HEX
Server: Apache/2.4.59 (Debian)
System: Linux keymana 4.19.0-21-cloud-amd64 #1 SMP Debian 4.19.249-2 (2022-06-30) x86_64
User: lijunjie (1003)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /var/www/html/wp-content/themes/ormedia/page-api-data.php
<?php
//Template Name: data2

//ini_set('display_errors',1);            //错误信息
//ini_set('display_startup_errors',1);    //php启动错误信息
//error_reporting(E_ALL);
get_header('app');
session_start();

require_once('token.php');
require_once('JwtAuthClass.php');
$debug = false;
//if (isset($_REQUEST['debug']) && $_REQUEST['debug'] == "debugString"){
//    $debug = true;
//}
$user = wp_get_current_user();

$allheader = array_change_key_case(getallheaders());
$token = empty($allheader['token']) ? $allheader['Token'] : $allheader['token'];
//$is_check = $allheader['is_check'];
$is_check = true;

if (isset($_REQUEST['action'])) {
    $a = $_REQUEST['action'];
} else {
    $a = "";
}

$dir = get_template_directory_uri();
if (!isset($_REQUEST['pages'])) {
    $first_separator = strpos($a, "_");
    $c = substr($a, $first_separator + 1);
    //    $c = explode("_",$a)[1];
} else {
    $c = $_REQUEST['pages'];
}
$rv->get_action = $_GET['action'];
$rv->post_action = $_POST['action'];
$user_id = $_REQUEST['admin_wp_id'];
if (empty($user_id)) {
    $user_id = 0;
}
$admin_wp_id = $wpdb->get_var("SELECT id FROM keylab_admin WHERE id = $user_id");
if (empty($admin_wp_id)) {
    $admin_wp_id = intval(get_user_meta($user_id, "admin_id", true));
    if (empty($admin_wp_id)) {
        $property_id  = intval(get_user_meta($user_id, "property_id", true));
        if (empty($property_id)) {
            $admin_wp_id = 0;
        } else {
            $_REQUEST['property_id_single'] = $property_id;
        }
    } else {
        $_REQUEST['admin_wp_id'] = $admin_wp_id;
    }
}

$rv = new stdClass();

if ($_REQUEST['pages'] == 'unit_list' && $_REQUEST['action'] == "r_unit_list" && $_REQUEST['sp1'] == 1) {
    $is_check = false;
}else if ($_REQUEST['pages'] == 'site_info' && $_REQUEST['action'] == "r_site_info") {
    $is_check = false;
}

if ($_REQUEST['pages'] == 'users' && in_array($_REQUEST['action'], [ "check_reg_user_code", "check_reset_pass_code", "send_reg_user_code", "send_reset_pass_code" ])) {
    $is_check = false;
}

if ($_REQUEST['pages'] == 'test') {
    $is_check = false;
}

if ($is_check || $debug) {
    if (has_token($token, false) != null) {
        $varify_flag = JwtAuthClass::verifyToken($token);
        $temp_user = has_token($token, false);
        if ($varify_flag == 1) {
        } else if ($varify_flag == 0) {
            $payload_new =
                array(
                    'iss' => 'keylab',
                    'iat' => time(),
                    'exp' => time() + 3600 * 24,
                    'nbf' => time() + 3600 * 24 + 3600 * 24 * 7,
                    'sub' => 'keylab.cc',
                    'jti' => md5(uniqid('JWT') . time())
                );
            $token_new = JwtAuthClass::getToken($payload_new);

            insert_token($temp_user->admin_wp_id, 0, $token_new, false);
            insert_token($temp_user->admin_wp_id, 0, $temp_user->token, true);

            $rv->token = $token_new;
        } else {
            $rv->rc = -100;
            $rv->msg = 'pass token';
            $rv->debug = JwtAuthClass::getTokenExp($token);
            $rv->debug2 = explode('.', $token);
            $rv->debug3 = array_change_key_case(getallheaders());
            echo json_encode($rv);
            exit();
        }
    } else {
        if (has_token($token, true) != null) {
            $varify_flag = JwtAuthClass::verifyToken($token);
            $temp_user = has_token($token, true);
            if ($varify_flag == 1 || $varify_flag == 0) {

                $rv->token = $temp_user->token;
            } else {
                $rv->rc = -100;
                $rv->msg = 'token expired';
                echo json_encode($rv);
                exit();
            }
        } else {
            $rv->rc = -100;
            $rv->msg = 'error token';
            echo json_encode($rv);
            exit();
        }
    }
}
//$rv->test = test_1();
$file = $dir . '/keylabData/' . $c . '/' . $a . '.php?checking_api_file=true';

$file_headers = @get_headers($file); //检测是否存在此文件
if (strpos($file_headers[0], 'OK') > -1) {
    global $wpdb;
    include 'keylabData/' . $c . '/' . $a . '.php';
    exit();
} else {
    $rv = new stdClass();
    $rv->rc = -255;
    $rv->msg = $file_headers[0];
    $rv->file = $file;
    echo json_encode($rv);
}