $year = (($header['mdate'] & 0xFE00) >> 9) + 1980; |
||
176 | $month = ($header['mdate'] & 0x01E0) >> 5; |
||
177 | $day = $header['mdate'] & 0x001F; |
||
178 | $header['mtime'] = mktime($hour, $minute, $seconde, $month, $day, $year); |
||
179 | } else { |
||
180 | $header['mtime'] = time(); |
||
181 | } |
||
182 | |||
183 | $header['stored_filename'] = $header['filename']; |
||
184 | $header['status'] = "ok"; |
||
185 | |||
186 | return $header; |
||
187 | } |
||
188 | |||
189 | /** |
||
190 | * @param $zip |
||
191 | * @return array |
||
192 | */ |
||
193 | function ReadCentralFileHeaders($zip) |
||
194 | { |
||
195 | $binary_data = fread($zip, 46); |
||
196 | $header = unpack('vchkid/vid/vversion/vversion_extracted/vflag/vcompression/vmtime/vmdate/Vcrc/Vcompressed_size/Vsize/vfilename_len/vextra_len/vcomment_len/vdisk/vinternal/Vexternal/Voffset', $binary_data); |
||
197 | |||
198 | if ($header['filename_len'] != 0) { |
||
199 | $header['filename'] = fread($zip, $header['filename_len']); |
||
200 | } else { |
||
201 | $header['filename'] = ''; |
||
202 | } |
||
203 | |||
204 | View Code Duplication | if ($header['extra_len'] != 0) { |
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
205 | $header['extra'] = fread($zip, $header['extra_len']); |
||
206 | } else { |
||
207 | $header['extra'] = ''; |
||
208 | } |
||
209 | |||
210 | if ($header['comment_len'] != 0) { |
||
211 | $header['comment'] = fread($zip, $header['comment_len']); |
||
212 | } else { |
||
213 | $header['comment'] = ''; |
||
214 | } |
||
215 | |||
216 | View Code Duplication | if ($header['mdate'] && $header['mtime']) { |
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
217 | $hour = ($header['mtime'] & 0xF800) >> 11; |
||
218 | $minute = ($header['mtime'] & 0x07E0) >> 5; |
||
219 | $seconde = ($header['mtime'] & 0x001F) * 2; |
||
220 | $year = (($header['mdate'] & 0xFE00) >> 9) + 1980; |
||
221 | $month = ($header['mdate'] & 0x01E0) >> 5; |
||
222 | $day = $header['mdate'] & 0x001F; |
||
223 | $header['mtime'] = mktime($hour, $minute, $seconde, $month, $day, $year); |
||
224 | } else { |
||
225 | $header['mtime'] = time(); |
||
226 | } |
||
227 | $header['stored_filename'] = $header['filename']; |
||
228 | $header['status'] = 'ok'; |
||
229 | if (substr($header['filename'], -1) === '/') { |
||
230 | $header['external'] = 0x41FF0010; |
||
231 | } |
||
232 | |||
233 | return $header; |
||
234 | } |
||
235 | |||
236 | /** |
||
237 | * @param $zip |
||
238 | * @param $zip_name |
||
239 | * @return mixed |
||
240 | */ |
||
241 | function ReadCentralDir($zip, $zip_name) |
||
242 | { |
||
243 | $size = filesize($zip_name); |
||
244 | |||
245 | if ($size < 277) { |
||
246 | $maximum_size = $size; |
||
247 | } else { |
||
248 | $maximum_size = 277; |
||
249 | } |
||
250 | |||
251 | @fseek($zip, $size - $maximum_size); |
||
252 | $pos = ftell($zip); |
||
253 | $bytes = 0x00000000; |
||
254 | |||
255 | while ($pos < $size) { |
||
256 | $byte = @fread($zip, 1); |
||
257 | $bytes = ($bytes << 8) | ord($byte); |
||
258 | if ($bytes == 0x504b0506 or $bytes == 0x2e706870504b0506) { |
||
259 | $pos++; |
||
260 | break; |
||
261 | } |
||
262 | $pos++; |
||
263 | } |
||
264 | |||
265 | $fdata = fread($zip, 18); |
||
266 | |||
267 | $data = @unpack('vdisk/vdisk_start/vdisk_entries/ventries/Vsize/Voffset/vcomment_size', $fdata); |
||
268 | |||
269 | if ($data['comment_size'] != 0) { |
||
270 | $centd['comment'] = fread($zip, $data['comment_size']); |
||
271 | } else { |
||
272 | $centd['comment'] = ''; |
||
273 | } |
||
274 | $centd['entries'] = $data['entries']; |
||
275 | $centd['disk_entries'] = $data['disk_entries']; |
||
276 | $centd['offset'] = $data['offset']; |
||
277 | $centd['disk_start'] = $data['disk_start']; |
||
278 | $centd['size'] = $data['size']; |
||
279 | $centd['disk'] = $data['disk']; |
||
280 | |||
281 | return $centd; |
