dedecms漏洞getshell

// 原始代码
if (isset($_FILES['file'])) {
    $file = $_FILES['file'];
    $upload_dir = './uploads/';
    if (move_uploaded_file($file['tmp_name'], $upload_dir . $file['name'])) {
        echo 'File uploaded successfully.';
    } else {
        echo 'Failed to upload file.';
    }
}

// 修复后的代码
if (isset($_FILES['file'])) {
    $file = $_FILES['file'];
    $upload_dir = './uploads/';
    $allowed_types = array('jpg', 'jpeg', 'png', 'gif');
    $file_ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    if (in_array($file_ext, $allowed_types) && move_uploaded_file($file['tmp_name'], $upload_dir . $file['name'])) {
        echo 'File uploaded successfully.';
    } else {
        echo 'Failed to upload file.';
    }
}