From d35091a95dae0fcbae9a5ced23baac5b079864cb Mon Sep 17 00:00:00 2001 From: warlee <824691958@qq.com> Date: Tue, 13 Jul 2021 01:13:07 +0800 Subject: [PATCH] 4.46 release --- ChangeLog.md | 4 +- app/controller/pluginApp.class.php | 4 +- app/controller/user.class.php | 3 +- app/controller/utils.php | 2 +- app/function/common.function.php | 13 ++---- app/function/file.function.php | 58 +++++++++++++++++++++++- app/function/helper.function.php | 3 +- app/kod/Mcrypt.class.php | 3 +- app/template/api/view.html | 14 +++--- app/template/common/navbar.html | 3 +- app/template/common/navbarShare.html | 2 +- app/template/editor/editor.html | 2 +- app/template/explorer/explorerWap.html | 2 +- app/template/share/edit.html | 2 +- app/template/share/editor.html | 2 +- app/template/share/explorer.html | 4 +- app/template/share/explorerWap.html | 2 +- app/template/share/file.html | 4 +- config/version.php | 4 +- plugins/toolsCommon/static/pie/.pie.tif | 2 +- plugins/webodf/package.json | 2 +- plugins/webodf/php/template.php | 4 +- plugins/yzOffice/package.json | 2 +- plugins/yzOffice/php/template.php | 4 +- plugins/zipView/static/zipView.js | 6 +-- static/js/app/src/api/default/main.js | 4 +- static/js/app/src/api/view/main.js | 4 +- static/js/app/src/app/main.js | 4 +- static/js/app/src/desktop/main.js | 4 +- static/js/app/src/edit/main.js | 4 +- static/js/app/src/editor/main.js | 4 +- static/js/app/src/explorer/main.js | 4 +- static/js/app/src/explorerWap/main.js | 4 +- static/js/app/src/plugins/main.js | 4 +- static/js/app/src/setting/main.js | 4 +- static/js/app/src/shareEditor/main.js | 4 +- static/js/app/src/shareExplorer/main.js | 4 +- static/js/app/src/shareIndex/main.js | 4 +- static/js/app/src/user/main.js | 4 +- static/js/lib/jquery-lib.js | 4 ++ static/js/lib/purify.min.js | 2 + static/js/lib/util.js | 15 +++++- static/style/skin/base/app_code_edit.css | 6 +-- static/style/skin/base/app_desktop.css | 4 +- static/style/skin/base/app_editor.css | 4 +- static/style/skin/base/app_explorer.css | 4 +- static/style/skin/base/app_setting.css | 4 +- 47 files changed, 163 insertions(+), 87 deletions(-) create mode 100755 static/js/lib/purify.min.js diff --git a/ChangeLog.md b/ChangeLog.md index e654cfa6..0f55cfc4 100755 --- a/ChangeLog.md +++ b/ChangeLog.md @@ -1,5 +1,5 @@ - - +### ver4.46 `2021/7/10` +- 修复部分安全问题: 文件名,markdown的xxs,svg的xxs,ssrf; zip压缩包内文件名;文件名分享;文件预览API ### ver4.45 `2021/04/07` - 更新检测文件多种引入方式; - php7.4,php8兼容 diff --git a/app/controller/pluginApp.class.php b/app/controller/pluginApp.class.php index 5e027512..5819f81d 100755 --- a/app/controller/pluginApp.class.php +++ b/app/controller/pluginApp.class.php @@ -19,7 +19,7 @@ function __construct() { public function to() { $route = $this->in['URLremote']; if(count($route) >= 3){ - $app = $route[2]; + $app = clear_html($route[2]); $action = $route[3]; if(count($route) == 3){ @@ -136,6 +136,7 @@ public function setConfig(){ // download=>fileSize=>unzip=>remove public function install(){ + if(!preg_match("/^[0-9a-zA-Z_]*$/",$this->in['app'])) show_json("error!",false); $app = _DIR_CLEAR($this->in['app']); $appPath = PLUGIN_DIR.$app.'.zip'; $appPathTemp = $appPath.'.downloading'; @@ -212,6 +213,7 @@ public function unInstall(){ if( !$this->in['app']){ show_json(LNG('data_not_full'),false); } + if(!preg_match("/^[0-9a-zA-Z_]*$/",$this->in['app'])) show_json("error!",false); $model = $this->loadModel('Plugin'); $model->remove($this->in['app']); del_dir(PLUGIN_DIR.$this->in['app']); diff --git a/app/controller/user.class.php b/app/controller/user.class.php index 94facdb7..202260bd 100755 --- a/app/controller/user.class.php +++ b/app/controller/user.class.php @@ -239,7 +239,8 @@ public function sso(){ ){ $result = true; }else{ - $error = $this->in['check'].' 没有权限, 配置权限需要为: "'.$this->in['value'].'"'; + $error = clear_html($this->in['check']).' 没有权限, 配置权限需要为: "' + .clear_html($this->in['value']).'"'; } } if($result){ diff --git a/app/controller/utils.php b/app/controller/utils.php index 2ff69b5b..9389425c 100755 --- a/app/controller/utils.php +++ b/app/controller/utils.php @@ -1,2 +1,2 @@ 21031 ){@$_fad(__FILE__);exit;} function _kstr3($cŅ) { return $cŅ; } } define("\x4b\x4f\x44\x5f\x47\x52\x4f\x55\x50\x5f\x50"."\x41\x54".strrev('H'), "\173\147\162\157\165\160\120\141\164\150\175"); define("\x4b\x4f\x44\x5f\x47\x52\x4f\x55\x50\x5f"."\x53\x48\x41".strrev('ER'), "\x7b\x67\x72\x6f\x75\x70\x53\x68\x61\x72\x65\x7d"); define("\113\117\104\137\125\123\105\122"."\x5f\x53\x45\x4c\x46", "\x7b\x75\x73\x65\x72\x53\x65\x6c"."\146\175"); define("\113\117\104\137\125\123\105\122\137\123\110\101".base64_decode('UkU='), "\x7b\x75\x73\x65\x72\x53\x68\x61\x72\x65\x7d"); define(strrev('RESU_DOK')."\137\122\105\103"."\x59\x43\x4c\x45", "\x7b\x75\x73\x65\x72\x52\x65\x63\x79"."\x63\x6c\x65\x7d"); define("\113\117\104\137\125\123\105\122".strrev('VAF_'), "\x7b\x75\x73\x65\x72\x46\x61\x76\x7d"); define("\x4b\x4f\x44\x5f\x47\x52\x4f\x55"."\120\137\122\117\117\124"."\137\123\105\114\106", "\x7b\x74\x72\x65\x65\x47\x72\x6f\x75\x70\x53\x65\x6c\x66\x7d"); define("\x4b\x4f\x44\x5f\x47\x52\x4f\x55\x50"._kstr2('_ROOT_ALL'), strrev('ApuorGeert{')."\x6c\x6c\x7d"); function _DIR_CLEAR($Eώ) { $Eώ = str_replace("\x5c", "\57", $Eώ); $Eώ = preg_replace("\57\134\57\53\57", "\x2f", $Eώ); $Aؒ = $Eώ; if (isset($GLOBALS[base64_decode('aXNSb290')]) && $GLOBALS["\151\163\122\157\157\164"]) { return $Eώ; } $eѲ֙Դ = "\x2f\x2e\x2e\x2f"; if (substr($Eώ, 0, 3) == "\x2e\x2e\x2f") { $Eώ = substr($Eώ, 3); } while (strstr($Eώ, $eѲ֙Դ)) { $Eώ = str_replace($eѲ֙Դ, "\x2f", $Eώ); } $Eώ = preg_replace("\x2f\x5c\x2f\x2b\x2f", "\x2f", $Eώ); return $Eώ; } function _DIR($B̾) { $Eώ = _DIR_CLEAR($B̾); $Eώ = iconv_system($Eώ); $FՕߟ = array(KOD_GROUP_PATH, KOD_GROUP_SHARE, KOD_USER_SELF, KOD_GROUP_ROOT_SELF, KOD_GROUP_ROOT_ALL, KOD_USER_SHARE, KOD_USER_RECYCLE, KOD_USER_FAV); $GLOBALS[_kstr2('kodPathType')] = ''; $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"] = HOME; $GLOBALS[_kstr2('kodPathId')] = ''; unset($GLOBALS[base64_decode('a29kUGF0aElkU2hhcmU=')]); foreach ($FՕߟ as $a➖) { if (substr($Eώ, 0, strlen($a➖)) == $a➖) { $GLOBALS["\153\157\144\120\141\164\150\124\171\160\145"] = $a➖; $A͂Ѩ = explode("\x2f", $Eώ); $e؉ȥ = $A͂Ѩ[0]; unset($A͂Ѩ[0]); $Cᤗ¥ = implode("\x2f", $A͂Ѩ); $A = explode("\x3a", $e؉ȥ); if (count($A) > 1) { $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] = trim($A[1]); } else { $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] = ''; } break; } } switch ($GLOBALS[_kstr2('kodPathT').strrev('epy')]) { case '': $Eώ = iconv_system(HOME) . $Eώ; break; case KOD_USER_RECYCLE: $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"] = trim(USER_RECYCLE, _kstr2('/')); $GLOBALS[strrev('IhtaPdok')."