||
282 | } |
||
283 | |||
284 | /** |
||
285 | * @param $header |
||
286 | * @param $to |
||
287 | * @param $zip |
||
288 | * @return bool|void |
||
289 | */ |
||
290 | function ExtractFile($header, $to, $zip) |
||
291 | { |
||
292 | $header = $this->readfileheader($zip); |
||
293 | |||
294 | if (substr($to, -1) !== "/") { |
||
295 | $to .= "/"; |
||
296 | } |
||
297 | if ($to === './') { |
||
298 | $to = ''; |
||
299 | } |
||
300 | $pth = explode("/", $to . $header['filename']); |
||
301 | $mydir = ''; |
||
302 | for ($i = 0; $i < count($pth) - 1; $i++) { |
||
303 | if (!$pth[$i]) { |
||
304 | continue; |
||
305 | } |
||
306 | $mydir .= $pth[$i] . "/"; |
||
307 | if ((!is_dir($mydir) && @mkdir($mydir, 0777)) || (($mydir == $to . $header['filename'] || ($mydir == $to && $this->total_folders == 0)) && is_dir($mydir))) { |
||
308 | @chmod($mydir, 0777); |
||
309 | $this->total_folders++; |
||
310 | echo "<input name='dfile[]' type='checkbox' value='$mydir' checked> <a href='$mydir' target='_blank'>目录: $mydir</a><br>"; |
||
311 | } |
||
312 | } |
||
313 | |||
314 | if (strrchr($header['filename'], '/') === '/') { |
||
315 | return; |
||
316 | } |
||
317 | |||
318 | if (!($header['external'] == 0x41FF0010) && !($header['external'] == 16)) { |
||
319 | if ($header['compression'] == 0) { |
||
320 | $fp = @fopen($to . $header['filename'], 'wb'); |
||
321 | if (!$fp) { |
||
322 | return (-1); |
||
323 | } |
||
324 | $size = $header['compressed_size']; |
||
325 | |||
326 | View Code Duplication | while ($size != 0) { |
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
327 | $read_size = ($size < 2048 ? $size : 2048); |
||
328 | $buffer = fread($zip, $read_size); |
||
329 | $binary_data = pack('a' . $read_size, $buffer); |
||
330 | @fwrite($fp, $binary_data, $read_size); |
||
331 | $size -= $read_size; |
||
332 | } |
||
333 | fclose($fp); |
||
334 | touch($to . $header['filename'], $header['mtime']); |
||
335 | } else { |
||
336 | $fp = @fopen($to . $header['filename'] . '.gz', 'wb'); |
||
337 | if (!$fp) { |
||
338 | return (-1); |
||
339 | } |
||
340 | $binary_data = pack('va1a1Va1a1', 0x8b1f, Chr($header['compression']), Chr(0x00), time(), Chr(0x00), Chr(3)); |
||
341 | |||
342 | fwrite($fp, $binary_data, 10); |
||
343 | $size = $header['compressed_size']; |
||
344 | |||
345 | View Code Duplication | while ($size != 0) { |
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
346 | $read_size = ($size < 1024 ? $size : 1024); |
||
347 | $buffer = fread($zip, $read_size); |
||
348 | $binary_data = pack('a' . $read_size, $buffer); |
||
349 | @fwrite($fp, $binary_data, $read_size); |
||
350 | $size -= $read_size; |
||
351 | } |
||
352 | |||
353 | $binary_data = pack('VV', $header['crc'], $header['size']); |
||
354 | fwrite($fp, $binary_data, 8); |
||
355 | fclose($fp); |
||
356 | |||
357 | $gzp = @gzopen($to . $header['filename'] . '.gz', 'rb') or die("Cette archive est compress閑"); |
||
358 | if (!$gzp) { |
||
359 | return (-2); |
||
360 | } |
||
361 | $fp = @fopen($to . $header['filename'], 'wb'); |
||
362 | if (!$fp) { |
||
363 | return (-1); |
||
364 | } |
||
365 | $size = $header['size']; |
||
366 | |||
367 | View Code Duplication | while ($size != 0) { |
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
368 | $read_size = ($size < 2048 ? $size : 2048); |
||
369 | $buffer = gzread($gzp, $read_size); |
||
370 | $binary_data = pack('a' . $read_size, $buffer); |
||
371 | @fwrite($fp, $binary_data, $read_size); |
||
372 | $size -= $read_size; |
||
373 | } |
||
374 | fclose($fp); |
||
375 | gzclose($gzp); |
||
376 | |||
377 | touch($to . $header['filename'], $header['mtime']); |
||
378 | @unlink($to . $header['filename'] . '.gz'); |
||
379 | |||
380 | } |
||
381 | } |
||
382 | |||
383 | $this->total_files++; |
||
