unrestricted file upload vulnerability

[P0wfuu]

You previously fixed one vulnerability of the theme file upload .

But now there is a similar vulnerability in /app/admin/appmini.php,because you didn't use the above method.

http://localhost:3000/admin.php?s=appmini/index/nav_type/weixin/view_type/upload.html


Then my file will be uploaded to sourcecode/weixin/

And i can bypass the !IS_AJAX，even upload my files to any writable directory using ../.
admin.php?s=appmini/themeupload&ajax=ajax

[gongfuxiang]

您之前修复了主题文件上传的一个漏洞。

但是现在有一个类似的漏洞/app/admin/appmini.php，因为你没有使用上面的方法。

http://localhost:3000/admin.php?s=appmini/index/nav_type/weixin/view_type/upload.html


然后我的文件将被上传到 sourcecode/weixin/

而且我可以绕过!IS_AJAX，甚至使用 将我的文件上传到任何可写目录../。
admin.php?s=appmini/themeupload&ajax=ajax

非常感谢您的反馈、已确定问题并在 dev 分支进行了优化
9b74bee