mambax7 /
xoops-martin
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | //验证密码 |
||
| 4 | $password = "pwd"; |
||
| 5 | |||
| 6 | ?> |
||
| 7 | <html> |
||
| 8 | <head> |
||
| 9 | <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> |
||
| 10 | <title>在线ZIP解压程序</title> |
||
| 11 | <style type="text/css"> |
||
| 12 | <!-- |
||
| 13 | body, td { |
||
| 14 | font-size: 14px; |
||
| 15 | color: #000000; |
||
| 16 | } |
||
| 17 | |||
| 18 | a { |
||
| 19 | color: #000066; |
||
| 20 | text-decoration: none; |
||
| 21 | } |
||
| 22 | |||
| 23 | a:hover { |
||
| 24 | color: #FF6600; |
||
| 25 | text-decoration: underline; |
||
| 26 | } |
||
| 27 | |||
| 28 | --> |
||
| 29 | </style> |
||
| 30 | </head> |
||
| 31 | |||
| 32 | <body> |
||
| 33 | <form name="myform" method="post" action="<?= $_SERVER[PHP_SELF]; ?>" enctype="multipart/form-data" onSubmit="return check_uploadObject(this);"> |
||
| 34 | <? |
||
|
0 ignored issues
–
show
|
|||
| 35 | if (!$_REQUEST["myaction"]): |
||
| 36 | ?> |
||
| 37 | |||
| 38 | <script language="javascript"> |
||
| 39 | function check_uploadObject(form) { |
||
| 40 | if (form.password.value == '') { |
||
| 41 | alert('请输入密码.'); |
||
| 42 | return false; |
||
| 43 | } |
||
| 44 | return true; |
||
| 45 | } |
||
| 46 | </script> |
||
| 47 | |||
| 48 | <table width="100%" border="0" cellspacing="0" cellpadding="4"> |
||
| 49 | <tr> |
||
| 50 | <td height="40" colspan="2" style="color:#FF9900"><p><font color="#FF0000">在线解压ZIP文件程序</font></p> |
||
| 51 | <p>使用方法:把zip文件通过FTP上传到本文件相同的目录下,选择zip文件;或直接点击“浏览...”上传zip文件。</p> |
||
| 52 | <p>解压的结果保留原来的目录结构。</p> |
||
| 53 | <p> </p></td> |
||
| 54 | </tr> |
||
| 55 | <tr> |
||
| 56 | <td width="11%">选择ZIP文件:</td> |
||
| 57 | <td width="89%"><select name="zipfile"> |
||
| 58 | <option value="" selected>- 请选择 -</option> |
||
| 59 | <? |
||
| 60 | $fdir = opendir('./'); |
||
| 61 | while ($file = readdir($fdir)) { |
||
| 62 | if (!is_file($file)) { |
||
| 63 | continue; |
||
| 64 | } |
||
| 65 | if (preg_match('/\.zip$/mis', $file)) { |
||
| 66 | echo "<option value='$file'>$file</option>\r\n"; |
||
| 67 | } |
||
| 68 | } |
||
| 69 | ?> |
||
| 70 | </select></td> |
||
| 71 | </tr> |
||
| 72 | <tr> |
||
| 73 | <td width="11%" nowrap>或上传文件:</td> |
||
| 74 | <td width="89%"><input name="upfile" type="file" id="upfile" size="20"></td> |
||
| 75 | </tr> |
||
| 76 | <tr> |
||
| 77 | <td>解压到目录:</td> |
||
| 78 | <td><input name="todir" type="text" id="todir" value="__unzipfiles__" size="15"> |
||
| 79 | (留空为本目录,必须有写入权限) |
||
| 80 | </td> |
||
| 81 | </tr> |
||
| 82 | <tr> |
||
| 83 | <td>验证密码:</td> |
||
| 84 | <td><input name="password" type="password" id="password" size="15"> |
||
| 85 | (源文件中设定的密码) |
||
| 86 | </td> |
||
| 87 | </tr> |
||
| 88 | <tr> |
||
| 89 | <td><input name="myaction" type="hidden" id="myaction" value="dounzip"></td> |
||
| 90 | <td><input type="submit" name="Submit" value=" 解 压 "></td> |
||
| 91 | </tr> |
||
| 92 | </table> |
||
| 93 | |||
| 94 | <? |
||
| 95 | |||
