PHP uploadscript bruges til at deface
HejsaMin kammerat har nu gentagne gange defacet min side efter at fået fat i min sourcekode pga. en fejl i min side.
Nu har jeg så forsøgt at få ændret koden men ikke med held.
Her er min side:
http://plazm.1go.dk/
og her er min kode til siderne:
index.php
<?php
$query=$_SERVER['QUERY_STRING'];
$query = explode("&", $query);
switch($query[0]) {
case "list":
$site="listview";
break;
default:
$site="forside";
break;
}
if($_FILES["file"]["tmp_name"]){
move_uploaded_file($_FILES["file"]["tmp_name"], "kaninmos/".addslashes(htmlentities($_FILES["file"]["name"])));
header("location: ?list");
}
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>PlazMs Site</title>
<meta http-equiv="Content-Language" content="da">
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" >
<link href="style.css" rel="stylesheet" type="text/css">
<script language="javascript" type="text/javascript">
function pop(file){
window.open(file,"ResizeBillede","width=300,height=50,status=no");
}
</script>
</head>
<body>
<div class=space>
</div>
<div class=ruler>
PlazMs Uploadsite
</div>
<div class=header>
- PlazM - <?php echo $site;?>
</div>
<div class=main>
<?php
switch($query[0]) {
case "list":
include("listview.php");
break;
case "download":
include("download.php");
break;
default:
include("forside.php");
break;
}
?>
</div>
<div class=ruler>
</div>
</body>
</html>
listview.php
<center><table class=list>
<tr><th class=list-1>Filnavn: </th><th class=list-2>Size:</th></tr>
<?php
if ($handle = opendir('kaninmos/')) {
while (false !== ($file = readdir($handle))) {
if ($file !== "." && $file !== "..") echo '<tr><td class=list-1><a href="download.php?file='.$file.'">'.$file.'</a></td><td class=list-2>'.round(filesize( "kaninmos/" . $file ) / 1024 / 1024 ,2).' mb</td></tr>'."\r\n";
}
closedir($handle);
}
?>
</table>
<?php
echo "<br><a href=\"?\">Upload ny fil</a><br><br></center>";
?>
download.php
<?php
$test = explode("/",$_GET['file']);
$abe = $test[count($test) - 1];
if (isset($_GET['file']) && file_exists("kaninmos/".$abe)) {
header("Content-Type: octet/stream");
header("Content-Disposition: attachment; filename=".str_replace(" ","_",$abe));
echo file_get_contents("kaninmos/".$abe);
} else {
echo "Filen blev ikke fundet";
}
?>
forside.php
<center><br>
<form action="?" method="post" enctype="multipart/form-data">
<input type=file class=file1 name=file><br><br>
<input type=submit class=submit value=Upload>
</form>
<br><a href="?list">Vis filer</a><br><br></center>
Hvordan kan han deface det vha. denne kode?
