WooYun.org

<?php
/**
 * screenImagesSave.php
 * 
 */
require_once('../global.inc.php');
//get request.
$ft = intval($_REQUEST['ft']);
/*
chdir($CONFIG["canned_file_tmp"]);
exec("rm -rf *");
*/
$date = date("Ymd");
$dest = $CONFIG->basePath.'data/files/'.$date."/";
if (!is_dir($dest))	mkdir($dest, 0777);
$filename = paramsFmt(urldecode($_GET["filename"]));
$nameExt = strtolower($COMMON->getFileExtName($_FILES['file']['name']));
$unallowedType = array('php', 'jsp', 'asp', 'sh', 'pl', 'js', 'jar', 'jad', 'class', 'java');
if(in_array($nameExt, $unallowedType)){
	if($ft == '1'){
		echo 'pe';
	}else if($ft == '2'){
		echo 'fe';
	}	
	exit;
}
/*
if (empty($filename)) $filename = date("Ymdhms")."_noname.file";
echo $date."/".$filename;
*/
$filenameNew = $dest.$filename;
if(empty($_FILES["file"]['error'])){
	move_uploaded_file($_FILES["file"]["tmp_name"],$filenameNew);
}
if(file_exists($filenameNew)){
	echo(urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename));
	@chmod($filenameNew, 0444);
}else{
	if($ft == '1'){
		echo 'pe';
	}else if($ft == '2'){
		echo 'fe';
	}
}
?>