| 96 | elseif ($_REQUEST["myaction"] === "dounzip"): |
||
| 97 | |||
| 98 | /** |
||
| 99 | * Class zip |
||
| 100 | */ |
||
| 101 | class zip |
||
| 102 | { |
||
| 103 | |||
| 104 | var $total_files = 0; |
||
| 105 | var $total_folders = 0; |
||
| 106 | |||
| 107 | /** |
||
| 108 | * @param $zn |
||
| 109 | * @param $to |
||
| 110 | * @param array $index |
||
| 111 | * @return int |
||
| 112 | */ |
||
| 113 | function Extract($zn, $to, $index = Array(-1)) |
||
| 114 | { |
||
| 115 | $ok = 0; |
||
| 116 | $zip = @fopen($zn, 'rb'); |
||
| 117 | if (!$zip) { |
||
| 118 | return (-1); |
||
| 119 | } |
||
| 120 | $cdir = $this->ReadCentralDir($zip, $zn); |
||
| 121 | $pos_entry = $cdir['offset']; |
||
| 122 | |||
| 123 | if (!is_array($index)) { |
||
| 124 | $index = array($index); |
||
| 125 | } |
||
| 126 | for ($i = 0; $index[$i]; $i++) { |
||
| 127 | if ((int)($index[$i]) != $index[$i] || $index[$i] > $cdir['entries']) { |
||
| 128 | return (-1); |
||
| 129 | } |
||
| 130 | } |
||
| 131 | for ($i = 0; $i < $cdir['entries']; $i++) { |
||
| 132 | @fseek($zip, $pos_entry); |
||
| 133 | $header = $this->ReadCentralFileHeaders($zip); |
||
| 134 | $header['index'] = $i; |
||
| 135 | $pos_entry = ftell($zip); |
||
| 136 | @rewind($zip); |
||
| 137 | fseek($zip, $header['offset']); |
||
| 138 | if (in_array("-1", $index) || in_array($i, $index)) { |
||
| 139 | $stat[$header['filename']] = $this->ExtractFile($header, $to, $zip); |
||
| 140 | } |
||
| 141 | } |
||
| 142 | fclose($zip); |
||
| 143 | |||
| 144 | return $stat; |
||
| 145 | } |
||
| 146 | |||
| 147 | /** |
||
| 148 | * @param $zip |
||
| 149 | * @return mixed |
||
| 150 | */ |
||
| 151 | function ReadFileHeader($zip) |
||
| 152 | { |
||
| 153 | $binary_data = fread($zip, 30); |
||
| 154 | $data = unpack('vchk/vid/vversion/vflag/vcompression/vmtime/vmdate/Vcrc/Vcompressed_size/Vsize/vfilename_len/vextra_len', $binary_data); |
||
| 155 | |||
| 156 | $header['filename'] = fread($zip, $data['filename_len']); |
||
| 157 | View Code Duplication | if ($data['extra_len'] != 0) { |
|
| 158 | $header['extra'] = fread($zip, $data['extra_len']); |
||
| 159 | } else { |
||
| 160 | $header['extra'] = ''; |
||
| 161 | } |
||
| 162 | |||
| 163 | $header['compression'] = $data['compression']; |
||
| 164 | $header['size'] = $data['size']; |
||
| 165 | $header['compressed_size'] = $data['compressed_size']; |
||
| 166 | $header['crc'] = $data['crc']; |
||
| 167 | $header['flag'] = $data['flag']; |
||
| 168 | $header['mdate'] = $data['mdate']; |
||
| 169 | $header['mtime'] = $data['mtime']; |
||
| 170 | |||
| 171 | View Code Duplication | if ($header['mdate'] && $header['mtime']) { |
|
| 172 | $hour = ($header['mtime'] & 0xF800) >> 11; |
||
| 173 | $minute = ($header['mtime'] & 0x07E0) >> 5; |
||
| 174 | $seconde = ($header['mtime'] & 0x001F) * 2; |
||
| 175 | $year = (($header['mdate'] & 0xFE00) >> 9) + 1980; |
||
| 176 | $month = ($header['mdate'] & 0x01E0) >> 5; |
||
| 177 | $day = $header['mdate'] & 0x001F; |
||
