项目管理系统远程命令执行漏洞

/**     * Check the user has permission to access this method, if not, locate to the login page or deny page.     *     * @access public     * @return void     */    public function checkPriv(){        try        {            $module = $this->app->getModuleName();            $method = $this->app->getMethodName();            if($this->app->isFlow)            {                $module = $this->app->rawModule;                $method = $this->app->rawMethod;            }
            $beforeValidMethods = array(                'user'    => array('deny', 'logout'),                'my'      => array('changepassword'),                'message' => array('ajaxgetmessage'),            );            if(!empty($this->app->user->modifyPassword) and (!isset($beforeValidMethods[$module]) or !in_array($method, $beforeValidMethods[$module]))) return print(js::locate(helper::createLink('my', 'changepassword')));            if(!$this->loadModel('user')->isLogon() and $this->server->php_auth_user) $this->user->identifyByPhpAuth();            if(!$this->loadModel('user')->isLogon() and $this->cookie->za) $this->user->identifyByCookie();            if($this->isOpenMethod($module, $method)) return true;
            if(isset($this->app->user))            {                $this->app->user = $this->session->user;                if(!commonModel::hasPriv($module, $method))                {                    if($module == 'story' and !empty($this->app->params['storyType']) and strpos(",story,requirement,", ",{$this->app->params['storyType']},") !== false) $module = $this->app->params['storyType'];                    $this->deny($module, $method);                }            }            else            {                $uri = $this->app->getURI(true);                if($module == 'message' and $method == 'ajaxgetmessage')                {                    $uri = helper::createLink('my');                }                elseif(helper::isAjaxRequest())                {                    die(json_encode(array('result' => false, 'message' => $this->lang->error->loginTimeout))); // Fix bug #14478.                }
                $referer = helper::safe64Encode($uri);                die(js::locate(helper::createLink('user', 'login', "referer=$referer")));            }        }        catch(EndResponseException $endResponseException)        {            echo $endResponseException->getContent();        }    }

{    try    {       // code    }    catch(EndResponseException $endResponseException)    {        echo $endResponseException->getContent();    }}

public function checkPriv(){        try        {            $module = $this->app->getModuleName();            $method = $this->app->getMethodName();            if($this->app->isFlow)            {                $module = $this->app->rawModule;                $method = $this->app->rawMethod;            }
            $beforeValidMethods = array(                'user'    => array('deny', 'logout'),                'my'      => array('changepassword'),                'message' => array('ajaxgetmessage'),            );            if(!empty($this->app->user->modifyPassword) and (!isset($beforeValidMethods[$module]) or !in_array($method, $beforeValidMethods[$module]))) return print(js::locate(helper::createLink('my', 'changepassword')));            if(!$this->loadModel('user')->isLogon() and $this->server->php_auth_user) $this->user->identifyByPhpAuth();            if(!$this->loadModel('user')->isLogon() and $this->cookie->za) $this->user->identifyByCookie();            if($this->isOpenMethod($module, $method)) return true;
            if(isset($this->app->user))            {                $this->app->user = $this->session->user;                if(!commonModel::hasPriv($module, $method))                {                // 需要进入这个逻辑才能触发                    if($module == 'story' and !empty($this->app->params['storyType']) and strpos(",story,requirement,", ",{$this->app->params['storyType']},") !== false) $module = $this->app->params['storyType'];                    $this->deny($module, $method);                }            }            else            {                $uri = $this->app->getURI(true);                if($module == 'message' and $method == 'ajaxgetmessage')                {                    $uri = helper::createLink('my');                }                elseif(helper::isAjaxRequest())                {                    die(json_encode(array('result' => false, 'message' => $this->lang->error->loginTimeout))); // Fix bug #14478.                }
                $referer = helper::safe64Encode($uri);                die(js::locate(helper::createLink('user', 'login', "referer=$referer")));            }        }        catch(EndResponseException $endResponseException)        {            echo $endResponseException->getContent();        }    }

public function isOpenMethod($module, $method){        if(in_array("$module.$method", $this->config->openMethods)) return true;
        if($module == 'block' and $method == 'main' and isset($_GET['hash'])) return true;
        if($this->loadModel('user')->isLogon() or ($this->app->company->guest and $this->app->user->account == 'guest'))        {            if(stripos($method, 'ajax') !== false) return true;            if($module == 'block') return true;            if($module == 'my' and $method == 'guidechangetheme') return true;            if($module == 'misc' and $method == 'downloadclient') return true;            if($module == 'misc' and $method == 'changelog')  return true;            if($module == 'tutorial' and $method == 'start')  return true;            if($module == 'tutorial' and $method == 'index')  return true;            if($module == 'tutorial' and $method == 'quit')   return true;            if($module == 'tutorial' and $method == 'wizard') return true;            if($module == 'product' and $method == 'showerrornone') return true;        }        return false;    }

/**     * Show captcha and save to session.     *     * @param  string $sessionVar     * @param  string $uuid     * @access public     * @return void     */    public function captcha($sessionVar = 'captcha', $uuid = ''){        $obLevel = ob_get_level();        for($i = 0; $i < $obLevel; $i++) ob_end_clean();
        header('Content-Type: image/jpeg');        $captcha = $this->app->loadClass('captcha');        $this->session->set($sessionVar, $captcha->getPhrase());        $captcha->build()->output();    }