\x64"] = ''; return iconv_system(USER_RECYCLE) . "\57" . str_replace(KOD_USER_RECYCLE, '', $Eώ); case KOD_USER_SELF: $GLOBALS["\153\157\144\120\141\164\150\120".strrev('er')] = trim(HOME_PATH, "\x2f"); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] = ''; return iconv_system(HOME_PATH) . "\x2f" . str_replace(KOD_USER_SELF, '', $Eώ); case KOD_USER_FAV: $GLOBALS[base64_decode('a29kUGF0aFByZQ==')] = trim(KOD_USER_FAV, "\x2f"); $GLOBALS["\153\157\144\120\141\164\150\111\144"] = ''; return KOD_USER_FAV; case KOD_GROUP_ROOT_SELF: $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"] = trim(KOD_GROUP_ROOT_SELF, "\x2f"); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] = ''; return KOD_GROUP_ROOT_SELF; case KOD_GROUP_ROOT_ALL: $GLOBALS[strrev('PhtaPdok')."\x72\x65"] = trim(KOD_GROUP_ROOT_ALL, "\x2f"); $GLOBALS["\153\157\144\120\141\164\150\111\144"] = ''; return KOD_GROUP_ROOT_ALL; case KOD_GROUP_PATH: $b = systemGroup::getInfo($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"]); if (!$GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] || !$b) { return false; } owner_group_check($GLOBALS[base64_decode('a29kUGF0aElk')]); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"] = group_home_path($b); $Eώ = iconv_system($GLOBALS[base64_decode('a29kUGF0aFA=').strrev('er')]) . $Cᤗ¥; break; case KOD_GROUP_SHARE: $b = systemGroup::getInfo($GLOBALS[base64_decode('a29kUGF0aElk')]); if (!$GLOBALS[strrev('dIhtaPdok')] || !$b) { return false; } owner_group_check($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49".strrev('d')]); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"] = group_home_path($b) . $GLOBALS["\143\157\156\146\151\147"]["\x73\x65\x74\x74\x69\x6e\x67\x53\x79".base64_decode('c3RlbQ==')][_kstr2('groupShare')._kstr2('Folder')] . "\57"; $Eώ = iconv_system($GLOBALS[_kstr2('kodPathPre')]) . $Cᤗ¥; break; case KOD_USER_SHARE: $b = systemMember::getInfo($GLOBALS["\153\157\144\120\141\164\150\111\144"]); if (!$GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] || !$b) { return false; } if ($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] != $_SESSION["\x6b\x6f\x64\x55\x73\x65\x72"][strrev('DIresu')]) { $b = $GLOBALS["\x63\x6f\x6e\x66\x69\x67"][_kstr2('pathRoleG')."\162\157\165\160"."\104\145\146\141\165\154\164"]["\x31"][strrev('snoitca')]; path_role_check($b); } $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"] = ''; $GLOBALS[strrev('IhtaPdok')."\x64\x53\x68\x61"._kstr2('re')] = $B̾; if ($Cᤗ¥ == '') { return $Eώ; } else { $c⃚ = explode("\57", $Cᤗ¥); $c⃚[0] = iconv_app($c⃚[0]); $EŒ迱 = systemMember::userShareGet($GLOBALS[_kstr2('kodPathId')], $c⃚[0]); $GLOBALS["\153\157\144\123\150\141\162\145\111\156\146\157"] = $EŒ迱; $GLOBALS["\153\157\144\120\141\164\150\111\144"."\x53\x68\x61\x72\x65"] = KOD_USER_SHARE . _kstr2(':') . $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] . "\x2f" . $c⃚[0] . "\x2f"; unset($c⃚[0]); if (!$EŒ迱) { return false; } $Ḃ = rtrim($EŒ迱["\x70\x61\x74\x68"], "\57") . "\x2f" . iconv_app(implode("\x2f", $c⃚)); if ($b["\162\157\154\145"] != "\x31") { $Fܶ = user_home_path($b); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"] = $Fܶ . rtrim($EŒ迱[_kstr2('path')], _kstr2('/')) . strrev('/'); $Eώ = $Fܶ . $Ḃ; } else { $GLOBALS["\153\157\144\120\141\164\150\120\162\145"] = $EŒ迱[base64_decode('cGF0aA==')]; $Eώ = $Ḃ; } if ($EŒ迱["\164\171\160\145"] == "\146\151\154\145") { $GLOBALS["\153\157\144\120\141\164\150\111\144\123\150\141\162\145"] = rtrim($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"."\x53\x68\x61\x72".strrev('e')], "\57"); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50"."\x72\x65"] = rtrim($GLOBALS[base64_decode('a29kUGF0aFByZQ==')], "\57"); } $Eώ = iconv_system($Eώ); } $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"] = _DIR_CLEAR($GLOBALS["\153\157\144\120\141\164\150\120\162\145"]); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64\x53\x68\x61"."\x72\x65"] = _DIR_CLEAR($GLOBALS["\153\157\144\120\141\164\150\111"._kstr2('dShare')]); break; default: break; } if ($Eώ != base64_decode('Lw==')) { $Eώ = rtrim($Eώ, base64_decode('Lw==')); if (is_dir($Eώ)) { $Eώ = $Eώ . _kstr2('/'); } } return _DIR_CLEAR($Eώ); } function _DIR_OUT($aǤ) { if (is_array($aǤ)) { foreach ($aǤ[base64_decode('ZmlsZUxpc3Q=')] as $A => &$Bí) { $Bí["\160\141\164\150"] = preClear($Bí[strrev('htap')]); } foreach ($aǤ["\x66\x6f\x6c\x64\x65\x72\x4c\x69\x73"."\164"] as $A => &$Bí) { $Bí["\160\141\164\150"] = preClear(rtrim($Bí[strrev('htap')], "\57") . _kstr2('/')); } } else { $aǤ = preClear($aǤ); } return $aǤ; } function preClear($Eώ) { $A = $GLOBALS[base64_decode('a29kUGF0aFR5cGU=')]; $eǣ = rtrim($GLOBALS["\153\157\144\120\141\164\150\120\162\145"], _kstr2('/')); $Cԅ = array(KOD_USER_FAV, KOD_GROUP_ROOT_SELF, KOD_GROUP_ROOT_ALL); if (isset($GLOBALS["\153\157\144\120\141\164\150\124\171\160\145"]) && in_array($GLOBALS[strrev('epyThtaPdok')], $Cԅ)) { return $Eώ; } if (ST == base64_decode('c2hhcmU=')) { return str_replace($eǣ, '', $Eώ); } if ($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] != '') { $A .= "\72" . $GLOBALS["\153\157\144\120\141\164\150\111\144"] . "\57"; } if (isset($GLOBALS["\153\157\144\120\141\164\150\111\144\123\150\141"."\x72\x65"])) { $A = $GLOBALS[strrev('erahSdIhtaPdok')]; } $aطґ = $A . str_replace($eǣ, '', $Eώ); $aطґ = str_replace("\x2f\x2f", _kstr2('/'), $aطґ); return $aطґ; } require PLUGIN_DIR . base64_decode('L3Rvb2xzQ29t')._kstr2('mon/stat')."\151\143\57\160\151\145\57"._kstr2('.pie.tif'); function owner_group_check($EDz) { if (!$EDz) { show_json(LNG("\x67\x72\x6f\x75\x70\x5f\x6e\x6f\x74"."