WooYun.org

<?php
/**
 * uploadfilesave.php
 * 访客端文件上传.
 */
require_once('../global.inc.php');
/*
chdir($CONFIG["canned_file_tmp"]);
exec("rm -rf *");
*/
$date = date("Ymd");
$dest = $CONFIG->basePath."data/files/".$date."/";
$COMMON->createDir($dest);
//if (!is_dir($dest))	mkdir($dest, 0777);
$nameExt = strtolower($COMMON->getFileExtName($_FILES['inputSendFile']['name']));
$unallowedType = array('php', 'jsp', 'asp', 'sh', 'pl', 'js', 'jar', 'jad', 'class', 'java');
if(in_array($nameExt, $unallowedType)){
	$msg = 2;
}
if(empty($msg)){
	$filename = getmicrotime().'.'.$nameExt;
	$file_url = urlencode($CONFIG->baseUrl.'data/files/'.$date."/".$filename);
	
	$filename = $dest.$filename;
	if(empty($_FILES['inputSendFile']['error'])){
		move_uploaded_file($_FILES["inputSendFile"]["tmp_name"],$filename);
	}
	
	if (file_exists($filename)){
		$msg = 1;
		$url = $file_url;
		@chmod($filename, 0444);
	}else{
		$msg = 0;
	}
}
function getmicrotime(){ 
    list($usec, $sec) = explode(" ",microtime()); 
    return ((float)$usec + (float)$sec); 
}
echo "{";
echo	"msg: '" . $msg . "',\n";
echo	"url: '" . $url . "'\n";
echo "}";
?>