4.47 release

Author: kalcaddle

app/controller/utils.php

@@ -27,6 +27,16 @@ function checkExt($file){
 	}
 	return 1;
 }
+function checkExtSafe($file){
+	if($file == '.htaccess' || $file == '.user.ini') return false;
+	if (strstr($file,'<') || strstr($file,'>') || $file=='') return false;
+	$disable  = 'php|phtml|phtm|pwml|asp|aspx|ascx|jsp|pl|html|htm|svg|shtml|shtm';
+	$extArr = explode('|',$disable);
+	foreach ($extArr as $ext) {
+		if ($ext && stristr($file,'.'.$ext)) return false;
+	}
+	return true;
+}
 
 //-----解压缩跨平台编码转换；自动识别编码-----
 //压缩前，文件名处理；

app/function/helper.function.php

@@ -100,11 +100,6 @@ static function fileDownloadFopen($url, $fileName,$headerSize=0){
 			//下载完成，重命名临时文件到目标文件
 			fclose($downloadFp);
 			fclose($fp);
-			
-			$filesize = get_filesize(iconv_system($fileTemp));
-			if($headerSize != 0 && $filesize != $headerSize){
-			    return array('code'=>false,'data'=>'file size error');
-			}
 			self::checkGzip($fileTemp);
 			if(!@rename($fileTemp,$fileName)){
 				usleep(round(rand(0,1000)*50));//0.01~10ms
@@ -145,11 +140,6 @@ static function fileDownloadCurl($url, $fileName,$supportRange=false,$existsLeng
 			if($filesize < $length && $length!=0){
 			    return array('code'=>false,'data'=>'downloading');
 			}
-			if($filesize > $length && $length!=0){
-			    //远程下载大小不匹配；则返回正在下载中，客户端重新触发下载
-			    return array('code'=>false,'data'=>'file size error');
-			}
-			
 			if($res && filesize($fileTemp) != 0){
 				self::checkGzip($fileTemp);
 				if(!@rename($fileTemp,$fileName)){

app/kod/Downloader.class.php

@@ -79,7 +79,7 @@ final function filePath($path){
 				show_json(LNG('url error!'),false);
 			}
 			$cacheName = md5($path.'kodcloud').'.'.get_path_ext($path);
-			$cacheFile = TEMP_PATH.$this->pluginName.'/files/'.$cacheName;
+			$cacheFile = $this->filePathName($cacheName);
 			mk_dir(get_path_father($cacheFile));
 			if(!file_exists($cacheFile)){
 				$result = url_request($path,'DOWNLOAD',$cacheFile);
@@ -92,8 +92,8 @@ final function filePath($path){
 				version_compare(phpversion(), '7.1.0', '>=') &&
 				preg_match("/([\x81-\xfe][\x40-\xfe])/", $path, $match)){
 
-				$name = hash_path($path).'.'.get_path_ext($path);
-				$cacheFile = TEMP_PATH.$this->pluginName.'/files/'.$name;
+				$cacheName = hash_path($path).'.'.get_path_ext($path);
+				$cacheFile = $this->filePathName($cacheName);
 				mk_dir(get_path_father($cacheFile));
 				if(!file_exists($cacheFile)){
 					@copy($path,$cacheFile);
@@ -106,6 +106,10 @@ final function filePath($path){
 		}
 		return $path;
 	}
+	private function filePathName($fileName){
+		if(! checkExtSafe($fileName)){$fileName = $fileName.'.txt';}
+		return TEMP_PATH.$this->pluginName.'/files/'.$fileName;
+	}
 
 	/**
 	 * 插件配置数据加载

app/kod/PluginBase.class.php

@@ -1,3 +1,3 @@
 <?php
-define('KOD_VERSION','4.46');
-define('KOD_VERSION_BUILD','0714');//time(),0409
+define('KOD_VERSION','4.47');
+define('KOD_VERSION_BUILD','1228');//time(),0409