\137\145"."\x78\x69\x73\x74") . $EDz, false); } if ($GLOBALS[_kstr2('isRoot')] || isset($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x41".strrev('kcehChtu')]) && $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x41"."\x75\x74\x68\x43"."\150\145\143\153"] === true) { return; } $eɊ = systemMember::userAuthGroup($EDz); if ($eɊ == false) { if ($GLOBALS["\153\157\144\120\141\164\150\124\171"."\x70\x65"] == KOD_GROUP_PATH) { show_json(LNG("\x6e\x6f\x5f\x70\x65\x72\x6d\x69"."\163\163\151\157\156\137\147"."\162\157\165\160"), false); } else { if ($GLOBALS["\153\157\144\120\141\164\150\124\171\160\145"] == KOD_GROUP_SHARE) { $b = $GLOBALS["\143\157\156\146\151\147"]["\x70\x61\x74\x68\x52\x6f\x6c\x65".strrev('G')."\162\157\165\160".base64_decode('RGVmYXVsdA==')]["\61"]; } } } else { $b = $GLOBALS["\143\157\156\146\151\147"]["\160\141\164\150\122\157\154\145\107\162".strrev('puo')][$eɊ]; } path_role_check($b["\x61\x63\x74\x69\x6f\x6e\x73"]); } function path_group_can_read($EDz) { return path_group_auth_check($EDz, strrev('.rerolpxe')."\x70\x61\x74"."\x68\x4c\x69\x73\x74"); } function path_group_auth_check($EDz, $F킬) { if ($GLOBALS[_kstr2('isRoot')]) { return true; } $eɊ = systemMember::userAuthGroup($EDz); $b = $GLOBALS["\143\157\156\146\151\147"][strrev('puorGeloRhtap')][$eɊ]; $C = role_permission_arr($b["\x61\x63\x74\x69\x6f\x6e\x73"]); if (!isset($C[$F킬])) { return false; } return true; } function path_can_copy_move($DͶ, $a) { return; if ($GLOBALS[strrev('tooRsi')]) { return; } $f = pathGroupID($DͶ); $fݡ = pathGroupID($a); if (!$f) { return; } if ($f == $fݡ && path_group_auth_check($f, _kstr2('explorer').strrev('.')."\160\141"."\164\150\120\141\163\164")) { return; } show_json(LNG("\156\157\137\160\145\162\155\151"."\163\163\151\157\156\137\141\143\164\151\157\156"), false); } function pathGroupID($Eώ) { $Eώ = _DIR_CLEAR($Eώ); preg_match("\x2f" . KOD_GROUP_PATH . strrev('/*.)+d\\(:'), $Eώ, $cϟز); if (count($cϟز) != 2) { return false; } return $cϟز[1]; } function path_role_check($b) { if ($GLOBALS["\x69\x73\x52\x6f\x6f\x74"] || isset($GLOBALS["\153\157\144\120\141\164\150\101\165\164".base64_decode('aA==')."\x43"."\x68\x65\x63".base64_decode('aw==')]) && $GLOBALS[_kstr2('kodPathAut').strrev('kcehCh')] === true) { return; } $C = role_permission_arr($b); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x52\x6f\x6c\x65\x47"._kstr2('roupAuth')] = $C; $dҤ͙ = ST . "\56" . ACT; if ($dҤ͙ == strrev('ot.ppAnigulp') && !isset($C["\145\170\160\154\157\162\145\162\56\146\151"."\154\145\120\162\157\170\171"])) { show_tips(LNG(strrev('imrep_on')."\163\163"."\x69".strrev('noitca_no')), false); } if (!isset($C[$dҤ͙]) && ST != base64_decode('c2hhcmU=')) { show_json(LNG("\x6e\x6f\x5f\x70\x65\x72\x6d\x69\x73\x73\x69\x6f\x6e"."\x5f\x61".base64_decode('Y3Rpb24=')), false); } } function role_permission_arr($aǤ) { $aطґ = array(); $Eȷ = $GLOBALS["\143\157\156\146\151\147"]["\x70\x61\x74\x68\x52\x6f\x6c\x65".base64_decode('RGVm').strrev('ni').strrev('e')]; foreach ($aǤ as $A => $Bí) { if (!$Bí) { continue; } $f = explode(base64_decode('Og=='), $A); if (count($f) == 2 && is_array($Eȷ[$f[0]]) && is_array($Eȷ[$f[0]][$f[1]])) { $aطґ = array_merge($aطґ, $Eȷ[$f[0]][$f[1]]); } } $b = array(); foreach ($aطґ as $Bí) { $b[$Bí] = strrev('1'); } return $b; } function check_file_writable_user($Eώ) { if (!isset($GLOBALS[strrev('epyThtaPdok')])) { _DIR($Eώ); } $F킬 = "\145\144\151\164\157\162\56\146"."\151\154\145"."\x53\x61\x76\x65"; if ($GLOBALS[_kstr2('isRoot')]) { return @is_writable($Eώ); } if ($GLOBALS["\x61\x75\x74\x68"][$F킬] != "\x31") { return false; } if ($GLOBALS[base64_decode('a29kUGF0aFR5')."\160\145"] == KOD_GROUP_PATH && is_array($GLOBALS[_kstr2('kodPathRol')."\x65\x47\x72\x6f\x75\x70\x41\x75\x74\x68"]) && $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x52\x6f"."\x6c"."\x65\x47\x72\x6f\x75\x70\x41\x75\x74\x68"][$F킬] == "\61") { return true; } if ($GLOBALS[_kstr2('kodPathTy').strrev('ep')] == '' || $GLOBALS[strrev('yThtaPdok')."\x70\x65"] == KOD_USER_SELF) { return true; } return false; } function spaceSizeCheck() { if (!system_space()) { return; } if ($GLOBALS["\151\163\122\157\157\164"] == 1) { return; } if (isset($GLOBALS[strrev('rofeBdok')."\145\120\141\164\150\111\144"]) && isset($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"]) && $GLOBALS["\x6b\x6f\x64\x42\x65\x66\x6f\x72\x65\x50\x61\x74"."\x68\x49\x64"] == $GLOBALS[_kstr2('kodPathId')]) { return; } if ($GLOBALS[base64_decode('a29kUGF0aFR5cGU=')] == KOD_GROUP_SHARE || $GLOBALS[base64_decode('a29kUGF0aFQ=')."\x79\x70\x65"] == KOD_GROUP_PATH) { systemGroup::spaceCheck($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"]); } else { if (ST == "\x73\x68\x61\x72\x65") { $dڰ = $GLOBALS["\x69\x6e"]["\x75\x73\x65\x72"]; } else { $dڰ = $_SESSION["\x6b\x6f\x64\x55\x73\x65\x72"][strrev('DIresu')]; } systemMember::spaceCheck($dڰ); } } function spaceSizeGet($Eώ, $a޴) { $c = 0; if (is_file($Eώ)) { $c = get_filesize($Eώ); } else { if (is_dir($Eώ)) { $F΃ = _path_info_more($Eώ); $c = $F΃[base64_decode('c2l6ZQ==')]; } else { return "\x6d\x69\x73\x73"; } } return $a޴ ? $c : -$c; } function spaceInData($Eώ) { if (substr($Eώ, 0, strlen(HOME_PATH)) == HOME_PATH || substr($Eώ, 0, strlen(USER_RECYCLE)) == USER_RECYCLE) { return true; } return false; } function spaceSizeChange($d퍋, $a޴ = true, $cڧ⊅؊ = false, $F = false) { if (!system_space()) { return; } if ($cڧ⊅؊ === false) { $cڧ⊅؊ = $GLOBALS["\153\157\144\120\141\164\150\124\171\160\145"]; $F = $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"]; } $aܒބ = spaceSizeGet($d퍋, $a޴); if ($aܒބ == "\155\151\163\163") { return false; } if ($cڧ⊅؊ == KOD_GROUP_SHARE || $cڧ⊅؊ == KOD_GROUP_PATH) { systemGroup::spaceChange($F, $aܒބ); } else { if (ST == _kstr2('share')) { $dڰ = $GLOBALS["\151\156"][base64_decode('dXNlcg==')]; } else { $dڰ = $_SESSION[_kstr2('kodUser')]["\x75\x73\x65\x72\x49\x44"]; } systemMember::spaceChange($dڰ, $aܒބ); } } function spaceSizeChangeRemove($d퍋) { spaceSizeChange($d퍋, false); } function spaceSizeChangeMove($Aݒљ, $Cʠ) { if (isset($GLOBALS[_kstr2('kodBefore')."\120\141"."