phpci框架漏洞,CodeIgniter框架内核设计缺陷可能导致任意代码执行 publicfunctionview($view,$vars=array(),$return=FALSE){return$this->_ci_load(array('_ci_view'=>$view,'_ci_vars'=>$this->_ci_object_to_array($vars),'_ci_return'=>$return));}...protectedfunction_ci_load($_ci_data){//Setthedefaultdatavariablesforeach(array('_ci_view','_ci_vars','_ci_path','_ci_return')as$_ci_val){$$_ci_val=isset($_ci_data[$_ci_val])?$_ci_data[$_ci_val]:FALSE;}$file_exists=FALSE;//Setthepathtotherequestedfileif(is_string($_ci_path)&&$_ci_path!==''){$_ci_x=explode('/',$_ci_path);$_ci_file=end($_ci_x);}else{$_ci_ext=pathinfo($_ci_view,PATHINFO_EXTENSION);$_ci_file=($_ci_ext==='')?$_ci_view.'.php':$_ci_view;foreach($this->_ci_view_pathsas$_ci_view_file=>$cascade){if(file_exists($_ci_view_file.$_ci_file)){$_ci_path=$_ci_view_file.$_ci_file;$file_exists=TRUE;break;}if(!$cascade){break;}}}if(!$file_exists&&!file_exists($_ci_path)){show_error('Unabletoloadtherequestedfile:'.$_ci_file);}//Thisallowsanythingloadedusing$this->load(views,files,etc.)//tobecomeaccessiblefromwithintheControllerandModelfunctions.$_ci_CI=&get_instance();foreach(get_object_vars($_ci_CI)as$_ci_key=>$_ci_var){if(!isset($this->$_ci_key)){$this->$_ci_key=&$_ci_CI->$_ci_key;}}/**Extractandcachevariables**Youcaneithersetvariablesusingthededicated$this->load->vars()*functionorviathesecondparameterofthisfunction.We'llmerge*thetwotypesandcachethemsothatviewsthatareembeddedwithin*otherviewscanhaveaccesstothesevariables.*/if(is_array($_ci_vars)){$this->_ci_cached_vars=array_merge($this->_ci_cached_vars,$_ci_vars);}extract($this->_ci_cached_vars);/**Buffertheoutput**Webuffertheoutputfortworeasons:*1.Speed.Yougetasignificantspeedboost.*2.Sothatthefinalrenderedtemplatecanbepost-processedby*theoutputclass.Whydoweneedpostprocessing?Foronething,*inordertoshowtheelapsedpageloadtime.Unlesswecan*interceptthecontentrightbeforeit'ssenttothebrowserand*thenstopthetimeritwon'tbeaccurate.*/ob_start();//IfthePHPinstallationdoesnotsupportshorttagswe'll//doalittlestringreplacement,changingtheshorttags//tostandardPHPechostatements.if(!is_php('5.4')&&!ini_get('short_open_tag')&&config_item('rewrite_short_tags')===TRUE){echoeval('?>'.preg_replace('/;*\s*\?>/',';?>',str_replace('=','$this->_ci_ob_level+1){ob_end_flush();}else{$_ci_CI->output->append_output(ob_get_contents());[@ob_end_clean](/ob_end_clean)();}return$this;} -全文完-