“取消链接”不适用于本地 WordPress 实例?

发布于 2025-01-01 05:38:48 字数 1391 浏览 1 评论 0原文

我正在尝试修改一个插件,以便可以使用 html 链接删除目录中的图像文件。我的代码输出一个表格,其中包含图像缩略图、图像链接和删除文件的链接:

<?php                                                   
   $dirname = "../wp-content/themes/teenclub/images/slider/"; 
   $images = scandir($dirname); 
   $ignore = array(".", "..", ".DS_Store");

   foreach($images as $curimg){ 
       if(!in_array($curimg, $ignore)) {
       echo "<tr ><td><img width='200' src='$dirname$curimg'/></td><td><a href='$dirname$curimg'/>$curimg</a></td><td><a href='../wp-content/plugins/wp-easy-uploader/delete.php?file=$curimg'>Delete</a></td></tr>"; 
       };
   }                         
?>      

delete.php:

<?php
$dir = '/Users/edmcmanwich/Desktop/TEMP/dev.teenclub.com';
$file = $dir.'/'.$_GET["file"];

if(is_writable($file)) {
  unlink($file);
} else {
  echo 'you dont have perms dude';
}
?>

我收到消息说我没有权限,但我已将所有文件更改为 777另外,MAMP 的 php_error.log 给了我这个:

[01-Feb-2012 21:10:13] PHP Warning:  unlink(../wp-content/themes/teenclub/images/slider/kids.png) [<a href='function.unlink'>function.unlink</a>]: No such file or directory in /Users/edmcmanwich/Desktop/TEMP/dev.teenclub.com/wp-content/plugins/wp-easy-uploader/delete.php on line 4

目录和文件名是正确的,所以我只是不明白问题是什么......

I'm trying to modify a plugin so that image files from a directory can be deleted with an html link. My code spits out a table containing an image thumbnail, a link to the image, and a link to delete the file:

<?php                                                   
   $dirname = "../wp-content/themes/teenclub/images/slider/"; 
   $images = scandir($dirname); 
   $ignore = array(".", "..", ".DS_Store");

   foreach($images as $curimg){ 
       if(!in_array($curimg, $ignore)) {
       echo "<tr ><td><img width='200' src='$dirname$curimg'/></td><td><a href='$dirname$curimg'/>$curimg</a></td><td><a href='../wp-content/plugins/wp-easy-uploader/delete.php?file=$curimg'>Delete</a></td></tr>"; 
       };
   }                         
?>      

delete.php:

<?php
$dir = '/Users/edmcmanwich/Desktop/TEMP/dev.teenclub.com';
$file = $dir.'/'.$_GET["file"];

if(is_writable($file)) {
  unlink($file);
} else {
  echo 'you dont have perms dude';
}
?>

I get the message saying I don't have permission but I've chmod all the files to 777. In addition MAMP's php_error.log give me this:

[01-Feb-2012 21:10:13] PHP Warning:  unlink(../wp-content/themes/teenclub/images/slider/kids.png) [<a href='function.unlink'>function.unlink</a>]: No such file or directory in /Users/edmcmanwich/Desktop/TEMP/dev.teenclub.com/wp-content/plugins/wp-easy-uploader/delete.php on line 4

The directory and file name are correct so I just don't understand what the problem is...

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(2

奈何桥上唱咆哮 2025-01-08 05:38:48

你一定是目录写错了。

unlink 显示文件位置 ../wp-content/themes/teenclub/images/slider/kids.png 但您的目录设置为 /Users/ edmcmanwich/Desktop/TEMP/dev.teenclub.com。因此,您的完整路径应为 /Users/edmcmanwich/Desktop/TEMP/dev.teenclub.com/../wp-content/themes/teenclub/images/slider/kids.png (或 < code>/Users/edmcmanwich/Desktop/TEMP/dev.teenclub.com/kids.png 根据您的来源),根据您的错误消息,情况并非如此。

运行 echo getcwd(); 查看删除脚本运行在哪个目录,您应该会看到文件路径不正确。或者,该文件已被删除,因此不存在。

而且,这是非常不安全的,因为任何人都可以将他们想要的任何内容传递给 $_GET['file'] 并可能删除该文件。例如,如果您搞砸了 /etc/passwd 的权限,那么有人可以使用 ../../../../../../.. 删除它。 /../../../../../etc/passwd

You must have the directories wrong.

unlink shows a file location of ../wp-content/themes/teenclub/images/slider/kids.png yet your directory is set as /Users/edmcmanwich/Desktop/TEMP/dev.teenclub.com. So, your full path should be /Users/edmcmanwich/Desktop/TEMP/dev.teenclub.com/../wp-content/themes/teenclub/images/slider/kids.png (or /Users/edmcmanwich/Desktop/TEMP/dev.teenclub.com/kids.png according to your source), which isn't the case according to your error message.

Run echo getcwd(); to see what directory your delete script is running at, you should see that the file path is incorrect. Or, the file was already deleted and is therefore does not exist.

Also, this is horribly insecure, as anybody can pass anything they want to $_GET['file'] and potentially delete the file. For example, if you screwed with the permissions on /etc/passwd, somebody could delete it with ../../../../../../../../../../../../etc/passwd.

我一直都在从未离去 2025-01-08 05:38:48

好吧,您已经知道这是不好的做法,但是您遇到的问题很可能涉及您使用相对路径。

尝试使用 realpath 包装文件路径
看看是否能解决问题。另请注意,如果使用 null 参数调用 realpath,它将返回您肯定不想删除的当前目录。

有关详细信息,请参阅 unlink 的文档和file:// 协议。

Well, you already know that this is bad practice however the issue your running in to most likely involves your use of a relative path.

Try wrapping the file path with realpath
and see if that fixes the problem. Also be aware that if realpath is called with a null argument it will return the current directory which you would most certainly not want to delete.

For more information see the documentation for unlink and the file:// protocol.

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文