chenshibing 发表于 2015-3-19 09:16:43

求大神看看。。我看了很久没发现问题，

一个正常的php代码，有人说里面有小马特征，可我怎么也发现不了。
<?php

/*
        (C)2001-2099 Comsenz Inc.
        This is NOT a freeware, use is subject to license terms

        $Id: avatar.php 1144 2013-01-31 06:47:43Z zhangjie $
*/


error_reporting(0);

_get_script_url();
define('UC_API', strtolower(($_SERVER['HTTPS'] == 'on' ? 'https' : 'http').'://'.$_SERVER['HTTP_HOST'].substr($_SERVER['PHP_SELF'], 0, strrpos($_SERVER['PHP_SELF'], '/'))));

$uid = isset($_GET['uid']) ? $_GET['uid'] : 0;
$size = isset($_GET['size']) ? $_GET['size'] : '';
$random = isset($_GET['random']) ? $_GET['random'] : '';
$type = isset($_GET['type']) ? $_GET['type'] : '';
$check = isset($_GET['check_file_exists']) ? $_GET['check_file_exists'] : '';

$avatar = './data/avatar/'.get_avatar($uid, $size, $type);
if(file_exists(dirname(__FILE__).'/'.$avatar)) {
        if($check) {
                echo 1;
                exit;
        }
        $random = !empty($random) ? rand(1000, 9999) : '';
        $avatar_url = empty($random) ? $avatar : $avatar.'?random='.$random;
} else {
        if($check) {
                echo 0;
                exit;
        }
        $size = in_array($size, array('big', 'middle', 'small')) ? $size : 'middle';
        $avatar_url = 'images/noavatar_'.$size.'.gif';
}

if(empty($random)) {
        header("HTTP/1.1 301 Moved Permanently");
        header("Last-Modified:".date('r'));
        header("Expires: ".date('r', time() + 86400));
}

header('Location: '.UC_API.'/'.$avatar_url);
exit;

function get_avatar($uid, $size = 'middle', $type = '') {
        $size = in_array($size, array('big', 'middle', 'small')) ? $size : 'middle';
        $uid = abs(intval($uid));
        $uid = sprintf("%09d", $uid);
        $dir1 = substr($uid, 0, 3);
        $dir2 = substr($uid, 3, 2);
        $dir3 = substr($uid, 5, 2);
        $typeadd = $type == 'real' ? '_real' : '';
        return $dir1.'/'.$dir2.'/'.$dir3.'/'.substr($uid, -2).$typeadd."_avatar_$size.jpg";
}

function _get_script_url() {
        $scriptName = basename($_SERVER['SCRIPT_FILENAME']);
        if(basename($_SERVER['SCRIPT_NAME']) === $scriptName) {
                $_SERVER['PHP_SELF'] = $_SERVER['SCRIPT_NAME'];
        } else if(basename($_SERVER['PHP_SELF']) === $scriptName) {
                $_SERVER['PHP_SELF'] = $_SERVER['PHP_SELF'];
        } else if(isset($_SERVER['ORIG_SCRIPT_NAME']) && basename($_SERVER['ORIG_SCRIPT_NAME']) === $scriptName) {
                $_SERVER['PHP_SELF'] = $_SERVER['ORIG_SCRIPT_NAME'];
        } else if(($pos = strpos($_SERVER['PHP_SELF'],'/'.$scriptName)) !== false) {
                $_SERVER['PHP_SELF'] = substr($_SERVER['SCRIPT_NAME'],0,$pos).'/'.$scriptName;
        } else if(isset($_SERVER['DOCUMENT_ROOT']) && strpos($_SERVER['SCRIPT_FILENAME'],$_SERVER['DOCUMENT_ROOT']) === 0) {
                $_SERVER['PHP_SELF'] = str_replace('\\','/',str_replace($_SERVER['DOCUMENT_ROOT'],'',$_SERVER['SCRIPT_FILENAME']));
                $_SERVER['PHP_SELF'] != '/' && $_SERVER['PHP_SELF'] = '/'.$_SERVER['PHP_SELF'];
        } else {
                return false;
        }
        return $_SERVER['PHP_SELF'];
}

?>

chenshibing 发表于 2015-3-19 09:18:51

是php论坛复制下来的，
我道行浅，求大神教育。

tintion 发表于 2015-3-19 12:09:49

没看到上传函数,估计是_get_script_url()这个函数吧,$_SERVER这个全局变量用了很多次,大部分小马都会有的,但是如果单单以这个为特征码,那也太严了吧.

chenshibing 发表于 2015-3-20 09:00:35

tintion 发表于 2015-3-19 12:09
没看到上传函数,估计是_get_script_url()这个函数吧,$_SERVER这个全局变量用了很多次,大部分小马都会有的, ...

十分感谢。。
页: [1]
查看完整版本: 求大神看看。。我看了很久没发现问题，