| 178 | $header['mtime'] = mktime($hour, $minute, $seconde, $month, $day, $year); |
||
| 179 | } else { |
||
| 180 | $header['mtime'] = time(); |
||
| 181 | } |
||
| 182 | |||
| 183 | $header['stored_filename'] = $header['filename']; |
||
| 184 | $header['status'] = "ok"; |
||
| 185 | |||
| 186 | return $header; |
||
| 187 | } |
||
| 188 | |||
| 189 | /** |
||
| 190 | * @param $zip |
||
| 191 | * @return array |
||
| 192 | */ |
||
| 193 | function ReadCentralFileHeaders($zip) |
||
| 194 | { |
||
| 195 | $binary_data = fread($zip, 46); |
||
| 196 | $header = unpack('vchkid/vid/vversion/vversion_extracted/vflag/vcompression/vmtime/vmdate/Vcrc/Vcompressed_size/Vsize/vfilename_len/vextra_len/vcomment_len/vdisk/vinternal/Vexternal/Voffset', $binary_data); |
||
| 197 | |||
| 198 | if ($header['filename_len'] != 0) { |
||
| 199 | $header['filename'] = fread($zip, $header['filename_len']); |
||
| 200 | } else { |
||
| 201 | $header['filename'] = ''; |
||
| 202 | } |
||
| 203 | |||
| 204 | View Code Duplication | if ($header['extra_len'] != 0) { |
|
| 205 | $header['extra'] = fread($zip, $header['extra_len']); |
||
| 206 | } else { |
||
| 207 | $header['extra'] = ''; |
||
| 208 | } |
||
| 209 | |||
| 210 | if ($header['comment_len'] != 0) { |
||
| 211 | $header['comment'] = fread($zip, $header['comment_len']); |
||
| 212 | } else { |
||
| 213 | $header['comment'] = ''; |
||
| 214 | } |
||
| 215 | |||
| 216 | View Code Duplication | if ($header['mdate'] && $header['mtime']) { |
|
| 217 | $hour = ($header['mtime'] & 0xF800) >> 11; |
||
| 218 | $minute = ($header['mtime'] & 0x07E0) >> 5; |
||
| 219 | $seconde = ($header['mtime'] & 0x001F) * 2; |
||
| 220 | $year = (($header['mdate'] & 0xFE00) >> 9) + 1980; |
||
| 221 | $month = ($header['mdate'] & 0x01E0) >> 5; |
||
| 222 | $day = $header['mdate'] & 0x001F; |
||
| 223 | $header['mtime'] = mktime($hour, $minute, $seconde, $month, $day, $year); |
||
| 224 | } else { |
||
| 225 | $header['mtime'] = time(); |
||
| 226 | } |
||
| 227 | $header['stored_filename'] = $header['filename']; |
||
| 228 | $header['status'] = 'ok'; |
||
| 229 | if (substr($header['filename'], -1) === '/') { |
||
| 230 | $header['external'] = 0x41FF0010; |
||
| 231 | } |
||
| 232 | |||
| 233 | return $header; |
||
| 234 | } |
||
| 235 | |||
| 236 | /** |
||
| 237 | * @param $zip |
||
| 238 | * @param $zip_name |
||
| 239 | * @return mixed |
||
| 240 | */ |
||
| 241 | function ReadCentralDir($zip, $zip_name) |
||
| 242 | { |
||
| 243 | $size = filesize($zip_name); |
||
| 244 | |||
| 245 | if ($size < 277) { |
||
| 246 | $maximum_size = $size; |
||
| 247 | } else { |
||
| 248 | $maximum_size = 277; |
||
| 249 | } |
||
| 250 | |||
| 251 | @fseek($zip, $size - $maximum_size); |
||
| 252 | $pos = ftell($zip); |
||
| 253 | $bytes = 0x00000000; |
||
| 254 | |||
| 255 | while ($pos < $size) { |
||
| 256 | $byte = @fread($zip, 1); |
||
| 257 | $bytes = ($bytes << 8) | ord($byte); |
||
| 258 | if ($bytes == 0x504b0506 or $bytes == 0x2e706870504b0506) { |
||
