WooYun.org

//保存头像
    public function doface() {
        $ysw=$_POST['ysw'];
        if ($ysw>660) {
            $zoom=intval($ysw)/660;
        } else {
            $zoom=1;
        }
        $x=$_POST['x']*$zoom;
        $y=$_POST['y']*$zoom;
        $w=$_POST['w']*$zoom;
        $h=$_POST['h']*$zoom;
        $imgpath=ET_ROOT.$_POST['imgpath'];
        //imgpath过滤了一些参数，但../等未过滤，致使任意文件删除
        $ext=strtolower(getExtensionName($imgpath));
        // var_dump($imgpath);die;
        import("@.ORG.IoHandler");
        $IoHandler = new IoHandler();
        if(!isImage($imgpath)) {
        	// var_dump($imgpath);die;
            $IoHandler->DeleteFile($imgpath);
            //ok了，任意文件删除
			setcookie('setok', json_encode(array('lang'=>L('face2'),'ico'=>2)),0,'/');
            header('location:'.SITE_URL.'/?m=setting&a=face');
            exit;
        }
        $image_path = ET_ROOT.'/Public/attachments/head/'.date('Ymd').'/';
        if(!is_dir($image_path)) {
            mkdir($image_path);
        }
        $f=date('His');
        //大图片
		import("@.ORG.makethumb");
		$makethumb=new makethumb();
        $filename=$f.'_big.'.$ext;
        $dst_file = $image_path.$filename;
        $make_result = $makethumb->dothumb($imgpath,$dst_file,max(10,min(120,$w)),max(10,min(120,$h)),0,0,$x,$y,$w,$h);
        //小图片
        $filename=$f.'_small.'.$ext;
        $dst_file = $image_path.$filename;
        $make_result = $makethumb->dothumb($imgpath,$dst_file,max(10,min(50,$w)),max(10,min(50,$h)),0,0,$x,$y,$w,$h);
        $IoHandler->DeleteFile($imgpath);
        M('Users')->where("user_id='".$this->my['user_id']."'")->setField('user_head',date('Ymd').'/'.$filename.'?v='.time());
		
		$plugin= A('Appaction');
		$plugin->do_action('saveface');
		setcookie('setok', json_encode(array('lang'=>L('face1'),'ico'=>1)),0,'/');
        header('location:'.SITE_URL.'/?m=setting&a=face');
    }