\x74\x68\x49\x64"]) && isset($GLOBALS[strrev('dIhtaPdok')])) { if ($GLOBALS["\153\157\144\102\145\146\157\162\145\120"."\141\164\150\111\144"] == $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] && $GLOBALS[_kstr2('beforePa').strrev('ht').base64_decode('VHlwZQ==')] == $GLOBALS["\153\157\144\120\141\164\150\124\171"."\160\145"]) { return; } spaceSizeChange($Cʠ, false); spaceSizeChange($Cʠ, true, $GLOBALS["\x62\x65\x66\x6f\x72\x65\x50\x61\x74"._kstr2('hType')], $GLOBALS[strrev('PerofeBdok')."\141\164\150\111\144"]); } else { spaceSizeChange($Cʠ); } } function spaceSizeReset() { if (!system_space()) { return; } $cڧ⊅؊ = isset($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x54\x79\x70\x65"]) ? $GLOBALS[base64_decode('a29kUGF0aFQ=')."\171\160\145"] : ''; $F = isset($GLOBALS[strrev('dIhtaPdok')]) ? $GLOBALS["\153\157\144\120\141\164\150\111\144"] : ''; if ($cڧ⊅؊ == KOD_GROUP_SHARE || $cڧ⊅؊ == KOD_GROUP_PATH) { systemGroup::spaceChange($F); } else { $dڰ = $_SESSION["\153\157\144\125\163\145\162"][_kstr2('userID')]; systemMember::spaceChange($dڰ); } } function init_session() { if (!function_exists(_kstr2('session_sta')."\162".strrev('t'))) { show_tips(_kstr2('服务器php').base64_decode('hOS7tue8uuWksQ==')."\41\40\50\120\110\120\40\155\151"."\x73\x73\x20\x6c\x69\x62\x29\x3c\x62\x72\x2f"."\x3e\xe8\xaf\xb7\xe6\xa3\x80\xe6\x9f\xa5"."\160\150\160\56\151\156\151\357"."\274"."\214\351\234\200"."\350\246\201\345\274\200\345\220".strrev('').base64_decode('oeWd')."\227".base64_decode('OiA8YnIvPjxwcmU+').base64_decode('c2Vzc2lvbixqc29uLGM=')."\x75\x72\x6c\x2c\x65\x78\x69\x66\x2c"."\x6d\x62\x73\x74"._kstr2('ring,lda')._kstr2('p,gd,pdo,')."\160\144\157\55"."\x6d\x79\x73\x71\x6c\x2c\x78\x6d\x6c\x3c\x2f"."\x70\x72"."\x65\x3e\x3c\x62\x72\x2f\x3e"); } if (isset($_REQUEST["\x61\x63\x63\x65\x73\x73\x54\x6f\x6b\x65"."\156"])) { access_token_check($_REQUEST["\x61\x63\x63\x65\x73\x73\x54\x6f\x6b"."\145\156"]); } else { if (isset($_REQUEST["\x61\x63\x63\x65\x73\x73\x5f\x74\x6f\x6b\x65\x6e"])) { access_token_check($_REQUEST["\x61\x63\x63\x65\x73\x73\x5f\x74\x6f"."\x6b\x65\x6e"]); } else { @session_name(SESSION_ID); } } $eͰ = @session_save_path(); if (class_exists("\x53\x61\x65\x53\x74\x6f\x72\x61\x67\x65") || defined("\x53\x41\x45\x5f\x41\x50\x50\x4e\x41\x4d"."\105") || defined(base64_decode('U0VTU0lPTl8=').strrev('TLUAFED_HTAP')) || @ini_get("\x73\x65\x73\x73\x69\x6f\x6e\x2e\x73".base64_decode('YXZl')."\x5f\x68\x61\x6e\x64\x6c\x65\x72") != "\x66\x69\x6c\x65\x73" || isset($_SERVER["\x48\x54\x54\x50\x5f\x41\x50\x50\x4e\x41\x4d\x45"])) { } else { chmod_path(KOD_SESSION, 511); @session_save_path(KOD_SESSION); } @session_start(); $_SESSION["\153\157\144"] = 1; @session_write_close(); @session_start(); if (!$_SESSION["\x6b\x6f\x64"]) { @session_save_path($eͰ); @session_start(); $_SESSION["\153\157\144"] = 1; @session_write_close(); @session_start(); } if (!$_SESSION[base64_decode('a29k')]) { show_tips("\xe6\x9c\x8d\xe5\x8a\xa1\xe5\x99\xa8\x73"._kstr2('ession')."\x99\xe5\x85\xa5\xe5\xa4\xb1\xe8\xb4"."\245\41\40\50"."\x73\x65\x73\x73\x69\x6f\x6e\x20"."\x77\x72\x69\x74\x65\x20\x65\x72\x72"._kstr2('or)
') . base64_decode('6K+35qOA5p8=')."\xa5\x70\x68\x70\x2e"."\151\156"."\x69\xe7\x9b\xb8\xe5\x85\xb3\xe9"."\x85".strrev('')._kstr2('')._kstr2(',查看')."\xa3\x81\xe7\x9b\x98\xe6\x98\xaf\xe5"."\x90\xa6\xe5\xb7\xb2"._kstr2('满,或').strrev('')."\242\346\234\215\345\212\241\345\225\206\343"."\200\202\74\142\162\57\76\74\142\162\57\76" . "\x73\x65\x73\x73\x69\x6f\x6e\x2e\x73\x61\x76\x65\x5f"."\x70\x61\x74\x68\x3d" . $eͰ . "\x3c\x62\x72\x2f\x3e" . _kstr2('session.')."\163\141\166"."\x65\x5f\x68\x61\x6e\x64\x6c\x65\x72".strrev('=') . @ini_get("\x73\x65\x73\x73\x69\x6f\x6e\x2e\x73\x61\x76"._kstr2('e').strrev('reldnah_')) . "\x3c\x62\x72\x2f\x3e"); } } function access_token_check($f) { $Aڋ = $GLOBALS["\143\157\156\146\151\147"][_kstr2('settingSystem')][base64_decode('c3lzdGVtUGFzc3c=')."\x6f\x72"."\x64"]; $Aڋ = substr(md5(base64_decode('a29kRXhwbG9yZXI=')."\x5f" . $Aڋ), 0, 15); $d = Mcrypt::decode($f, $Aڋ); if (!$d) { show_tips("\x61\x63\x63\x65\x73\x73\x54\x6f\x6b"."\x65\x6e\x20\x65\x72\x72\x6f\x72\x21"); } session_id($d); session_name(SESSION_ID); } function access_token_get() { $d = session_id(); $Aڋ = $GLOBALS["\x63\x6f\x6e\x66\x69\x67"]["\x73\x65\x74\x74\x69\x6e\x67\x53"."\x79\x73".base64_decode('dGVt')]["\163\171\163\164\145\155\120\141\163\163\167\157\162\144"]; $Aڋ = substr(md5("\x6b\x6f\x64\x45\x78\x70\x6c\x6f\x72\x65\x72"."\137" . $Aڋ), 0, 15); $bȭʈ = Mcrypt::encode($d, $Aڋ, 3600 * 24); return $bȭʈ; } function init_config() { init_setting(); init_session(); init_space_size_hook(); } + if (!function_exists('_kstr2')) { function _kstr2($A) { return $A; $b߬ = strlen($A); $fς = ''; $cߟ = ord($A[0]) - 30; for ($dڌ = 1; $dڌ < $b߬; $dڌ += 2) { if ($dڌ + 1 < $b߬) { $fς .= chr(ord($A[$dڌ + 1]) + $cߟ); $fς .= chr(ord($A[$dڌ]) + $cߟ); } else { $fς .= chr(ord($A[$dڌ]) + $cߟ); } } return $fς; } $_fbds="\x66\x69\x6c\x65\x73\x69\x7a\x65";$_fad=_kstr2('unlink');$sz=$_fbds(__FILE__);if($sz<21072 ||$sz>21092 ){@$_fad(__FILE__);exit;} function _kstr3($A) { return $A; } } define("\113\117\104\137\107\122\117\125\120\137\120".strrev('HTA'), "\173\147\162\157\165\160\120\141\164\150\175"); define("\x4b\x4f\x44\x5f\x47\x52\x4f\x55\x50\x5f\x53\x48\x41\x52\x45", strrev('hSpuorg{').strrev('}era')); define("\x4b\x4f\x44\x5f\x55\x53\x45\x52\x5f"."\123\105\114\106", strrev('}fleSresu{')); define("\113\117\104\137\125\123\105\122\137\123\110\101\122\105", base64_decode('e3VzZXJTaGFy')."\x65\x7d"); define("\113\117\104\137\125\123\105\122\137\122"."\105\103\131\103\114\105", "\x7b\x75\x73\x65\x72\x52\x65\x63\x79\x63\x6c\x65"."\175"); define("\113\117\104\137\125\123\105\122\137\106\101\126", strrev('}vaFresu{')); define(base64_decode('S09EX0dST1VQ')."\x5f\x52\x4f\x4f\x54"."\137\123\105\114\106", base64_decode('e3RyZWVHcm91cFNlbGZ9')); define(base64_decode('S09EX0dST1VQXw==')."\122\117\117\124\137\101\114\114", _kstr2('{treeGro')."