| 259 | $pos++; |
||
| 260 | break; |
||
| 261 | } |
||
| 262 | $pos++; |
||
| 263 | } |
||
| 264 | |||
| 265 | $fdata = fread($zip, 18); |
||
| 266 | |||
| 267 | $data = @unpack('vdisk/vdisk_start/vdisk_entries/ventries/Vsize/Voffset/vcomment_size', $fdata); |
||
| 268 | |||
| 269 | if ($data['comment_size'] != 0) { |
||
| 270 | $centd['comment'] = fread($zip, $data['comment_size']); |
||
| 271 | } else { |
||
| 272 | $centd['comment'] = ''; |
||
| 273 | } |
||
| 274 | $centd['entries'] = $data['entries']; |
||
| 275 | $centd['disk_entries'] = $data['disk_entries']; |
||
| 276 | $centd['offset'] = $data['offset']; |
||
| 277 | $centd['disk_start'] = $data['disk_start']; |
||
| 278 | $centd['size'] = $data['size']; |
||
| 279 | $centd['disk'] = $data['disk']; |
||
| 280 | |||
| 281 | return $centd; |
||
| 282 | } |
||
| 283 | |||
| 284 | /** |
||
| 285 | * @param $header |
||
| 286 | * @param $to |
||
| 287 | * @param $zip |
||
| 288 | * @return bool|void |
||
| 289 | */ |
||
| 290 | function ExtractFile($header, $to, $zip) |
||
| 291 | { |
||
| 292 | $header = $this->readfileheader($zip); |
||
| 293 | |||
| 294 | if (substr($to, -1) !== "/") { |
||
| 295 | $to .= "/"; |
||
| 296 | } |
||
| 297 | if ($to === './') { |
||
| 298 | $to = ''; |
||
| 299 | } |
||
| 300 | $pth = explode("/", $to . $header['filename']); |
||
| 301 | $mydir = ''; |
||
| 302 | for ($i = 0; $i < count($pth) - 1; $i++) { |
||
| 303 | if (!$pth[$i]) { |
||
| 304 | continue; |
||
| 305 | } |
||
| 306 | $mydir .= $pth[$i] . "/"; |
||
| 307 | if ((!is_dir($mydir) && @mkdir($mydir, 0777)) || (($mydir == $to . $header['filename'] || ($mydir == $to && $this->total_folders == 0)) && is_dir($mydir))) { |
||
| 308 | @chmod($mydir, 0777); |
||
| 309 | $this->total_folders++; |
||
| 310 | echo "<input name='dfile[]' type='checkbox' value='$mydir' checked> <a href='$mydir' target='_blank'>目录: $mydir</a><br>"; |
||
| 311 | } |
||
| 312 | } |
||
| 313 | |||
| 314 | if (strrchr($header['filename'], '/') === '/') { |
||
| 315 | return; |
||
| 316 | } |
||
| 317 | |||
| 318 | if (!($header['external'] == 0x41FF0010) && !($header['external'] == 16)) { |
||
| 319 | if ($header['compression'] == 0) { |
||
| 320 | $fp = @fopen($to . $header['filename'], 'wb'); |
||
| 321 | if (!$fp) { |
||
| 322 | return (-1); |
||
| 323 | } |
||
| 324 | $size = $header['compressed_size']; |
||
| 325 | |||
| 326 | View Code Duplication | while ($size != 0) { |
|
| 327 | $read_size = ($size < 2048 ? $size : 2048); |
||
| 328 | $buffer = fread($zip, $read_size); |
||
| 329 | $binary_data = pack('a' . $read_size, $buffer); |
||
| 330 | @fwrite($fp, $binary_data, $read_size); |
||
| 331 | $size -= $read_size; |
||
| 332 | } |
||
| 333 | fclose($fp); |
||
| 334 | touch($to . $header['filename'], $header['mtime']); |
||
| 335 | } else { |
||
| 336 | $fp = @fopen($to . $header['filename'] . '.gz', 'wb'); |
||
| 337 | if (!$fp) { |
||
| 338 | return (-1); |
||
| 339 | } |
||
