【代码审计】两个任意文件读取漏洞实例

    public function edit() {
        $ftype     = I(‘ftype‘, 0, ‘intval‘);
        $fname     = I(‘fname‘, ‘‘, ‘trim,htmlspecialchars‘);
        $file_path = !$ftype ? ‘./Public/Home/‘ . C(‘CFG_THEMESTYLE‘) . ‘/‘ : ‘./Public/Mobile/‘ . C(‘CFG_MOBILE_THEMESTYLE‘) . ‘/‘;
        if (IS_POST) {
            if (empty($fname)) {
                $this->error(‘未指定文件名‘);
            }
            $_ext     = ‘.‘ . pathinfo($fname, PATHINFO_EXTENSION);
            $_cfg_ext = C(‘TMPL_TEMPLATE_SUFFIX‘);
            if ($_ext != $_cfg_ext) {
                $this->error(‘文件后缀必须为"‘ . $_cfg_ext . ‘"‘);
            }
            $content  = I(‘content‘, ‘‘, ‘‘);
            $fname    = ltrim($fname, ‘./‘);
            $truefile = $file_path . $fname;
            if (false !== file_put_contents($truefile, $content)) {
                $this->success(‘保存成功‘, U(‘index‘, array(‘ftype‘ => $ftype)));
            } else {
                $this->error(‘保存文件失败，请重试‘);
            }
            exit();
        }
        $fname = base64_decode($fname);
        if (empty($fname)) {
            $this->error(‘未指定要编辑的文件‘);
        }
        $truefile = $file_path . $fname;

        if (!file_exists($truefile)) {
            $this->error(‘文件不存在‘);
        }
        $content = file_get_contents($truefile);
        if ($content === false) {
            $this->error(‘读取文件失败‘);
        }
        $content = htmlspecialchars($content);

        $this->assign(‘ftype‘, $ftype);
        $this->assign(‘fname‘, $fname);
        $this->assign(‘content‘, $content);
        $this->assign(‘type‘, ‘修改模板‘);
        $this->display();
    }

public function add()  
{  
    $filename = dami_url_repalce(str_replace(‘*‘,‘.‘,trim($_GET[‘id‘])));  
    if (empty($filename))   
    {  
        $this->error(‘模板名称不能为空！‘);  
    }  
    $content = read_file($filename);  
    $this->assign(‘filename‘,$filename);  
    $this->assign(‘content‘,htmlspecialchars($content));  
    $this->display(‘add‘);  
}