youpaishidifu/wenquanauth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

加固-01/02: CWD 无关 include 改造 + UEditor 全入口鉴权 (P0-01)

Browse Source 
A. 相对路径 include/require 全量改写为 __DIR__ 基址
   - 修复 nginx+fastcgi 下 php-cgi 继承启动目录 CWD (D:\phpstudy_pro\COM)
     导致 require '../function/...' 相对路径 include 全部失效；
     28 文件 101 处统一改为 __DIR__ 绝对基址，任意 Web 服务器行为一致。
   - 补齐带括号/缺斜杠漏改的 13 处 (controller.php、epay lib、
     payment.php、notify_url.php、return_url.php)。
   - function/config.inc.php 增加 config.local.inc.php 本地覆盖机制
     (该文件加入 .gitignore 不入库)，仓库默认配置保持中立。

B. UEditor 后台入口安全加固 (P0-01)
   - admin/php/controller.php 全部 action 前置管理员会话校验
     (admin_username + admin_password)，匿名无法上传/抓取/列目录/读配置。
   - 禁用远程图片抓取 catchimage (SSRF 向量)，删除 action_crawler.php。
   - 上传/列表白名单剔除 .exe/.dll/.iso/.cab/.swf。
   - Uploader: 移除 iconv('unicode') Windows 告警行；
     getFileInfo/action_list 的 URL 拼接增加 REQUEST_SCHEME 回退。

