强网杯 2021 线下赛 WEB WP

 public function adminLoginStyle()
 {
     $config = $this->getAddonConfig();
     if ($config['mode'] == 'random' || $config['mode'] == 'daily') {
         $gettime     = $config['mode'] == 'random' ? mt_rand(-1, 7) : 0;
         $json_string = file_get_contents('https://www.bing.com/HPImageArchive.aspx?format=js&idx=' . $gettime . '&n=1');
         $data        = json_decode($json_string);
         $background  = "https://www.bing.com" . $data->{"images"}[0]->{"urlbase"} . "_1920x1080.jpg";
     } else {
         if ($config['load'] == 'embed' && (file_exists($config['pic']) || stristr($config['pic'], 'http://') || stristr($config['pic'], 'https://'))) {
             $background = 'data:image/png;base64,'.base64_encode(@file_get_contents($config['pic']));
         } 
         else {
             $background = $config['pic'];
         }
     }

     $this->assign('background', $background);
     return $this->fetch('loginbg');
 }

/**
 * 设置插件页面
 */
public function config($name = null)
{
    $name = $name ? $name : $this->request->get("name");
    if (!$name) {
        $this->error('参数不得为空！');
    }
    if (!preg_match('/^[a-zA-Z0-9]+$/', $name)) {
        $this->error('插件名称不正确！');
    }
    if (!is_dir(ADDON_PATH . $name)) {
        $this->error('目录不存在！');
    }
    $info   = get_addon_info($name);
    $config = get_addon_fullconfig($name);
    if (!$info) {
        $this->error('配置不存在！');
    }
    if ($this->request->isPost()) {
        $params = $this->request->post("config/a", [], 'trim');
        if ($params) {
            foreach ($config as $k => &$v) {
                if (isset($params[$v['name']])) {
                    if ($v['type'] == 'array') {
                        $params[$v['name']] = is_array($params[$v['name']]) ? $params[$v['name']] : (array) json_decode($params[$v['name']],
                                                                                                                        true);
                        $value = $params[$v['name']];
                    } else {
                        $value = is_array($params[$v['name']]) ? implode(',',
                                                                         $params[$v['name']]) : $params[$v['name']];
                    }
                    $v['value'] = $value;
                }
            }
            try {
                //更新配置文件
                set_addon_fullconfig($name, $config);
                //AddonService::refresh();
            } catch (\Exception $e) {
                $this->error($e->getMessage());
            }
        }
        $this->success('插件配置成功！');
    }
    $this->assign('data', ['info' => $info, 'config' => $config]);
    $configFile = ADDON_PATH . $name . DS . 'config.html';
    if (is_file($configFile)) {
        $this->assign('custom_config', $this->view->fetch($configFile));
    }
    return $this->fetch();
}

 2 => 
  array (
    'name' => 'pic',
    'title' => '固定图片',
    'type' => 'image',
    'value' => 'configtest',
    'tip' => '选择固定则需要上传此图片',
  ),

/**
    上传
    @param	$name	string	对应文本框名称
    @param	$cfile	string	文件名心的文件名，不带扩展名的
    @return	string/array
*/
public function up($name,$cfile='')
{
    if(!$_FILES)return 'sorry!';
    $file_name		= $_FILES[$name]['name'];
    $file_size		= $_FILES[$name]['size'];//字节
    $file_type		= $_FILES[$name]['type'];
    $file_error		= $_FILES[$name]['error'];
    $file_tmp_name	= $_FILES[$name]['tmp_name'];
    $zongmax		= $this->getmaxupsize();	
    if($file_size<=0 || $file_size > $zongmax){
        return '文件为0字节/超过'.$this->formatsize($zongmax).'，不能上传';
    }
    $file_sizecn	= $this->formatsize($file_size);
    $file_ext		= $this->getext($file_name);//文件扩展名

    $file_img		= $this->isimg($file_ext);
    $file_kup		= $this->issavefile($file_ext);
    
    if(!$file_img && !$this->isoffice($file_ext) && getconfig('systype')=='demo')return '演示站点禁止文件上传';
    
    if($file_error>0){
        $rrs = $this->geterrmsg($file_error);
        return $rrs;
    }
        
    if(!$this->contain('|'.$this->ext.'|', '|'.$file_ext.'|') && $this->ext != '*'){
        return '禁止上传文件类型['.$file_ext.']';
    }
    
    if($file_size>$this->maxsize*1024*1024){
        return '上传文件过大，限制在：'.$this->formatsize($this->maxsize*1024*1024).'内，当前文件大小是：'.$file_sizecn.'';
    }
    
