WooYun.org

function uploadfile($upfile, $maxsize, $updir, $newname = 'date') {
    $name = $upfile ["name"];
    $type = $upfile ["type"];
    $size = $upfile ["size"];
    $tmp_name = $upfile ["tmp_name"];
	if ($newname == 'date')
        $newname = date ( "Ymdhis" ); //使用日期做文件
        $newname = date ( "Ymdhis" ).mt_rand(1,1000000);
	//$newname = md5($name.time());
	$p = strrpos($name,".");
	$extend = strtolower(substr($name,$p));
	$fileSize = $size;
    if ($size > $maxsize) {
        $maxpr = $maxsize / 1000;
        //return  ( "警告！上传文件大小不能超过" . $maxpr . "K!" );
		return false;
    }
	if(!is_dir($updir))
	{
		//mkdir($updir);
		do {
		   $dir = $updir;
		   while (!@mkdir($dir,0777)) {
			   $dir = dirname($dir);
			   if ($dir == '/' || is_dir($dir))
				   break;
		   }
		} while ($dir != $updir);
	}
    if (move_uploaded_file ( $tmp_name, $updir . "/" . $newname . $extend )) {
        return $updir ."/" . $newname . $extend;
    }
}

if( $_POST['tmap'] && is_numeric($_POST['tmap']) 
    && $_POST['auth']   //加密验证串
    && $_POST['path'] 
    && !empty($_FILES)
  ){
    $tmap = $_POST['tmap'];
    $auth = $_POST['auth'];
    $path = $_POST['path'];
    if( time()-ceil($tmap/1000) > 600 || $auth!=md5($path.$tmap.$key) ){
        $err = 7;