Question

我目前正在编写可恢复Joomla网站的python脚本。它实际上基于here发布的缺陷。

我怀疑我定位的PHP脚本不应该直接调用。当我针对它运行脚本时，它会返回此

{“状态”：false，“消息”：“无效的登录”}

这是我怀疑是负责的功能！

// Import configuration
masterSetup();

$retArray = array(
    'status'    => true,
    'message'   => null
);

$enabled = AKFactory::get('kickstart.enabled', false);

if($enabled)
{
    $task = getQueryParam('task');

    switch($task)
    {
        case 'ping':
            // ping task - realy does nothing!
            $timer = AKFactory::getTimer();
            $timer->enforce_min_exec_time();
            break;

        case 'startRestore':
            AKFactory::nuke(); // Reset the factory

            // Let the control flow to the next step (the rest of the code is common!!)

        case 'stepRestore':
            $engine = AKFactory::getUnarchiver(); // Get the engine
            $observer = new RestorationObserver(); // Create a new observer
            $engine->attach($observer); // Attach the observer
            $engine->tick();
            $ret = $engine->getStatusArray();

            if( $ret['Error'] != '' )
            {
                $retArray['status'] = false;
                $retArray['done'] = true;
                $retArray['message'] = $ret['Error'];
            }
            elseif( !$ret['HasRun'] )
            {
                $retArray['files'] = $observer->filesProcessed;
                $retArray['bytesIn'] = $observer->compressedTotal;
                $retArray['bytesOut'] = $observer->uncompressedTotal;
                $retArray['status'] = true;
                $retArray['done'] = true;
            }
            else
            {
                $retArray['files'] = $observer->filesProcessed;
                $retArray['bytesIn'] = $observer->compressedTotal;
                $retArray['bytesOut'] = $observer->uncompressedTotal;
                $retArray['status'] = true;
                $retArray['done'] = false;
                $retArray['factory'] = AKFactory::serialize();
            }
            break;

这是 MasterSetup（）

  function masterSetup()
    {
        // ------------------------------------------------------------
        // 1. Import basic setup parameters
        // ------------------------------------------------------------

    $ini_data = null;

    // In restore.php mode, require restoration.php or fail
    if(!defined('KICKSTART'))
    {
        // This is the standalone mode, used by Akeeba Backup Professional. It looks for a restoration.php
        // file to perform its magic. If the file is not there, we will abort.
        $setupFile = 'restoration.php';

        if( !file_exists($setupFile) )
        {
            // Uh oh... Somebody tried to pooh on our back yard. Lock the gates! Don't let the traitor inside!
            AKFactory::set('kickstart.enabled', false);
            return false;
        }

        // Load restoration.php. It creates a global variable named $restoration_setup
        require_once $setupFile;
        $ini_data = $restoration_setup;
        if(empty($ini_data))
        {
            // No parameters fetched. Darn, how am I supposed to work like that?!
            AKFactory::set('kickstart.enabled', false);
            return false;
        }

        AKFactory::set('kickstart.enabled', true);
    }
    else
    {
        // Maybe we have $restoration_setup defined in the head of kickstart.php
        global $restoration_setup;
        if(!empty($restoration_setup) && !is_array($restoration_setup)) {
            $ini_data = AKText::parse_ini_file($restoration_setup, false, true);
        } elseif(is_array($restoration_setup)) {
            $ini_data = $restoration_setup;
        }
    }

我的问题是，是否可以将旁路参数解析为函数并强制该函数返回true？

Answer 1

我想并非总是如此，但是如果从http请求中获取了 Function 参数，那么可能会忽略以下内容

这里，以下内容清除了$ _REQUEST，但没有清除$_POST和$_GET，因此为旁路留有空白

if(!empty($_REQUEST))
{
    foreach($_REQUEST as $key => $value)
    {
        unset($_REQUEST[$key]);
    }
}

就我而言，它只是避免该函数返回默认值

function getQueryParam( $key, $default = null )
{
    if(array_key_exists($key, $_REQUEST)) {
        $value = $_REQUEST[$key];
    } elseif(array_key_exists($key, $_POST)) {
        $value = $_POST[$key];
    } elseif(array_key_exists($key, $_GET)) {
        $value = $_GET[$key];
    } else {
        return $default;
    }
    return $value;
}

如何绕过PHP中的函数参数？

{“状态”：false，“消息”：“无效的登录”}

1 个答案: