WooYun.org

function download()
{
    $file = isset($_GET['file']) ? trim($_GET['file']) : '';
    $backup_name = isset($_GET['backup_name']) ? trim($_GET['backup_name']) : '';
    if (!$file)
    {
        $this->show_warning('no_such_file');
        return;
    }
     if (!$backup_name)
    {
        $this->show_warning('no_backup_name');
        return;
    }
    $sql_file = $this->backup_path . $backup_name . '/' . $file;//直接拼接就下载了，未过滤..
    //print_r($sql_file);
    if (file_exists($sql_file))
    {
        header('Content-type: application/unknown');
        header('Content-Disposition: attachment; filename="'. $file. '"');
        header("Content-Length: " . filesize($sql_file) ."; ");
        readfile($sql_file);
    }
    else
    {
        $this->show_warning('no_such_file1');
        return;
    }
}