微博上传图片时只在前端进行验证, 服务器端没有进行安全过滤。# d7 `1 B) O" J
1 o+ \6 E1 ?8 A8 z0 ?/ R; o
G& g' Z! r7 p9 R$ c\api\StatusesApi.class.php8 h) B& v' c6 K0 m* W- o
; t+ h" {' U- I8 I7 Z- q
function uploadpic(){+ m/ K9 }/ I) b* x
if( $_FILES['pic'] ){
. r' ~6 ~& D1 S0 i- o: q( { //执行上传操作
; ]4 F, {" q- h6 Q, \0 ]6 N $savePath = $this->_getSaveTempPath();
$ t6 r5 M' _4 G$ K/ O+ s4 \ $filename = md5( time().'teste' ).'.'.substr($_FILES['pic']['name'],strpos($_FILES['pic']['name'],'.')+1);
# V* H( }3 g; j2 ? if(@copy($_FILES['pic']['tmp_name'], $savePath.'/'.$filename) || @move_uploaded_file($_FILES['pic']['tmp_name'], $savePath.'/'.$filename))
( i6 F1 c' w6 h& r {
( }' d; X' @( a6 r4 q7 g $result['boolen'] = 1;% C9 z# n+ N3 M. h6 e
$result['type_data'] = 'temp/'.$filename;9 M2 Q; |! F5 g
$result['picurl'] = SITE_PATH.'/uploads/temp/'.$filename;; ~2 r: Z, ?8 y$ g# m' G
} else {' b& f. ]9 v: W8 h
$result['boolen'] = 0;' F8 _& O. x- ]
$result['message'] = '上传失败';
6 g1 L& O, o* V+ R8 t+ M }" m- b6 o: q9 a7 @% \ u; z2 U, r
}else{9 w5 I9 O! x$ F2 V5 V$ j/ C3 u8 E
$result['boolen'] = 0;: o, ?$ }: @( J0 J. ~- C, @
$result['message'] = '上传失败';
& n- @, p2 m* P2 l- S8 g( E. U& g }
. u9 W$ V' @, j. Hreturn $result;( |+ a; M4 u# _0 [6 f5 k# }4 m
}. N) B3 D9 j6 |0 ?
unloadpic()方法没有对文件类型进行验证; p' h8 S$ o# m3 q# o! E% u
* b1 ^/ D% M4 k M. b可以构建表单, 选择任意文件, 提交到8 P& ?' P% A6 |6 A/ o
/index.php?app=w3g&mod=Index&act=doPost. ^- i; H2 s" z" q: N
/ N0 L p0 ?5 S2 |. P! j在新提交的微博上可以找到上传的文件地址(去掉small_、middle_ 前缀)4 D9 W/ f) Z1 {$ u
& H1 J- ~9 |2 H( ], C
) U6 q8 j7 U( ?. ]在登录thinksns官方微博后,
& i9 D5 k4 Q' I/ h0 d% Q构建以下表单:
, l0 Y& v: j$ f
% E. V6 l1 A3 Q( `0 J7 }<form action="http://t.thinksns.com/index.php?app=w3g&mod=Index&act=doPost" method="post" enctype="multipart/form-data" />
+ L! [1 N. a5 b4 t<textarea name="content">test</textarea>: c7 T, X0 u: b; f
file: <input id="file" type="file" name="pic" />
# a" o+ o0 T6 I. K<input type="submit" value="Post" />! G t: D+ d0 d# z/ V! ?3 Y) B
</form>
. L) a7 p% X' O- f- q& q8 `5 r- {! L去掉缩略图的前缀(small_ )
+ ?5 b2 a% i* y5 Y# b. V修复方案:
) b! ?# v+ ?& I% t" c- ] _
, Z9 Y: K& L; ~& T+ P2 o
: \; k% Y6 m! A\api\StatusesApi.class.php$ g" R, m. p3 g6 s, s2 q- o, j
- a V$ k: c; V9 ] R" Bfunction uploadpic(){! G% `. V& s1 w ?# V
/**, P5 M6 F/ y# d$ Y- a
* 20121018 @yelo
* ^( ?( v" Q( ?4 R: \4 v7 `5 i * 增加上传类型验证. T5 l, F" N- j! m1 c4 c. p
*/) u& b! e( ^0 E) C/ y9 ?0 x
$pathinfo = pathinfo($_FILES['pic']['name']);
& Z% R# h1 X7 U- h$ b $ext = $pathinfo['extension'];
' [% a$ a; m! G! p0 A5 r $allowExts = array('jpg', 'png', 'gif', 'jpeg');7 V1 y# J. A; x' k/ E/ I8 k( Q
* s# b0 s F3 I3 ~7 h
$uploadCondition = $_FILES['pic'] && in_array(strtolower($ext),$allowExts,true);0 u+ e1 U5 v0 \ X6 ?, z
: x9 n: \6 i3 m# v& k6 x0 X if( $uploadCondition ){
& D. n5 S! Z3 \ //执行上传操作
7 n) R: _% v8 ^ $savePath = $this->_getSaveTempPath();
( {- d- l* R0 L $filename = md5( time().'teste' ).'.'.substr($_FILES['pic']['name'],strpos($_FILES['pic']['name'],'.')+1);( Z* ?$ @; t. g
if(@copy($_FILES['pic']['tmp_name'], $savePath.'/'.$filename) || @move_uploaded_file($_FILES['pic']['tmp_name'], $savePath.'/'.$filename))( C" e4 p7 o& G3 V" Z R& Z; z
{( v/ s0 V' ^+ t- R4 P/ l1 a- g
$result['boolen'] = 1;
' v+ ], G, a0 U% F $result['type_data'] = 'temp/'.$filename;3 C: p' c+ O/ @
$result['picurl'] = SITE_PATH.'/uploads/temp/'.$filename;$ n, D5 o N7 u' _
} else {
! A7 A7 X2 a! u- D $result['boolen'] = 0;$ Q7 a& e; I! h
$result['message'] = '上传失败';
, R; A2 D1 p7 {2 Q7 K5 Z }, ~7 x$ S, E% b9 |" |4 m
}else{ c7 P" P R2 u- Q: I# {
$result['boolen'] = 0;5 e$ t. a% }. c# g/ L; R
$result['message'] = '上传失败';4 M7 T ~+ D: p+ ?; @2 Q% ^3 D& ?- E
}
' [+ J$ o4 _/ N2 R7 f: y7 L8 jreturn $result;8 g3 L# P! Z+ S) d( I/ n. S# ?4 e# ^
}
. w" Q, l! I6 Z( s# n* h# a! Y. Q8 E- K$ |- \/ X% p5 f' d( [
, v* `# y' k6 O; Y5 D; j
|