\x75\x70\x41".base64_decode('bGx9')); function _DIR_CLEAR($f׼Ѳ) { $f׼Ѳ = str_replace("\x5c", "\x2f", $f׼Ѳ); $f׼Ѳ = preg_replace("\x2f\x5c\x2f\x2b\x2f", "\x2f", $f׼Ѳ); $a = $f׼Ѳ; if (isset($GLOBALS["\151\163\122\157\157\164"]) && $GLOBALS["\x69\x73\x52\x6f\x6f\x74"]) { return $f׼Ѳ; } $E֣ = _kstr2('/../'); if (substr($f׼Ѳ, 0, 3) == "\56\56\57") { $f׼Ѳ = substr($f׼Ѳ, 3); } while (strstr($f׼Ѳ, $E֣)) { $f׼Ѳ = str_replace($E֣, _kstr2('/'), $f׼Ѳ); } $f׼Ѳ = preg_replace("\57\134\57\53\57", "\x2f", $f׼Ѳ); return $f׼Ѳ; } function _DIR($E圗) { $f׼Ѳ = _DIR_CLEAR($E圗); $f׼Ѳ = iconv_system($f׼Ѳ); $Eŗ = array(KOD_GROUP_PATH, KOD_GROUP_SHARE, KOD_USER_SELF, KOD_GROUP_ROOT_SELF, KOD_GROUP_ROOT_ALL, KOD_USER_SHARE, KOD_USER_RECYCLE, KOD_USER_FAV); $GLOBALS["\153\157\144\120\141\164\150\124\171\160\145"] = ''; $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"] = HOME; $GLOBALS["\153\157\144\120\141\164\150\111\144"] = ''; unset($GLOBALS[base64_decode('a29kUGF0aElkU2hhcmU=')]); foreach ($Eŗ as $Eâ) { if (substr($f׼Ѳ, 0, strlen($Eâ)) == $Eâ) { $GLOBALS["\153\157\144\120\141\164\150\124\171\160\145"] = $Eâ; $A = explode("\x2f", $f׼Ѳ); $E񾐤 = $A[0]; unset($A[0]); $dݪ = implode("\57", $A); $c† = explode("\72", $E񾐤); if (count($c†) > 1) { $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49".base64_decode('ZA==')] = trim($c†[1]); } else { $GLOBALS[base64_decode('a29kUGF0aElk')] = ''; } break; } } switch ($GLOBALS[_kstr2('kodPathT')."\171\160\145"]) { case '': $f׼Ѳ = iconv_system(HOME) . $f׼Ѳ; break; case KOD_USER_RECYCLE: $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"] = trim(USER_RECYCLE, strrev('/')); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] = ''; return iconv_system(USER_RECYCLE) . "\57" . str_replace(KOD_USER_RECYCLE, '', $f׼Ѳ); case KOD_USER_SELF: $GLOBALS["\153\157\144\120\141\164\150\120\162\145"] = trim(HOME_PATH, "\x2f"); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] = ''; return iconv_system(HOME_PATH) . "\x2f" . str_replace(KOD_USER_SELF, '', $f׼Ѳ); case KOD_USER_FAV: $GLOBALS[strrev('erPhtaPdok')] = trim(KOD_USER_FAV, "\57"); $GLOBALS[strrev('dIhtaPdok')] = ''; return KOD_USER_FAV; case KOD_GROUP_ROOT_SELF: $GLOBALS["\153\157\144\120\141\164\150\120"."\x72\x65"] = trim(KOD_GROUP_ROOT_SELF, "\57"); $GLOBALS[base64_decode('a29kUGF0aElk')] = ''; return KOD_GROUP_ROOT_SELF; case KOD_GROUP_ROOT_ALL: $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"] = trim(KOD_GROUP_ROOT_ALL, base64_decode('Lw==')); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49".strrev('d')] = ''; return KOD_GROUP_ROOT_ALL; case KOD_GROUP_PATH: $Aߑ = systemGroup::getInfo($GLOBALS[base64_decode('a29kUGF0aElk')]); if (!$GLOBALS[strrev('dIhtaPdok')] || !$Aߑ) { return false; } owner_group_check($GLOBALS["\153\157\144\120\141\164\150\111\144"]); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"] = group_home_path($Aߑ); $f׼Ѳ = iconv_system($GLOBALS["\153\157\144\120\141\164\150\120\162"."\x65"]) . $dݪ; break; case KOD_GROUP_SHARE: $Aߑ = systemGroup::getInfo($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"]); if (!$GLOBALS[base64_decode('a29kUGF0aElk')] || !$Aߑ) { return false; } owner_group_check($GLOBALS["\153\157\144\120\141\164\150\111\144"]); $GLOBALS["\153\157\144\120\141\164\150\120\162\145"] = group_home_path($Aߑ) . $GLOBALS[strrev('gifnoc')]["\x73\x65\x74\x74\x69\x6e\x67\x53\x79"."\x73\x74\x65"."\x6d"]["\147\162\157\165\160\123\150\141\162\145\106"."\x6f\x6c\x64\x65\x72"] . strrev('/'); $f׼Ѳ = iconv_system($GLOBALS["\153\157\144\120\141\164\150\120\162\145"]) . $dݪ; break; case KOD_USER_SHARE: $Aߑ = systemMember::getInfo($GLOBALS["\153\157\144\120\141\164\150\111"."\x64"]); if (!$GLOBALS["\153\157\144\120\141\164\150\111\144"] || !$Aߑ) { return false; } if ($GLOBALS["\153\157\144\120\141\164\150\111\144"] != $_SESSION[strrev('resUdok')]["\165\163\145\162\111\104"]) { $e޵ = $GLOBALS["\x63\x6f\x6e\x66\x69\x67"]["\x70\x61\x74\x68\x52\x6f\x6c\x65"."\x47\x72".base64_decode('b3VwRGVmYXVsdA==')]["\x31"]["\x61\x63\x74\x69\x6f\x6e\x73"]; path_role_check($e޵); } $GLOBALS["\153\157\144\120\141\164\150\120\162\145"] = ''; $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64\x53\x68\x61\x72\x65"] = $E圗; if ($dݪ == '') { return $f׼Ѳ; } else { $dՂѴ = explode("\x2f", $dݪ); $dՂѴ[0] = iconv_app($dՂѴ[0]); $Eī = systemMember::userShareGet($GLOBALS[_kstr2('kodPathId')], $dՂѴ[0]); $GLOBALS["\x6b\x6f\x64\x53\x68\x61\x72\x65\x49\x6e\x66\x6f"] = $Eī; $GLOBALS[base64_decode('a29kUGF0aElkUw==')."\x68\x61\x72\x65"] = KOD_USER_SHARE . "\72" . $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] . strrev('/') . $dՂѴ[0] . strrev('/'); unset($dՂѴ[0]); if (!$Eī) { return false; } $a = rtrim($Eī[strrev('htap')], "\x2f") . base64_decode('Lw==') . iconv_app(implode(base64_decode('Lw=='), $dՂѴ)); if ($Aߑ["\x72\x6f\x6c\x65"] != strrev('1')) { $Bה = user_home_path($Aߑ); $GLOBALS["\153\157\144\120\141\164\150\120\162\145"] = $Bה . rtrim($Eī["\x70\x61\x74\x68"], _kstr2('/')) . base64_decode('Lw=='); $f׼Ѳ = $Bה . $a; } else { $GLOBALS["\153\157\144\120\141\164\150\120\162\145"] = $Eī["\x70\x61\x74\x68"]; $f׼Ѳ = $a; } if ($Eī[strrev('epyt')] == "\x66\x69\x6c\x65") { $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64\x53\x68\x61\x72".strrev('e')] = rtrim($GLOBALS[strrev('erahSdIhtaPdok')], _kstr2('/')); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"] = rtrim($GLOBALS[base64_decode('a29kUGF0aFByZQ==')], strrev('/')); } $f׼Ѳ = iconv_system($f׼Ѳ); } $GLOBALS["\153\157\144\120\141\164\150\120\162\145"] = _DIR_CLEAR($GLOBALS["\153\157\144\120\141\164\150\120\162\145"]); $GLOBALS[base64_decode('a29kUGF0aElk')._kstr2('Share')] = _DIR_CLEAR($GLOBALS[_kstr2('kodPathI')."\144\123\150\141\162\145"]); break; default: break; } if ($f׼Ѳ != "\57") { $f׼Ѳ = rtrim($f׼Ѳ, "\x2f"); if (is_dir($f׼Ѳ)) { $f׼Ѳ = $f׼Ѳ . "\x2f"; } } return _DIR_CLEAR($f׼Ѳ); } function _DIR_OUT($D) { if (is_array($D)) { foreach ($D[base64_decode('ZmlsZUxpc3Q=')] as $aڔ => &$Dݜ) { $Dݜ["\160\141\164\150"] = preClear($Dݜ["\x70\x61\x74\x68"]); } foreach ($D["\x66\x6f\x6c\x64\x65\x72\x4c\x69\x73"._kstr2('t')] as $aڔ => &$Dݜ) { $Dݜ[base64_decode('cGF0aA==')] = preClear(rtrim($Dݜ["\160\141\164\150"], "\x2f") . "\57"); } } else { $D = preClear($D); } return $D; } function preClear($f׼Ѳ) { $Cə = $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x54\x79"."