| 340 | $binary_data = pack('va1a1Va1a1', 0x8b1f, Chr($header['compression']), Chr(0x00), time(), Chr(0x00), Chr(3)); |
||
| 341 | |||
| 342 | fwrite($fp, $binary_data, 10); |
||
| 343 | $size = $header['compressed_size']; |
||
| 344 | |||
| 345 | View Code Duplication | while ($size != 0) { |
|
| 346 | $read_size = ($size < 1024 ? $size : 1024); |
||
| 347 | $buffer = fread($zip, $read_size); |
||
| 348 | $binary_data = pack('a' . $read_size, $buffer); |
||
| 349 | @fwrite($fp, $binary_data, $read_size); |
||
| 350 | $size -= $read_size; |
||
| 351 | } |
||
| 352 | |||
| 353 | $binary_data = pack('VV', $header['crc'], $header['size']); |
||
| 354 | fwrite($fp, $binary_data, 8); |
||
| 355 | fclose($fp); |
||
| 356 | |||
| 357 | $gzp = @gzopen($to . $header['filename'] . '.gz', 'rb') or die("Cette archive est compress閑"); |
||
| 358 | if (!$gzp) { |
||
| 359 | return (-2); |
||
| 360 | } |
||
| 361 | $fp = @fopen($to . $header['filename'], 'wb'); |
||
| 362 | if (!$fp) { |
||
| 363 | return (-1); |
||
| 364 | } |
||
| 365 | $size = $header['size']; |
||
| 366 | |||
| 367 | View Code Duplication | while ($size != 0) { |
|
| 368 | $read_size = ($size < 2048 ? $size : 2048); |
||
| 369 | $buffer = gzread($gzp, $read_size); |
||
| 370 | $binary_data = pack('a' . $read_size, $buffer); |
||
| 371 | @fwrite($fp, $binary_data, $read_size); |
||
| 372 | $size -= $read_size; |
||
| 373 | } |
||
| 374 | fclose($fp); |
||
| 375 | gzclose($gzp); |
||
| 376 | |||
| 377 | touch($to . $header['filename'], $header['mtime']); |
||
| 378 | @unlink($to . $header['filename'] . '.gz'); |
||
| 379 | |||
| 380 | } |
||
| 381 | } |
||
| 382 | |||
| 383 | $this->total_files++; |
||
| 384 | echo "<input name='dfile[]' type='checkbox' value='$to$header[filename]' checked> <a href='$to$header[filename]' target='_blank'>文件: $to$header[filename]</a><br>"; |
||
| 385 | |||
| 386 | return true; |
||
| 387 | } |
||
| 388 | |||
| 389 | // end class |
||
| 390 | } |
||
| 391 | |||
| 392 | set_time_limit(0); |
||
| 393 | |||
| 394 | if ($_POST['password'] != $password) { |
||
| 395 | die("输入的密码不正确,请重新输入。"); |
||
| 396 | } |
||
| 397 | if (!$_POST["todir"]) { |
||
| 398 | $_POST["todir"] = "."; |
||
| 399 | } |
||
| 400 | $z = new Zip; |
||
| 401 | $have_zip_file = 0; |
||
| 402 | /** |
||
| 403 | * @param $tmp_name |
||
| 404 | * @param $new_name |
||
| 405 | * @param $checked |
||
| 406 | */ |
||
| 407 | function start_unzip($tmp_name, $new_name, $checked) |
||
| 408 | { |
||
| 409 | global $_POST, $z, $have_zip_file; |
||
| 410 | $upfile = array("tmp_name" => $tmp_name, "name" => $new_name); |
||
| 411 | if (is_file($upfile[tmp_name])) { |
||
| 412 | $have_zip_file = 1; |
||
| 413 | echo "<br>正在解压: <input name='dfile[]' type='checkbox' value='$upfile[name]' " . ($checked ? "checked" : "") . "> $upfile[name]<br><br>"; |
||
| 414 | if (preg_match('/\.zip$/mis', $upfile[name])) { |
||
| 415 | $result = $z->Extract($upfile[tmp_name], $_POST["todir"]); |
||
| 416 | if ($result == -1) { |
||
| 417 | echo "<br>文件 $upfile[name] 错误.<br>"; |
