WooYun.org

if ( ACTION == "delete" )
{
    $file_ids = gss( $_GET['file'] );  //未过滤1
    $folder_ids = gss( $_GET['folder'] );  //未过滤2
    if ( $file_ids )
    {
        $result = $Netdisk->delFileByIDS( $user_id, $file_ids, 0 ); //跟踪delFileByIDS，第二个参数可控
        if ( !$result )
        {
            dump_json( array( "status" => 0, "message" => "删除文件时发生错误，删除失败！" ) );
        }
    }
    if ( $folder_ids )
    {
        $folder_list = explode( ",", $folder_ids );
        foreach ( $folder_list as $folder_id )
        {
                        $result = $Netdisk->recursionDelFolderByID( $user_id, $folder_id, 0 );
                        if ( !$result )
                        {
                            dump_json( array( "status" => 0, "message" => "删除文件夹时发生错误，删除失败！" ) );
                        }
        }
    }
    dump_json( array( "status" => 1, "message" => "" ) );
}
public function delFileByIDS( $_obfuscate_nQNptTJPg, $_obfuscate_7EPr4MtGdrQ, $_obfuscate_ySeUHBw = fals )
{
    $_obfuscate_IRFhnYw = "user_id='".$_obfuscate_nQNptTJPg."' AND file_id IN (".$_obfuscate_7EPr4MtGdrQ.")";
    return $this->delFileByWhere( $_obfuscate_nQNptTJPg, $_obfuscate_IRFhnYw, $_obfuscate_ySeUHBw );
}