WooYun.org

public function upload() {
        // 大众版头像上传处理 2014-6-15
        if (!isset($GLOBALS['HTTP_RAW_POST_DATA'])) {
            exit(function_exists('iconv') ? iconv('UTF-8', 'GBK', '环境不支持') : 'The php does not support');
        }
        // 创建图片存储文件夹
        $dir = FCPATH.'member/uploadfile/member/'.$this->uid.'/';
        if (!file_exists($dir)) {
            mkdir($dir, 0777, true);
        }
        $filename = $dir.'avatar.zip'; // 存储flashpost图片
        file_put_contents($filename, $GLOBALS['HTTP_RAW_POST_DATA']);
        // 解压缩文件
        $this->load->library('Pclzip');
        $this->pclzip->PclFile($filename);
        $content = $this->pclzip->listContent();
        if (!$content) {
            @unlink($filename);
            exit(function_exists('iconv') ? iconv('UTF-8', 'GBK', '文件已损坏') : 'The file has damaged');
        }
        // 验证文件
        foreach ($content as $t) {
            if (strpos($t['stored_filename'], '..') !== FALSE ||
                strpos($t['filename'], '..') !== FALSE ||
                strpos($t['filename'], '/') !== FALSE ||
                strpos($t['stored_filename'], '/') !== FALSE) {
                @unlink($filename);
                exit(function_exists('iconv') ? iconv('UTF-8', 'GBK', '非法名称的文件') : 'llegal name file');
            }
            if (substr(strrchr($t['stored_filename'], '.'), 1) != 'jpg') {
                @unlink($filename);
                exit(function_exists('iconv') ? iconv('UTF-8', 'GBK', '文件格式校验不正确') : 'The document format verification is not correct');
            }
        }
        // 解压文件
        if ($this->pclzip->extract(PCLZIP_OPT_PATH, $dir, PCLZIP_OPT_REPLACE_NEWER) == 0) {
            @dr_dir_delete($dir);
            exit($this->pclzip->zip(true));
        }
        @unlink($filename);
        if (!is_file($dir.'45x45.jpg') || !is_file($dir.'90x90.jpg')) {
            exit('文件创建失败');
        }