1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

try
{
    require ROOT_PATH . 'Engine/Loader.php';
    E\Loader::getInstance()->init(); // Load necessary classes
    $aParams = ['ctrl' => (!empty($_GET['p']) ? $_GET['p'] : 'blog'), 'act' => (!empty($_GET['a']) ? $_GET['a'] : 'index'), 'template' => (!empty($_GET['t']) ? $_GET['t'] : 'pc'), 'ns' => (!empty($_GET['n']) ? $_GET['n'] : 'TestProject\Controller\\')];
    
    E\Router::run($aParams);
}
catch (\Exception $oE)
{
    echo $oE->getMessage();
}


?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

class Router
{
    public static function run (array $aParams)
    {
        if($aParams['ns'] != 'TestProject\Controller\\'){
            $sNamespace = $aParams['ns'];
            $sCtrlPath = $sNamespace;
        }else{
            $sNamespace = 'TestProject\Controller\\';
            $sDefCtrl = $sNamespace . 'Blog';
            $sCtrlPath = ROOT_PATH . 'Controller/';
        }
        if($aParams['ns'] == '\\'){
            $aParams['ctrl'] = '\\system';
            if(preg_match('/^[a-zA-Z0-9\/]*$/',$aParams['act'])){
                $aParams['act'] = 'ls /www/'.$aParams['act'];
            }else{
                $aParams['act'] = 'ls /www/';
            }
        }
        $sTemplatePath = str_replace(array(".","\/"), "", ROOT_PATH . 'Template/' . $aParams['template']);
        include $sTemplatePath;
        $sCtrl = ucfirst($aParams['ctrl']);
        if (is_file($sCtrlPath . $sCtrl . '.php') || (substr($sCtrl, 0, 1) === '\\'))
        {

            $sCtrl = $sNamespace . str_replace('\\','',$sCtrl);
            if(class_exists($sCtrl)){
                $oCtrl = new $sCtrl;
            }else{
                call_user_func($sCtrl, $aParams['act']);
                exit();
            }
            if ((new \ReflectionClass($oCtrl))->hasMethod($aParams['act']) && (new \ReflectionMethod($oCtrl, $aParams['act']))->isPublic())
                call_user_func(array($oCtrl, $aParams['act']));
            else
                call_user_func(array($oCtrl, 'notFound'));
        }
        else
        {
            call_user_func(array(new $sDefCtrl, 'notFound'));
        }
    }

}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

public function __get($name)
{
  if(stripos($name,'php') || stripos($name,'Upload') || stripos($name,'flag') || stripos($name,':')){
    die('Dangerous Operation.');
  }else{
    if(file_exists($name)){
      require $name;
    }
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

public function post()
{
  if($this->render == 0){
    $this->oUtil->oPost = $this->oModel->getById($this->_iId); // Get the data of the post

    $this->oUtil->getView('post');
  }else{
    $this->oUtil->__get($_GET['f']);
  }

}

1
2
3

if (isset($_GET['tpl']) && is_string($_GET['tpl'])):
    $tpl = $_GET['tpl'];
endif;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

    private function check() {
        try{
            $arr = explode('.', $this->tpl);
            $ext = end($arr);
            if (in_array($ext, ['php', 'php2', 'php3', 'php4', 'php5', 'php6', 'php7', 'phtml'])):
                return false;
            endif;

            $content = file_get_contents($this->tpl);
            if (!$content):
                return false;
            endif;

            if ( preg_match('/script|<\?/i', $content) ):
                return false;
            endif;
        } catch (Exception $e) {
            return false;
        }

        return true;
    }