WooYun.org

case 'uploadCloud':
		$folder_id = (int)gpc('folder_id','P',0);
		$folder_id = $folder_id ? $folder_id : -1;
		$data = trim(gpc('data','P',''));
		$is_checked = $is_public ? ($settings['check_public_file'] ? 0 :1) : 1;
		if($settings['all_file_share']){
			$in_share = 1;
		}else{
			$in_share = (int)@$db->result_first("select in_share from {$tpf}folders where userid='$pd_uid' and folder_id='$folder_id'");
		}
		if($data){
			$file_key = random(8);
			if(strpos($data,',')!==false){
				$add_sql = $msg = '';
				$arr = explode(',',$data);
				for($i=0;$i<count($arr)-1;$i++){
					$file = unserialize(base64_decode($arr[$i]));
					$file[file_id] = (int)$file[file_id];
					$file[file_size] = (int)$file[file_size];
					$file[file_description] = $db->escape(trim($file[file_description]));
					$file[file_extension] = $db->escape(trim($file[file_extension]));
					$file[file_name] = $db->escape(trim($file[file_name]));
					$report_status =0;
					$report_arr = explode(',',$settings['report_word']);
					if(count($report_arr)){
						foreach($report_arr as $value){
							if (strpos($file['file_name'],$value) !== false){
								$report_status = 2;
							}
						}
					}
					$num = @$db->result_first("select count(*) from {$tpf}files where yun_fid='{$file[file_id]}' and userid='$pd_uid'");
					if($num && $file[file_id]){
						$tmp_ext = $file[file_extension] ? '.'.$file[file_extension] : '';
						$msg .=	$file[file_name].$tmp_ext.',';
					}else{
						$add_sql .= "({$file[file_id]},'{$file[file_name]}','$file_key','{$file[file_extension]}','application/octet-stream','{$file[file_description]}','{$file[file_size]}','$timestamp','$is_checked','$in_share','$report_status','$pd_uid','$folder_id','$onlineip'),";
					}
				}
				if($add_sql){
					$add_sql = is_utf8() ? $add_sql : convert_str('utf-8','gbk',$add_sql);
					$add_sql = substr($add_sql,0,-1);
					$db->query_unbuffered("insert into {$tpf}files(yun_fid,file_name,file_key,file_extension,file_mime,file_description,file_size,file_time,is_checked,in_share,report_status,userid,folder_id,ip) values $add_sql ;");
				}
			}

case 'save_as':
		$file_id = (int)gpc('file_id','G',0);
		if($pd_uid){
			$rs = $db->fetch_one_array("select * from {$tpf}files where file_id='$file_id' limit 1");
			if($rs){
				$has_file = @$db->result_first("select count(*) from {$tpf}files where file_name='{$rs[file_name]}' and file_extension='{$rs[file_extension]}' and file_size='{$rs[file_size]}' and userid='$pd_uid' limit 1");	//注入点1
				if(($rs['userid'] ==$pd_uid) || $has_file){
					$rtn ='ufile';
				}else{
					$ins = array(
					'file_name' => '[转]'.$rs['file_name'],
					'file_key' => random(8),
					'file_extension' => $rs['file_extension'],
					'is_image' => $rs['is_image'],
					'file_mime' => $rs['file_mime'],
					'file_description' => $rs['file_description'],
					'file_store_path' => $rs['file_store_path'],
					'file_real_name' => $rs['file_real_name'],
					'file_md5' => $rs['file_md5'],
					'server_oid' => $rs['server_oid'],
					'file_size' => $rs['file_size'],
					'file_time' => $timestamp,
					'in_share' => 1,
					'is_checked' => $rs['is_checked'],
					'userid' => $pd_uid,
					'ip' => get_ip(),
					);
					$db->query_unbuffered("insert into {$tpf}files set ".$db->sql_array($ins)."");	//注入点2
					$rtn = 'true';
				}
			}
			unset($rs);
		}else{
			$rtn = 'false';
		}
		echo $rtn;
		break;

update set description = (select xxx)