Merge pull request #195 from yuantuo666/dev

漏洞修复

Author: yuantuo666

functions.php

@@ -327,10 +327,13 @@ function connectdb(bool $isAPI = false)
 	$DBPassword = DbConfig["DBPassword"];
 	$dbname = DbConfig["dbname"];
 	$GLOBALS['dbtable'] = DbConfig["dbtable"];
-	$conn = mysqli_connect($servername, $username, $DBPassword, $dbname);
-	$GLOBALS['conn'] = $conn;
+	$conn = mysqli_init();
+	mysqli_options($conn, MYSQLI_OPT_LOCAL_INFILE, false); // 感谢 unc1e 披露的漏洞
+	$m = mysqli_real_connect($conn, $servername, $username, $DBPassword, $dbname, 3306);
+	// $conn = mysqli_connect($servername, $username, $DBPassword, $dbname);
+
 	// Check connection
-	if (!$conn) {
+	if (!$m) {
 		if ($isAPI) {
 			// api特殊处理
 			EchoInfo(-1, array("msg" => "数据库连接失败：" . mysqli_connect_error(), "sviptips" => "Error"));
@@ -340,6 +343,8 @@ function connectdb(bool $isAPI = false)
 			exit;
 		}
 	}
+	$GLOBALS['conn'] = $conn;
+
 	mysqli_query($conn, "set sql_mode = ''");
 	mysqli_query($conn, "set character set 'utf8'");
 	mysqli_query($conn, "set names 'utf8'");

index.php

@@ -9,14 +9,14 @@
  *
  * 此项目 GitHub 地址：https://github.com/yuantuo666/baiduwp-php
  *
- * @version 2.2.0
+ * @version 2.2.0.1
  *
  * @author Yuan_Tuo <yuantuo666@gmail.com>
  * @link https://imwcr.cn/
  * @link https://space.bilibili.com/88197958
  *
  */
-$programVersion_Index = "2.2.0";
+$programVersion_Index = "2.2.0.1";
 session_start();
 define('init', true);
 if (version_compare(PHP_VERSION, '7.0.0', '<')) {
@@ -329,7 +329,7 @@ function getip()
 						}
 						return $ip;
 					}
-					$ip = getip();
+					$ip = htmlspecialchars(getip(), ENT_QUOTES); // 防注入 #193
 					$isipwhite = FALSE; //初始化 防止报错
 					if (USING_DB) {
 						connectdb();

install/config_raw

@@ -3,12 +3,12 @@
  * PanDownload 网页复刻版，PHP 语言版配置文件
  * ！！！请勿修改本文件，如果手动修改后再在后台设置，可能导致config.php文件被清空！！！
  *
- * @version 2.2.0
+ * @version 2.2.0.1
  * @author Yuan_Tuo <yuantuo666@gmail.com>
  * @link https://imwcr.cn/
  * @link https://space.bilibili.com/88197958
  */
-const programVersion = '2.2.0';
+const programVersion = '2.2.0.1';
 if (!defined('init')) {
 	http_response_code(403); header('Content-Type: text/plain; charset=utf-8'); header('Refresh: 3;url=./');
 	die("HTTP 403 禁止访问！\r\n此文件是 PanDownload 网页复刻版 PHP 语言版项目版本 " . programVersion . " 的配置文件！\r\n禁止直接访问！");

updater.php

@@ -7,12 +7,12 @@
  *
  * 此项目 GitHub 地址：https://github.com/yuantuo666/baiduwp-php
  *
- * @version 2.2.0
+ * @version 2.2.0.1
  *
  * @author Yuan_Tuo <yuantuo666@gmail.com>
  * @link https://imwcr.cn/
  * @link https://space.bilibili.com/88197958
  *
  */
 
-$programVersion_Updater = "2.2.0";
+$programVersion_Updater = "2.2.0.1";