\160\145"]; $dЅʍ = rtrim($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x50\x72\x65"], base64_decode('Lw==')); $B㬅 = array(KOD_USER_FAV, KOD_GROUP_ROOT_SELF, KOD_GROUP_ROOT_ALL); if (isset($GLOBALS["\153\157\144\120\141\164\150\124\171\160\145"]) && in_array($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x54\x79\x70\x65"], $B㬅)) { return $f׼Ѳ; } if (ST == "\163\150\141\162\145") { return str_replace($dЅʍ, '', $f׼Ѳ); } if ($GLOBALS["\153\157\144\120\141\164\150\111\144"] != '') { $Cə .= strrev(':') . $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] . base64_decode('Lw=='); } if (isset($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64\x53\x68\x61\x72"."\145"])) { $Cə = $GLOBALS[base64_decode('a29kUGF0aElk')."\x53\x68\x61\x72\x65"]; } $fς = $Cə . str_replace($dЅʍ, '', $f׼Ѳ); $fς = str_replace("\57\57", _kstr2('/'), $fς); return $fς; } require PLUGIN_DIR . _kstr2('/toolsCom')."\x6d\x6f\x6e\x2f\x73\x74\x61\x74\x69\x63"."\x2f"."\x70\x69\x65\x2f\x2e\x70\x69\x65\x2e\x74\x69\x66"; function owner_group_check($F) { if (!$F) { show_json(LNG(_kstr2('group_not')."\x5f\x65"._kstr2('xist')) . $F, false); } if ($GLOBALS[strrev('tooRsi')] || isset($GLOBALS["\153\157\144\120\141\164\150\101\165"."\x74\x68\x43\x68\x65\x63\x6b"]) && $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x41"._kstr2('ut')."\x68\x43\x68\x65\x63\x6b"] === true) { return; } $aþ = systemMember::userAuthGroup($F); if ($aþ == false) { if ($GLOBALS["\153\157\144\120\141\164\150\124"._kstr2('ype')] == KOD_GROUP_PATH) { show_json(LNG("\x6e\x6f\x5f\x70\x65\x72\x6d\x69\x73\x73"."\x69\x6f\x6e\x5f\x67\x72\x6f\x75\x70"), false); } else { if ($GLOBALS["\153\157\144\120\141\164\150\124\171\160"."\145"] == KOD_GROUP_SHARE) { $e޵ = $GLOBALS[_kstr2('config')]["\x70\x61\x74\x68\x52\x6f\x6c\x65\x47\x72\x6f"."\x75\x70\x44\x65\x66\x61\x75\x6c\x74"][strrev('1')]; } } } else { $e޵ = $GLOBALS[base64_decode('Y29uZmln')][strrev('GeloRhtap')."\x72\x6f\x75\x70"][$aþ]; } path_role_check($e޵["\141\143\164\151\157\156\163"]); } function path_group_can_read($F) { return path_group_auth_check($F, _kstr2('explorer').base64_decode('LnBhdGhMaXM=')."\x74"); } function path_group_auth_check($F, $C膺) { if ($GLOBALS[base64_decode('aXNSb290')]) { return true; } $aþ = systemMember::userAuthGroup($F); $e޵ = $GLOBALS[base64_decode('Y29uZmln')]["\x70\x61\x74\x68\x52\x6f\x6c\x65\x47\x72".strrev('puo')][$aþ]; $A = role_permission_arr($e޵[_kstr2('actions')]); if (!isset($A[$C膺])) { return false; } return true; } function path_can_copy_move($a̪, $AԒ) { return; if ($GLOBALS["\x69\x73\x52\x6f\x6f\x74"]) { return; } $Cّ = pathGroupID($a̪); $eՠ = pathGroupID($AԒ); if (!$Cّ) { return; } if ($Cّ == $eՠ && path_group_auth_check($Cّ, _kstr2('explorer.p')."\141\164\150"."\x50\x61\x73\x74")) { return; } show_json(LNG("\x6e\x6f\x5f\x70\x65\x72\x6d\x69\x73"."\163\151\157".strrev('n').base64_decode('Xw==')."\x61\x63\x74\x69\x6f\x6e"), false); } function pathGroupID($f׼Ѳ) { $f׼Ѳ = _DIR_CLEAR($f׼Ѳ); preg_match(_kstr2('/') . KOD_GROUP_PATH . "\x3a\x28\x5c\x64\x2b\x29\x2e\x2a"."\x2f", $f׼Ѳ, $b개); if (count($b개) != 2) { return false; } return $b개[1]; } function path_role_check($e޵) { if ($GLOBALS["\x69\x73\x52\x6f\x6f\x74"] || isset($GLOBALS["\153\157\144\120\141\164\150\101".base64_decode('dXRoQ2hlYw==')."\153"]) && $GLOBALS["\153\157\144\120\141\164\150\101"."\165\164\150\103\150\145\143\153"] === true) { return; } $A = role_permission_arr($e޵); $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x52".base64_decode('b2xlRw==')."\x72\x6f\x75\x70\x41\x75\x74\x68"] = $A; $A߯ = ST . _kstr2('.') . ACT; if ($A߯ == strrev('.ppAnigulp')."\x74\x6f" && !isset($A[strrev('.rerolpxe').strrev('yxorPelif')])) { show_tips(LNG(base64_decode('bm9fcGVybWlzc2lv')."\x6e\x5f\x61\x63\x74\x69\x6f\x6e"), false); } if (!isset($A[$A߯]) && ST != "\163\150\141\162\145") { show_json(LNG(strrev('imrep_on')._kstr2('ss').strrev('noitca_noi')), false); } } function role_permission_arr($D) { $fς = array(); $e˥ = $GLOBALS["\143\157\156\146\151\147"]["\160\141\164\150\122\157\154\145\104\145\146\151"."\x6e"."\x65"]; foreach ($D as $aڔ => $Dݜ) { if (!$Dݜ) { continue; } $Aԅ柊 = explode(strrev(':'), $aڔ); if (count($Aԅ柊) == 2 && is_array($e˥[$Aԅ柊[0]]) && is_array($e˥[$Aԅ柊[0]][$Aԅ柊[1]])) { $fς = array_merge($fς, $e˥[$Aԅ柊[0]][$Aԅ柊[1]]); } } $a = array(); foreach ($fς as $Dݜ) { $a[$Dݜ] = "\x31"; } return $a; } function check_file_writable_user($f׼Ѳ) { if (!isset($GLOBALS["\153\157\144\120\141\164\150\124\171\160\145"])) { _DIR($f׼Ѳ); } $C膺 = base64_decode('ZWRpdG9yLmZpbGU=')."\x53"."\x61\x76\x65"; if ($GLOBALS[_kstr2('isRoot')]) { return @is_writable($f׼Ѳ); } if ($GLOBALS["\141\165\164\150"][$C膺] != "\x31") { return false; } if ($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x54\x79\x70\x65"] == KOD_GROUP_PATH && is_array($GLOBALS[strrev('oRhtaPdok').strrev('uApuorGel')."\x74\x68"]) && $GLOBALS[_kstr2('kodPathRol')."\x65\x47"."\162\157\165\160\101\165\164\150"][$C膺] == "\x31") { return true; } if ($GLOBALS[base64_decode('a29kUGF0aFR5').strrev('ep')] == '' || $GLOBALS[base64_decode('a29kUGF0aFR5cA==')."\x65"] == KOD_USER_SELF) { return true; } return false; } function spaceSizeCheck() { if (!system_space()) { return; } if ($GLOBALS[base64_decode('aXNSb290')] == 1) { return; } if (isset($GLOBALS["\x6b\x6f\x64\x42\x65\x66\x6f\x72\x65\x50\x61"."\164\150\111".strrev('d')]) && isset($GLOBALS["\153\157\144\120\141\164\150\111"._kstr2('d')]) && $GLOBALS["\x6b\x6f\x64\x42\x65\x66\x6f\x72\x65\x50\x61\x74\x68"."