no commit message

2023-12-21 21:15:19 +08:00
parent ad77fdd196
commit 7eaf20c8fd
28 changed files with 187 additions and 53 deletions
--- a/webmain/system/sysfile/sysfileAction.php
+++ b/webmain/system/sysfile/sysfileAction.php
@@ -96,7 +96,8 @@ class sysfileClassAction extends Action
 		if($str=$this->iscaozuo())return $str;
 		$path = $this->jm->base64decode($this->get('path'));
 		if(isempt($path))return '无效路径';
-		
+		$path = str_replace('\\','/', $path);
+		$path = str_replace(array('../','..'),'', $path);
 		if(!file_exists(ROOT_PATH.'/'.$path))return '文件不存在';
 		$pathinfo=pathinfo($path);