    //创建目录
    $zpath=explode('|',$this->path);
    $mkdir='';
    for($i=0;$i<count($zpath);$i++){
        $mkdir.=''.$zpath[$i].'/';
        if(!is_dir($mkdir))mkdir($mkdir);
    }
    
    //新的文件名
    $file_newname	= $file_name;
    $randname		= $file_name;
    if(!$cfile==''){
        $file_newname=''.$cfile.'.'.$file_ext.'';
    }else{
        $_oldval 	 = m('option')->getval('randfilename');
        $randname	 = $this->getrandfile(1, $_oldval);
        m('option')->setval('randfilename', $randname);
        $file_newname=''.$randname.'.'.$file_ext.'';
    }
    
    $save_path	= ''.str_replace('|','/',$this->path);
    //if(!is_writable($save_path))return '目录'.$save_path.'无法写入不能上传';
    $allfilename= $save_path.'/'.$file_newname.'';
    $uptempname	= $save_path.'/'.$randname.'.uptemp';

    $upbool	 	= true;
    if(!$file_kup){
        $allfilename= $this->filesave($file_tmp_name, $file_newname, $save_path, $file_ext);
        if(isempt($allfilename))return '无法保存到'.$save_path.'';
    }else{
        $upbool		= @move_uploaded_file($file_tmp_name,$allfilename);
    }
    
    if($upbool){
        $picw=0;$pich=0;
        if($file_img){
            $fobj = $this->isimgsave($file_ext, $allfilename);
            if(!$fobj){
                return 'error:非法图片文件';
            }else{
                $picw = $fobj[0];
                $pich = $fobj[1];	
            }
        }
        return array(
            'newfilename' => $file_newname,
            'oldfilename' => $file_name,
            'filesize'    => $file_size,
            'filesizecn'  => $file_sizecn,
            'filetype'    => $file_type,
            'filepath'    => $save_path,
            'fileext'     => $file_ext,
            'allfilename' => $allfilename,
            'picw'        => $picw,
            'pich'        => $pich
        );
    }else{
        return '上传失败：'.$this->geterrmsg($file_error).'';
    }
}

//可上传文件类型，也就是不保存为uptemp的文件
private $upallfile    = '|doc|docx|xls|xlsx|ppt|pptx|pdf|swf|rar|zip|txt|gz|wav|mp3|avi|mp4|flv|wma|chm|apk|amr|log|json|cdr|';

public function filesave($oldfile, $filename, $savepath, $ext)
{
    $file_kup	= $this->issavefile($ext);
    $ldisn 		= strrpos($filename, '.');
    if($ldisn>0)$filename = substr($filename, 0, $ldisn);
    $filepath 	= ''.$savepath.'/'.$filename.'.'.$ext.'';
    if(!$file_kup){
        $filebase64	= base64_encode(file_get_contents($oldfile));
        $filepath 	= ''.$savepath.'/'.$filename.'.uptemp';
        $bo 		= $this->rock->createtxt($filepath, $filebase64);
        @unlink($oldfile);
        if(!$bo)$filepath = '';
    }else{
    }
    return $filepath;
}

/**
*  发送上传文件
*  php task.php qcloudCos,run -fileid=1
*  http://你地址/task.php?m=qcloudCos|runt&a=run&fileid=文件id
*/
public function runAction()
{
    $fileid = (int)$this->getparams('fileid','0'); //文件ID
    if($fileid<=0)return 'error fileid';
    $frs 	= m('file')->getone($fileid);
    if(!$frs)return 'filers not found';
    
    $filepath 	= $frs['filepath'];
    if(substr($filepath, 0, 4)=='http')return 'filepath is httppath';
    
    if(substr($filepath,-6)=='uptemp'){
        $aupath = ROOT_PATH.'/'.$filepath;
        $nfilepath  = str_replace('.uptemp','.'.$frs['fileext'].'', $filepath);
        $content	= file_get_contents($aupath);
        $this->rock->createtxt($nfilepath, base64_decode($content));
        unlink($aupath);
        $filepath 	= $nfilepath;
    }
    
    $msg 	= $this->sendpath($filepath, $frs, 'filepathout');
    if($msg)return $msg;
    
    $thumbpath	= $frs['thumbpath'];
    if(!isempt($thumbpath)){
        $msg 	= $this->sendpath($thumbpath, $frs, 'thumbplat');
        if($msg)return $msg;
    }
    return 'success';
}

<?php
if(stripos($_GET['file'], "gopher") !== FALSE)
    die("no gopher, try to find another ssrf on this server!");
else
    echo file_get_contents($_GET['file']);