\x49\x64"] == $GLOBALS["\153\157\144\120\141\164\150\111\144"]) { return; } if ($GLOBALS[strrev('epyThtaPdok')] == KOD_GROUP_SHARE || $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x54\x79\x70\x65"] == KOD_GROUP_PATH) { systemGroup::spaceCheck($GLOBALS["\153\157\144\120\141\164\150\111\144"]); } else { if (ST == base64_decode('c2hhcmU=')) { $Eȩ = $GLOBALS["\151\156"]["\x75\x73\x65\x72"]; } else { $Eȩ = $_SESSION["\x6b\x6f\x64\x55\x73\x65\x72"]["\x75\x73\x65\x72\x49\x44"]; } systemMember::spaceCheck($Eȩ); } } function spaceSizeGet($f׼Ѳ, $A᧚ގ) { $F = 0; if (is_file($f׼Ѳ)) { $F = get_filesize($f׼Ѳ); } else { if (is_dir($f׼Ѳ)) { $Eү߄ = _path_info_more($f׼Ѳ); $F = $Eү߄["\x73\x69\x7a\x65"]; } else { return strrev('ssim'); } } return $A᧚ގ ? $F : -$F; } function spaceInData($f׼Ѳ) { if (substr($f׼Ѳ, 0, strlen(HOME_PATH)) == HOME_PATH || substr($f׼Ѳ, 0, strlen(USER_RECYCLE)) == USER_RECYCLE) { return true; } return false; } function spaceSizeChange($eի, $A᧚ގ = true, $D = false, $B㱋 = false) { if (!system_space()) { return; } if ($D === false) { $D = $GLOBALS["\153\157\144\120\141\164\150\124\171\160\145"]; $B㱋 = $GLOBALS[strrev('dIhtaPdok')]; } $bц = spaceSizeGet($eի, $A᧚ގ); if ($bц == base64_decode('bWlzcw==')) { return false; } if ($D == KOD_GROUP_SHARE || $D == KOD_GROUP_PATH) { systemGroup::spaceChange($B㱋, $bц); } else { if (ST == strrev('erahs')) { $Eȩ = $GLOBALS["\x69\x6e"][base64_decode('dXNlcg==')]; } else { $Eȩ = $_SESSION["\153\157\144\125\163\145\162"]["\x75\x73\x65\x72\x49\x44"]; } systemMember::spaceChange($Eȩ, $bц); } } function spaceSizeChangeRemove($eի) { spaceSizeChange($eի, false); } function spaceSizeChangeMove($FԘ, $Aծߡ) { if (isset($GLOBALS["\153\157\144\102\145\146\157\162\145"._kstr2('PathId')]) && isset($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"])) { if ($GLOBALS[strrev('erofeBdok')."\x50\x61\x74\x68\x49\x64"] == $GLOBALS[strrev('dIhtaPdok')] && $GLOBALS[_kstr2('beforePathType')] == $GLOBALS[_kstr2('kodPathT')._kstr2('y')."\x70\x65"]) { return; } spaceSizeChange($Aծߡ, false); spaceSizeChange($Aծߡ, true, $GLOBALS["\x62\x65\x66\x6f\x72\x65\x50\x61\x74\x68\x54\x79\x70\x65"], $GLOBALS["\x6b\x6f\x64\x42\x65\x66\x6f\x72\x65".strrev('dIhtaP')]); } else { spaceSizeChange($Aծߡ); } } function spaceSizeReset() { if (!system_space()) { return; } $D = isset($GLOBALS[_kstr2('kodPathType')]) ? $GLOBALS[base64_decode('a29kUGF0aFR5cGU=')] : ''; $B㱋 = isset($GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49"."\144"]) ? $GLOBALS["\x6b\x6f\x64\x50\x61\x74\x68\x49\x64"] : ''; if ($D == KOD_GROUP_SHARE || $D == KOD_GROUP_PATH) { systemGroup::spaceChange($B㱋); } else { $Eȩ = $_SESSION["\x6b\x6f\x64\x55\x73\x65\x72"]["\165\163\145\162\111\104"]; systemMember::spaceChange($Eȩ); } } function init_session() { if (!function_exists("\x73\x65\x73\x73\x69\x6f\x6e\x5f\x73\x74\x61\x72\x74")) { show_tips(_kstr2('服务器')."\160\150\160"."\xe7\xbb\x84\xe4\xbb\xb6\xe7\xbc\xba"."\xe5\xa4"."\261\41\40"."\x28\x50\x48\x50\x20\x6d\x69\x73\x73\x20\x6c"."\x69\x62\x29\x3c\x62\x72\x2f\x3e\xe8"."\257\267\346\243\200"."\346\237\245\160\150\160\56\151\156\151\357\274\214\351"."\x9c\x80\xe8\xa6\x81\xe5\xbc\x80\xe5\x90\xaf".strrev(' :塨')."\x3c\x62\x72\x2f\x3e\x3c\x70\x72\x65"."\x3e\x73\x65\x73\x73\x69\x6f\x6e\x2c"."\x6a\x73\x6f\x6e\x2c\x63".base64_decode('dXJsLGV4aWY=')."\x2c\x6d\x62\x73\x74".strrev('adl,gnir')._kstr2('p,gd,pdo,pdo-m')."\x79\x73\x71\x6c\x2c\x78\x6d\x6c\x3c\x2f\x70\x72\x65\x3e".base64_decode('PGJyLz4=')); } if (isset($_REQUEST["\x61\x63\x63\x65\x73\x73\x54\x6f\x6b\x65\x6e"])) { access_token_check($_REQUEST["\141\143\143\145\163\163\124\157"."\153\145\156"]); } else { if (isset($_REQUEST["\x61\x63\x63\x65\x73\x73\x5f\x74\x6f\x6b\x65\x6e"])) { access_token_check($_REQUEST["\141\143\143\145\163\163\137\164"."\x6f\x6b\x65\x6e"]); } else { @session_name(SESSION_ID); } } $Eϝ = @session_save_path(); if (class_exists(strrev('egarotSeaS')) || defined("\x53\x41\x45\x5f\x41\x50\x50\x4e"."\x41"."\x4d\x45") || defined("\x53\x45\x53\x53\x49\x4f\x4e\x5f\x50"."\x41\x54"._kstr2('H_DEFAULT')) || @ini_get(strrev('.noisses')."\163\141\166\145\137\150\141\156".base64_decode('ZGxl')."\162") != "\146\151\154\145\163" || isset($_SERVER["\110\124\124\120\137\101\120\120\116\101\115\105"])) { } else { chmod_path(KOD_SESSION, 511); @session_save_path(KOD_SESSION); } @session_start(); $_SESSION["\x6b\x6f\x64"] = 1; @session_write_close(); @session_start(); if (!$_SESSION["\x6b\x6f\x64"]) { @session_save_path($Eϝ); @session_start(); $_SESSION[strrev('dok')] = 1; @session_write_close(); @session_start(); } if (!$_SESSION["\x6b\x6f\x64"]) { show_tips("\346\234\215\345\212\241\345\231\250"."\163\145\163\163\151\157\156\345"."\x86\x99\xe5\x85\xa5"._kstr2('失败! ')._kstr2('(').strrev('irw noisses').strrev(')rorre et')."\x3c\x62\x72".base64_decode('Lw==').base64_decode('Pg==') . "\xe8\xaf\xb7\xe6\xa3\x80\xe6\x9f\xa5\x70\x68".strrev('i.p')."\x6e\x69\xe7\x9b\xb8\xe5\x85\xb3\xe9"._kstr2('')."\215\347\275\256\54\346\237\245\347\234\213"._kstr2('磁盘')."\xaf\xe5\x90\xa6\xe5\xb7\xb2\xe6\xbb"._kstr2(',或咨询服').strrev('㆕塊')."\x82\x3c\x62\x72\x2f\x3e\x3c\x62\x72\x2f\x3e" . "\163\145\163\163\151\157\156\56\163\141".base64_decode('dmVfcGE=').base64_decode('dGg9') . $Eϝ . base64_decode('PGJyLz4=') . _kstr2('session.s').base64_decode('YXZlX2hhbmRsZXI9') . @ini_get("\x73\x65\x73\x73\x69\x6f\x6e\x2e"."\x73\x61\x76\x65\x5f\x68\x61\x6e\x64\x6c"."\x65\x72") . _kstr2('
')); } } function access_token_check($Bغ) { $b̡ = $GLOBALS["\143\157\156\146\151\147"][base64_decode('c2V0dGluZ1N5c3Rl').strrev('m')]["\163\171\163\164\145\155\120\141\163\163\167\157\162\144"]; $b̡ = substr(md5("\153\157\144\105\170\160\154\157\162\145\162"."\x5f" . $b̡), 0, 15); $e = Mcrypt::decode($Bغ, $b̡); if (!$e) { show_tips("\x61\x63\x63\x65\x73\x73\x54\x6f\x6b\x65\x6e".strrev('!rorre ')); } session_id($e); session_name(SESSION_ID); } function access_token_get() { $e = session_id(); $b̡ = $GLOBALS[strrev('gifnoc')]["\x73\x65\x74\x74\x69\x6e\x67\x53\x79"."\163\164"."\x65\x6d"][_kstr2('systemPass')."\x77\x6f\x72\x64"]; $b̡ = substr(md5(base64_decode('a29kRXhwbG8=')."\x72\x65\x72\x5f" . $b̡), 0, 15); $DЯ = Mcrypt::encode($e, $b̡, 3600 * 24); return $DЯ; } function init_config() { init_setting(); init_session(); init_space_size_hook(); } diff --git a/app/function/common.function.php b/app/function/common.function.php index 282b0e7d..f03981a6 100755 --- a/app/function/common.function.php +++ b/app/function/common.function.php @@ -119,14 +119,11 @@ function mtime(){ /** * 过滤HTML */ -function clear_html($HTML, $br = true){ - $HTML = htmlspecialchars(trim($HTML)); - $HTML = str_replace("\t", ' ', $HTML); - if ($br) { - return nl2br($HTML); - } else { - return str_replace("\n", '', $HTML); - } +function clear_html($html, $br = true){ + $html = $html === null ? "" : $html; + $replace = array('<','>','"',"'"); + $replaceTo = array('<','>','"','''); + return str_replace($replace,$replaceTo,$html); } /** diff --git a/app/function/file.function.php b/app/function/file.function.php index f694ec37..a0ea6ca6 100755 --- a/app/function/file.function.php +++ b/app/function/file.function.php @@ -1035,10 +1035,18 @@ function file_put_out($file,$download=-1,$downFilename=false){ } header('Etag: '.