384 | echo "<input name='dfile[]' type='checkbox' value='$to$header[filename]' checked> <a href='$to$header[filename]' target='_blank'>文件: $to$header[filename]</a><br>"; |
||
385 | |||
386 | return true; |
||
387 | } |
||
388 | |||
389 | // end class |
||
390 | } |
||
391 | |||
392 | set_time_limit(0); |
||
393 | |||
394 | if ($_POST['password'] != $password) { |
||
395 | die("输入的密码不正确,请重新输入。"); |
||
396 | } |
||
397 | if (!$_POST["todir"]) { |
||
398 | $_POST["todir"] = "."; |
||
399 | } |
||
400 | $z = new Zip; |
||
401 | $have_zip_file = 0; |
||
402 | /** |
||
403 | * @param $tmp_name |
||
404 | * @param $new_name |
||
405 | * @param $checked |
||
406 | */ |
||
407 | function start_unzip($tmp_name, $new_name, $checked) |
||
408 | { |
||
409 | global $_POST, $z, $have_zip_file; |
||
410 | $upfile = array("tmp_name" => $tmp_name, "name" => $new_name); |
||
411 | if (is_file($upfile[tmp_name])) { |
||
412 | $have_zip_file = 1; |
||
413 | echo "<br>正在解压: <input name='dfile[]' type='checkbox' value='$upfile[name]' " . ($checked ? "checked" : "") . "> $upfile[name]<br><br>"; |
||
414 | if (preg_match('/\.zip$/mis', $upfile[name])) { |
||
415 | $result = $z->Extract($upfile[tmp_name], $_POST["todir"]); |
||
416 | if ($result == -1) { |
||
417 | echo "<br>文件 $upfile[name] 错误.<br>"; |
||
418 | } |
||
419 | echo "<br>完成,共建立 $z->total_folders 个目录,$z->total_files 个文件.<br><br><br>"; |
||
420 | } else { |
||
421 | echo "<br>$upfile[name] 不是 zip 文件.<br><br>"; |
||
422 | } |
||
423 | if (realpath($upfile[name]) != realpath($upfile[tmp_name])) { |
||
424 | @unlink($upfile[name]); |
||
425 | rename($upfile[tmp_name], $upfile[name]); |
||
426 | } |
||
427 | } |
||
428 | } |
||
429 | |||
430 | clearstatcache(); |
||
431 | |||
432 | start_unzip($_POST["zipfile"], $_POST["zipfile"], 0); |
||
433 | start_unzip($_FILES["upfile"][tmp_name], $_FILES["upfile"][name], 1); |
||
434 | |||
435 | if (!$have_zip_file) { |
||
436 | echo "<br>请选择或上传文件.<br>"; |
||
437 | } |
||
438 | ?> |
||
439 | <input name="password" type="hidden" id="password" value="<?= $_POST['password']; ?>"> |
||
440 | <input name="myaction" type="hidden" id="myaction" value="dodelete"> |
||
441 | <input name="按钮" type="button" value="返回" onClick="window.location='<?= $_SERVER[PHP_SELF]; ?>';"> |
||
442 | |||
443 | <input type='button' value='反选' onclick='selrev();'> <input type='submit' onclick='return confirm("删除选定文件?");' value='删除选定'> |
||
444 | |||
445 | <script language='javascript'> |
||
446 | function selrev() { |
||
447 | with (document.myform) { |
||
448 | for (i = 0; i < elements.length; i++) { |
||
449 | thiselm = elements[i]; |
||
450 | if (thiselm.name.match(/dfile\[]/)) thiselm.checked = !thiselm.checked; |
||
451 | } |
||
452 | } |
||
453 | } |
||
454 | alert('完成.'); |
||
455 | </script> |
||
456 | <? |
||
457 | |||
458 | elseif ($_REQUEST["myaction"] === "dodelete"): |
||
459 | set_time_limit(0); |
||
460 | if ($_POST['password'] != $password) { |
||
461 | die("输入的密码不正确,请重新输入。"); |
||
462 | } |
||
463 | |||
464 | $dfile = $_POST["dfile"]; |
||
465 | echo "正在删除文件...<br><br>"; |
||
466 | if (is_array($dfile)) { |
||
467 | for ($i = count($dfile) - 1; $i >= 0; $i--) { |
||
468 | if (is_file($dfile[$i])) { |
||
469 | if (@unlink($dfile[$i])) { |
||
470 | echo "已删除文件: $dfile[$i]<br>"; |
||
471 | } else { |
||
472 | echo "删除文件失败: $dfile[$i]<br>"; |
||
473 | } |
||
474 | } else { |
||
475 | if (@rmdir($dfile[$i])) { |
||
476 | echo "已删除目录: $dfile[$i]<br>"; |
||
477 | } else { |
||
478 | echo "删除目录失败: $dfile[$i]<br>"; |
||
479 | } |
||
480 | } |
||
481 | |||
482 | } |
||
483 | } |
||
484 | echo "<br>完成.<br><br><input type='button' value='返回' onclick=\"window.location='$_SERVER[PHP_SELF]';\"><br><br> |
||
485 | <script language='javascript'>('完成.');</script>"; |
||
486 | |||
487 | endif; |
||
488 | |||
489 | ?> |
||
490 | </form> |
||
491 | </body> |
||
492 | </html> |
||
493 |
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.