||
| 418 | } |
||
| 419 | echo "<br>完成,共建立 $z->total_folders 个目录,$z->total_files 个文件.<br><br><br>"; |
||
| 420 | } else { |
||
| 421 | echo "<br>$upfile[name] 不是 zip 文件.<br><br>"; |
||
| 422 | } |
||
| 423 | if (realpath($upfile[name]) != realpath($upfile[tmp_name])) { |
||
| 424 | @unlink($upfile[name]); |
||
| 425 | rename($upfile[tmp_name], $upfile[name]); |
||
| 426 | } |
||
| 427 | } |
||
| 428 | } |
||
| 429 | |||
| 430 | clearstatcache(); |
||
| 431 | |||
| 432 | start_unzip($_POST["zipfile"], $_POST["zipfile"], 0); |
||
| 433 | start_unzip($_FILES["upfile"][tmp_name], $_FILES["upfile"][name], 1); |
||
| 434 | |||
| 435 | if (!$have_zip_file) { |
||
| 436 | echo "<br>请选择或上传文件.<br>"; |
||
| 437 | } |
||
| 438 | ?> |
||
| 439 | <input name="password" type="hidden" id="password" value="<?= $_POST['password']; ?>"> |
||
| 440 | <input name="myaction" type="hidden" id="myaction" value="dodelete"> |
||
| 441 | <input name="按钮" type="button" value="返回" onClick="window.location='<?= $_SERVER[PHP_SELF]; ?>';"> |
||
| 442 | |||
| 443 | <input type='button' value='反选' onclick='selrev();'> <input type='submit' onclick='return confirm("删除选定文件?");' value='删除选定'> |
||
| 444 | |||
| 445 | <script language='javascript'> |
||
| 446 | function selrev() { |
||
| 447 | with (document.myform) { |
||
| 448 | for (i = 0; i < elements.length; i++) { |
||
| 449 | thiselm = elements[i]; |
||
| 450 | if (thiselm.name.match(/dfile\[]/)) thiselm.checked = !thiselm.checked; |
||
| 451 | } |
||
| 452 | } |
||
| 453 | } |
||
| 454 | alert('完成.'); |
||
| 455 | </script> |
||
| 456 | <? |
||
| 457 | |||
| 458 | elseif ($_REQUEST["myaction"] === "dodelete"): |
||
| 459 | set_time_limit(0); |
||
| 460 | if ($_POST['password'] != $password) { |
||
| 461 | die("输入的密码不正确,请重新输入。"); |
||
| 462 | } |
||
| 463 | |||
| 464 | $dfile = $_POST["dfile"]; |
||
| 465 | echo "正在删除文件...<br><br>"; |
||
| 466 | if (is_array($dfile)) { |
||
| 467 | for ($i = count($dfile) - 1; $i >= 0; $i--) { |
||
| 468 | if (is_file($dfile[$i])) { |
||
| 469 | if (@unlink($dfile[$i])) { |
||
| 470 | echo "已删除文件: $dfile[$i]<br>"; |
||
| 471 | } else { |
||
| 472 | echo "删除文件失败: $dfile[$i]<br>"; |
||
| 473 | } |
||
| 474 | } else { |
||
| 475 | if (@rmdir($dfile[$i])) { |
||
| 476 | echo "已删除目录: $dfile[$i]<br>"; |
||
| 477 | } else { |
||
| 478 | echo "删除目录失败: $dfile[$i]<br>"; |
||
| 479 | } |
||
| 480 | } |
||
| 481 | |||
| 482 | } |
||
| 483 | } |
||
| 484 | echo "<br>完成.<br><br><input type='button' value='返回' onclick=\"window.location='$_SERVER[PHP_SELF]';\"><br><br> |
||
| 485 | <script language='javascript'>('完成.');</script>"; |
||
| 486 | |||
| 487 | endif; |
||
| 488 | |||
| 489 | ?> |
||
| 490 | </form> |
||
| 491 | </body> |
||
| 492 | </html> |
||
| 493 |
Short opening tags are disabled in PHP’s default configuration. In such a case, all content of this file is output verbatim to the browser without being parsed, or executed.
As a precaution to avoid these problems better use the long opening tag
<?php.