加固-01/02: CWD 无关 include 改造 + UEditor 全入口鉴权 (P0-01)

A. 相对路径 include/require 全量改写为 __DIR__ 基址
   - 修复 nginx+fastcgi 下 php-cgi 继承启动目录 CWD (D:\phpstudy_pro\COM)
     导致 require '../function/...' 相对路径 include 全部失效；
     28 文件 101 处统一改为 __DIR__ 绝对基址，任意 Web 服务器行为一致。
   - 补齐带括号/缺斜杠漏改的 13 处 (controller.php、epay lib、
     payment.php、notify_url.php、return_url.php)。
   - function/config.inc.php 增加 config.local.inc.php 本地覆盖机制
     (该文件加入 .gitignore 不入库)，仓库默认配置保持中立。

B. UEditor 后台入口安全加固 (P0-01)
   - admin/php/controller.php 全部 action 前置管理员会话校验
     (admin_username + admin_password)，匿名无法上传/抓取/列目录/读配置。
   - 禁用远程图片抓取 catchimage (SSRF 向量)，删除 action_crawler.php。
   - 上传/列表白名单剔除 .exe/.dll/.iso/.cab/.swf。
   - Uploader: 移除 iconv('unicode') Windows 告警行；
     getFileInfo/action_list 的 URL 拼接增加 REQUEST_SCHEME 回退。

验证: 匿名访问全部 action 返回未授权；登录态上传成功且 URL 正确；
catchimage 已禁用；JSON 合法；全量 php -l 0 错误；
nginx(8081) 与内置服务器(8082) 双通道回归通过。

agent/ajax.php

@@ -6,7 +6,7 @@
  * Time: 22:12
  * 测试的
  */
-include '../function/function_core.php';
+include __DIR__ . '/../function/function_core.php';
 if ($_GET['mod'] === 'login') {
     if (!empty($_POST['token'])) {
         if (!$result = $db->select_first_row('sq_agent', '*', array('accesstoken' => $_POST['token']), 'AND')) {
@@ -23,7 +23,7 @@ if ($_GET['mod'] === 'login') {
     }
 
 
-    include '../function/VerificationCode.class.php';
+    include __DIR__ . '/../function/VerificationCode.class.php';
     $verification = Verification::check($_POST['token']);
     if ($verification !== true) {
         die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
@@ -108,7 +108,7 @@ switch ($_GET['mod']) {
         if (!$levelinfo = $db->select_first_row('sq_level', '*', array('ID' => $agentinfo['levelid']), 'AND')) {
             die(json_encode(array('code' => -2, 'msg' => '代理等级信息获取失败！')));
         }
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         $where = array();
         $i = '<option value="0">显示所有商品</option>';
         $info = explode(',', $levelinfo['appid']);
@@ -130,7 +130,7 @@ switch ($_GET['mod']) {
         die($i);
         break;
     case 'buy_fidlist':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
 
         //$where['agentbuy'] = '1';
         if (!$agentinfo = $db->select_first_row('sq_agent', '*', array('username' => $_SESSION['agent_username']), 'AND')) {
@@ -235,7 +235,7 @@ switch ($_GET['mod']) {
         //echo $whereinfo;
         $backinfo['code'] = 0;
         $backinfo['count'] = $db->select_count_row('sq_user', $whereinfo, 'AND');
-        include "../function/function_app.php";
+        include __DIR__ . "/../function/function_app.php";
         $appinfo = app_idgetinfo($_GET['appid']);
         if (!$arr = $db->select_limit_row('sq_user', '*', ($_GET['page'] - 1) * $_GET['limit'], $_GET['limit'], $whereinfo, 'AND')) {
             //$backinfo['code'] = -1;
@@ -332,7 +332,7 @@ switch ($_GET['mod']) {
 
     case 'buy_first':
 
-        include "../function/function_app.php";
+        include __DIR__ . "/../function/function_app.php";
         $fidinfo = $db->select_first_row('sq_fidlist', '*', array('ID' => $_GET['fid']), 'AND');
         $appinfo = app_idgetinfo($fidinfo['appid']);
         $show_form = '';
@@ -393,11 +393,11 @@ switch ($_GET['mod']) {
             }
             $type = 3;
         }
-        include './html/buy.page.inc.php';
+        include __DIR__ . '/html/buy.page.inc.php';
         die();
         break;
     case 'buy_submit':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
 
         if (!$fidinfo = $db->select_first_row('sq_fidlist', '*', array('ID' => $_POST['id']), 'AND')) {
             die(json_encode(array('code' => -2, 'msg' => '无法找到该商品，请刷新页面重试')));
@@ -828,7 +828,7 @@ switch ($_GET['mod']) {
         }
         break;
     case 'getagentlist':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         if (!$result = $db->select_limit_row('sq_agent', '*', ($_GET['page'] - 1) * $_GET['limit'], $_GET['limit'], array('superior' => $_SESSION['agent_id']), 'AND')) {
             $error = $db->geterror();
             if (!empty($error)) {
@@ -893,7 +893,7 @@ switch ($_GET['mod']) {
         }
         break;
     case 'leveltips':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         if (!$levelinfo = $db->select_first_row('sq_level', '*', array('ID' => $_POST['leval']), 'AND')) {
             die('等级信息获取失败');
         }
@@ -905,7 +905,7 @@ switch ($_GET['mod']) {
         die('<center>代理应用：' . $appinfo . '，等级名称：' . $levelinfo['lname'] . '，升级金额：' . $levelinfo['price'] . '，拿货折率：' . $levelinfo['fracture'] . '<br>注意：升级后当前等级会被释放，而不是同时有两个等级，如果希望有多个等级请联系站长新开代理账号！</center>');
         break;
     case 'addagenttips':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         if (!$agentinfo = $db->select_first_row('sq_agent', '*', array('username' => $_SESSION['agent_username']), 'AND')) {
             die('代理信息获取失败');
         }
@@ -945,7 +945,7 @@ switch ($_GET['mod']) {
 
         break;
     case 'fidlist_show':
-        include '../function/function_app.php';
+        include __DIR__ . '/../function/function_app.php';
         //$where['agentbuy'] = '1';
         if (!$agentinfo = $db->select_first_row('sq_agent', '*', array('username' => $_SESSION['agent_username']), 'AND')) {
             die(json_encode(array('code' => -2, 'msg' => '代理信息获取失败')));

agent/index.php

@@ -5,7 +5,7 @@
  * Date: 2017-10-15
  * Time: 12:08
  */
-require '../function/function_core.php';
+require __DIR__ . '/../function/function_core.php';
 if (empty($_SESSION['agent_username']) || empty($_SESSION['agent_password'])) {
     echo '没有登录:code:-1';
     header('Location: login.html');