验证: 匿名访问全部 action 返回未授权；登录态上传成功且 URL 正确；
catchimage 已禁用；JSON 合法；全量 php -l 0 错误；
nginx(8081) 与内置服务器(8082) 双通道回归通过。
This commit is contained in:
youpaishidifu
2026-10-10 11:10:29 +08:00
parent e4a7137206
commit 6669f4bc9c
33 changed files with 121 additions and 155 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ajax.php
+18 -18
View File
@@ -6,7 +6,7 @@
* Time: 13:24
*/
include "function/function_core.php";
include __DIR__ . "/function/function_core.php";
error_reporting(E_ALL);
switch ($_GET['mod']) {
case 'buy_applist':
@@ -21,7 +21,7 @@ switch ($_GET['mod']) {
die($i);
break;
case 'loadbuylist':
include 'function/function_app.php';
include __DIR__ . '/function/function_app.php';
$where = array();
$where['openbuy'] = '1';
@@ -84,7 +84,7 @@ switch ($_GET['mod']) {
die($info);
break;
case 'buy_first':
include "function/function_app.php";
include __DIR__ . "/function/function_app.php";
$fidinfo = $db->select_first_row('sq_fidlist', '*', array('ID' => $_GET['fid']), 'AND');
$appinfo = app_idgetinfo($fidinfo['appid']);
$output = '<!DOCTYPE html>
@@ -253,7 +253,7 @@ function dofill() {
die($output);
break;
case 'buy_agent':
include './function/VerificationCode.class.php';
include __DIR__ . '/function/VerificationCode.class.php';
$verification = Verification::check($_POST['token']);
if ($verification !== true) {
die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
@@ -335,12 +335,12 @@ function dofill() {
break;
case 'buy_submit':
include './function/VerificationCode.class.php';
include __DIR__ . '/function/VerificationCode.class.php';
$verification = Verification::check($_POST['token']);
if ($verification !== true) {
die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
}
include 'function/function_app.php';
include __DIR__ . '/function/function_app.php';
if (empty($_POST['kt_key'])) {
$_POST['kt_key'] = '无';
@@ -538,14 +538,14 @@ function dofill() {
}
break;
case 'queryauth':
include './function/VerificationCode.class.php';
include __DIR__ . '/function/VerificationCode.class.php';
$verification = Verification::check($_POST['token']);
if ($verification !== true) {
die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
}
if($result = $db->select_first_row('sq_bclist','*',array('obj'=>$_POST['qq']),'AND')){
if ($result['appid'] != 0){
include_once 'function/function_app.php';
include_once __DIR__ . '/function/function_app.php';
$app = app_idgetname($result['appid']);
}else{
$app = '所有应用';
@@ -558,7 +558,7 @@ function dofill() {
die('查询的QQ号码不能为空');
}
$info = $db->select_all_row('sq_agent', 'begintime,levelid,qq', array('qq' => $_POST['qq'], 'status' => 1), 'AND');
include 'function/function_app.php';
include __DIR__ . '/function/function_app.php';
if (!is_array($info) || count($info) == 0) {
echo('QQ' . $_POST['qq'] . '没有查询到任何代理信息' . '<br>');
} else {
@@ -619,7 +619,7 @@ function dofill() {
die($i);
break;
case 'FieldKamiOpen_First':
include './function/VerificationCode.class.php';
include __DIR__ . '/function/VerificationCode.class.php';
$verification = Verification::check($_GET['token']);
if ($verification !== true) {
die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
@@ -628,7 +628,7 @@ function dofill() {
if ($info['status'] != 1) die('卡密已被冻结');
if ( !empty($info['user']) || !empty($info['usetime'])) die('卡密已被使用');
if (!$fidinfo = $db->select_first_row('sq_fidlist','fidname,appid',array('ID'=>$info['fid']),'AND'))die('无法找到对应套餐，请联系管理员处理');
include "function/function_app.php";
include __DIR__ . "/function/function_app.php";
$appinfo = app_idgetinfo($fidinfo['appid']);
$output = '<!DOCTYPE html>
<html>
@@ -744,7 +744,7 @@ function buy_submit(id,type) {
break;
case 'FieldKeyBuy_submit':
error_reporting(E_ALL);
include './function/VerificationCode.class.php';
include __DIR__ . '/function/VerificationCode.class.php';
$verification = Verification::check($_POST['token']);
if ($verification !== true) {
die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
@@ -754,7 +754,7 @@ function buy_submit(id,type) {
if ( !empty($info['user']) || !empty($info['usetime'])) die(json_encode(array('code' => '-102', 'msg' => '卡密已被使用')));
if (!$fidinfo = $db->select_first_row('sq_fidlist','*',array('ID'=>$info['fid']),'AND'))die(json_encode(array('code' => '-201', 'msg' => '套餐无法找到，请联系管理员')));;
$tips='';
include 'function/function_app.php';
include __DIR__ . '/function/function_app.php';
if (!$appinfo = app_idgetinfo($fidinfo['appid'])) {
die(json_encode(array('code' => -2, 'msg' => '无法找到应用，也许是该应用已下架')));
}
@@ -870,7 +870,7 @@ function buy_submit(id,type) {
}
//$newtrade['ID'] = $db->insert_back_id('sq_trade', $newtrade);
include_once './function/function_auth.php';
include_once __DIR__ . '/function/function_auth.php';
$back = auth_add($newtrade['user'],$newtrade['pass'],$newtrade['ip'], $fidinfo['num'],$newtrade['uqq'],$newtrade['mail'],$fidinfo['appid'],3,$info['ID'],$info['aid'],$newkey,$tips,$newtrade);
$db->update('sq_fidkey',array('ID'=>$info['ID']),'AND',array('usetime'=>time(),'user'=>$newtrade['user']));
if ($back == 1){
@@ -885,7 +885,7 @@ function buy_submit(id,type) {
break;
case 'changegetform':
include './function/function_app.php';
include __DIR__ . '/function/function_app.php';
if(!$appinfo = app_idgetinfo(intval($_POST['appid']))){
die('');
}
@@ -985,12 +985,12 @@ function buy_submit(id,type) {
die($output);
break;
case 'ChangeGetVerCode':
include './function/VerificationCode.class.php';
include __DIR__ . '/function/VerificationCode.class.php';
$verification = Verification::check($_POST['token']);
if ($verification !== true) {
die(json_encode(array('code' => '-88', 'msg' => '请先进行人机验证')));
}
include './function/function_app.php';
include __DIR__ . '/function/function_app.php';
if(!$appinfo = app_idgetinfo(intval($_POST['applist']))){
die(makejson(-1,'请先选择一个应用'));
}
@@ -1076,7 +1076,7 @@ function buy_submit(id,type) {
die('验证码错误，请重新输入');
}
include_once './function/function_app.php';
include_once __DIR__ . '/function/function_app.php';
if(!$appinfo = app_idgetinfo($_POST['applist'])){
die('服务器错误：应用无法找到');
}