diff --git a/upload/api/db/dbbak.php b/upload/api/db/dbbak.php
index 201223f4..ba36fbc9 100644
--- a/upload/api/db/dbbak.php
+++ b/upload/api/db/dbbak.php
@@ -515,6 +515,10 @@ function halt($message = '', $sql = '') {
$get['volume'] = 0;
}
+ if(!preg_match('/^backup_(\d+)_\w+$/', $get['sqlpath']) || !preg_match('/^\d+_\w+\-(\d+).sql$/', $get['dumpfile'])) {
+ api_msg('bak_file_lose', $get['dumpfile']);
+ }
+
$get['volume']++;
$next_dumpfile = preg_replace('/^(\d+)\_(\w+)\-(\d+)\.sql$/', '\\1_\\2-'.$get['volume'].'.sql', $get['dumpfile']);
if(!is_file(BACKUP_DIR.$get['sqlpath'].'/'.$get['dumpfile'])) {
@@ -558,7 +562,7 @@ function halt($message = '', $sql = '') {
$directory = dir(BACKUP_DIR);
while($entry = $directory->read()) {
$filename = BACKUP_DIR.$entry;
- if(is_dir($filename) && preg_match('/backup_(\d+)_\w+$/', $filename, $match)) {
+ if(is_dir($filename) && preg_match('/^backup_(\d+)_\w+$/', $entry, $match)) {
$str .= "\t
\n";
$str .= "\t\t$filename\n";
$str .= "\t\t$match[1]\n";
diff --git a/upload/api/uc.php b/upload/api/uc.php
index 09f01231..7c8c27b7 100644
--- a/upload/api/uc.php
+++ b/upload/api/uc.php
@@ -111,7 +111,10 @@ function renameuser($get, $post) {
return API_RETURN_FORBIDDEN;
}
-
+ $len = strlen($get['newusername']);
+ if($len > 22 || $len < 3 || preg_match("/\s+|^c:\\con\\con|[%,\*\"\s\<\>\&\(\)']/is", $get['newusername'])) {
+ return API_RETURN_FAILED;
+ }
$tables = array(
'common_block' => array('id' => 'uid', 'name' => 'username'),
@@ -292,9 +295,10 @@ function updateapps($get, $post) {
if($UC_API && is_writeable(DISCUZ_ROOT.'./config/config_ucenter.php')) {
if(preg_match('/^https?:\/\//is', $UC_API)) {
+ require DISCUZ_ROOT.'./config/config_ucenter.php';
$configfile = trim(file_get_contents(DISCUZ_ROOT.'./config/config_ucenter.php'));
$configfile = substr($configfile, -2) == '?>' ? substr($configfile, 0, -2) : $configfile;
- $configfile = preg_replace("/define\('UC_API',\s*'.*?'\);/i", "define('UC_API', '".addslashes($UC_API)."');", $configfile);
+ $configfile = str_replace("define('UC_API', '".addslashes(UC_API)."')", "define('UC_API', '".addslashes($UC_API)."')", $configfile);
if($fp = @fopen(DISCUZ_ROOT.'./config/config_ucenter.php', 'w')) {
@fwrite($fp, trim($configfile));
@fclose($fp);
diff --git a/upload/config/config_global_default.php b/upload/config/config_global_default.php
index d182c7e5..0c2d0876 100644
--- a/upload/config/config_global_default.php
+++ b/upload/config/config_global_default.php
@@ -176,6 +176,7 @@
$_config['admincp']['checkip'] = 1; // 后台管理操作是否验证管理员的 IP, 1=是[安全], 0=否。仅在管理员无法登陆后台时设置 0。
$_config['admincp']['runquery'] = 0; // 是否允许后台运行 SQL 语句 1=是 0=否[安全]
$_config['admincp']['dbimport'] = 1; // 是否允许后台恢复论坛数据 1=是 0=否[安全]
+$_config['admincp']['mustlogin'] = 1; // 是否必须前台登录后才允许后台登录 1=是[安全] 0=否
/**
* 系统远程调用功能模块
diff --git a/upload/install/include/install_function.php b/upload/install/include/install_function.php
index 16389b5e..bcf94ef6 100644
--- a/upload/install/include/install_function.php
+++ b/upload/install/include/install_function.php
@@ -134,7 +134,7 @@ function env_check(&$env_items) {
if($key == 'php') {
$env_items[$key]['current'] = PHP_VERSION;
} elseif($key == 'attachmentupload') {
- $env_items[$key]['current'] = @ini_get('file_uploads') ? ini_get('upload_max_filesize') : 'unknow';
+ $env_items[$key]['current'] = @ini_get('file_uploads') ? (min(min(ini_get('upload_max_filesize'), ini_get('post_max_size')), ini_get('memory_limit'))) : 'unknow';
} elseif($key == 'gdversion') {
$tmp = function_exists('gd_info') ? gd_info() : array();
$env_items[$key]['current'] = empty($tmp['GD Version']) ? 'noext' : $tmp['GD Version'];
@@ -647,7 +647,7 @@ function showmessage(message) {