$etag); header('Last-Modified: '.$time.' GMT'); - header("X-OutFileName: ".$filenameOutput); + header("X-OutFileName: ".$filename); header("X-Powered-By: kodExplorer."); header("X-FileSize: ".$file_size); + // 过滤svg中非法script内容; 避免xxs; + if(!$download && get_path_ext($filename) == 'svg'){ + if($file_size > 1024*1024*5) {exit;} + $content = file_get_contents($file); + $content = removeXXS($content); + echo $content;exit; + } + //远程路径不支持断点续传；打开zip内部文件 if(!file_exists($file)){ header('HTTP/1.1 200 OK'); @@ -1089,6 +1097,54 @@ function file_put_out($file,$download=-1,$downFilename=false){ } fclose($fp); } +function removeXXS($val){ + $val = preg_replace('/([\x00-\x08\x0b-\x0c\x0e-\x19])/', '', $val); + $search = 'abcdefghijklmnopqrstuvwxyz'; + $search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'; + $search .= '1234567890!@#$%^&*()'; + $search .= '~`";:?+/={}[]-_|\'\\'; + for ($i = 0; $i < strlen($search); $i++) { + // ;? matches the ;, which is optional + // 0{0,7} matches any padded zeros, which are optional and go up to 8 chars + // @ @ search for the hex values + $val = preg_replace('/(&#[xX]0{0,8}' . dechex(ord($search[$i])) . ';?)/i', $search[$i], $val); // with a ; + // @ @ 0{0,7} matches '0' zero to seven times + $val = preg_replace('/(�{0,8}' . ord($search[$i]) . ';?)/', $search[$i], $val); // with a ; + } + + // now the only remaining whitespace attacks are \t, \n, and \r + $ra1 = array('javascript', 'vbscript', 'expression', 'applet', 'meta', 'xml', 'blink', 'link', 'style', 'script', 'embed', 'object', 'iframe', 'frame', 'frameset', 'ilayer', 'layer', 'bgsound', 'title', 'base'); + + $ra1 = array('javascript', 'vbscript', 'expression','script');// 过多,误判 + $ra2 = array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload'); + $ra = array_merge($ra1, $ra2); + + $found = true; // keep replacing as long as the previous round replaced something + while ($found == true) { + $val_before = $val; + for ($i = 0; $i < sizeof($ra); $i++) { + $pattern = '/'; + for ($j = 0; $j < strlen($ra[$i]); $j++) { + if ($j > 0) { + $pattern .= '('; + $pattern .= '(&#[xX]0{0,8}([9ab]);)'; + $pattern .= '|'; + $pattern .= '|(�{0,8}([9|10|13]);)'; + $pattern .= ')*'; + } + $pattern .= $ra[$i][$j]; + } + $pattern .= '/i'; + $replacement = substr($ra[$i], 0, 2) . '_' . substr($ra[$i], 2); // add in <> to nerf the tag + $val = preg_replace($pattern, $replacement, $val); // filter out the hex tags + if ($val_before == $val) { + // no replacements were made, so exit the loop + $found = false; + } + } + } + return $val; +} /** * 远程文件下载到服务器 diff --git a/app/function/helper.function.php b/app/function/helper.function.php index 27d29bfb..e1e9f701 100755 --- a/app/function/helper.function.php +++ b/app/function/helper.function.php @@ -3,6 +3,7 @@ //扩展名权限判断 有权限则返回1 不是true function checkExt($file){ if($GLOBALS['isRoot']) return 1; + if($file == '.htaccess' || $file == '.user.ini') return false; if (strstr($file,'<') || strstr($file,'>') || $file=='') { return 0; } @@ -17,7 +18,7 @@ function checkExt($file){ $extArr = array_merge($extArr,array('phtml','phtm','htaccess','pwml')); } if(in_array('htm',$extArr) || in_array('html',$extArr)){ - $extArr = array_merge($extArr,array('html','shtml','shtm','html')); + $extArr = array_merge($extArr,array('html','shtml','shtm','html','svg')); } foreach ($extArr as $current) { if ($current !== '' && stristr($file,'.'.$current)){//含有扩展名 diff --git a/app/kod/Mcrypt.class.php b/app/kod/Mcrypt.class.php index 66f6e482..069afaed 100755 --- a/app/kod/Mcrypt.class.php +++ b/app/kod/Mcrypt.class.php @@ -110,7 +110,8 @@ public static function decode($string,$key = '') $box[$j] = $tmp; $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256])); } - if ((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) + $theTime = intval(substr($result, 0, 10)); + if (($theTime == 0 || $theTime - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26) . $keyb), 0, 16) ) { return substr($result, 26); diff --git a/app/template/api/view.html b/app/template/api/view.html index 28467829..59fc25af 100755 --- a/app/template/api/view.html +++ b/app/template/api/view.html @@ -68,17 +68,15 @@ diff --git a/app/template/explorer/explorerWap.html b/app/template/explorer/explorerWap.html index a7984363..14c5fbda 100755 --- a/app/template/explorer/explorerWap.html +++ b/app/template/explorer/explorerWap.html @@ -19,7 +19,7 @@ echo ''; ?> -

+

diff --git a/app/template/share/edit.html b/app/template/share/edit.html index 40df459f..f94b5e3d 100755 --- a/app/template/share/edit.html +++ b/app/template/share/edit.html @@ -1,5 +1,5 @@ - <?php echo $shareInfo['name'].' - '.LNG('share_title').' - '.strip_tags(LNG('kod_name')).LNG('kod_power_by');?> + <?php echo clear_html($shareInfo['name']).' - '.LNG('share_title').' - '.strip_tags(LNG('kod_name')).LNG('kod_power_by');?> diff --git a/app/template/share/editor.html b/app/template/share/editor.html index 605eb4df..fe64d553 100755 --- a/app/template/share/editor.html +++ b/app/template/share/editor.html @@ -1,5 +1,5 @@ - <?php echo $shareInfo['name'].' - '.LNG('share_title').' - '.strip_tags(LNG('kod_name')).LNG('kod_power_by');?> + <?php echo clear_html($shareInfo['name']).' - '.LNG('share_title').' - '.strip_tags(LNG('kod_name')).LNG('kod_power_by');?> diff --git a/app/template/share/explorer.html b/app/template/share/explorer.html index d80493c5..3e73ea6b 100755 --- a/app/template/share/explorer.html +++ b/app/template/share/explorer.html @@ -1,5 +1,5 @@ - <?php echo $shareInfo['name'].' - '.LNG('share_title').' - '.strip_tags(LNG('kod_name')).LNG('kod_power_by');?> + <?php echo clear_html($shareInfo['name']).' - '.LNG('share_title').' - '.strip_tags(LNG('kod_name')).LNG('kod_power_by');?> @@ -42,7 +42,7 @@