zhimengzhe/ibarn

iBarn SkyDrive provides file network backup, synchronization and sharing service. This system can resume upload and down file and if someone uploads one file when you upload it too, it needn't upload any more, directly upload success. You can choose file download to local or online collection. The recycle bin function to prevent users from accidentally deleted data. While providing customized services, and the two development. the intention to contact by email [email protected] or QQ 451802973.iBarn网盘，功能强大，堪比百度网盘

ibarn's Issues

当文件名为中文的时候无法进行下载

当文件名为中文，点击下载会服务器500错误。

程序存在兼容性问题

sql语句存在兼容性问题 我的mysql版本5.7.16 PHP7.1
表中的time字段 DEFAULT '0000-00-00 00:00:00' 会报错 导致无法安装 为什么不用int 存时间戳呢?
分享提示操作失败 我等下去看下是啥问题
客户端运行没反应... win7 x64

iBarn v1.5 has a reflected XSS vulnerability

Summary

A reflected Cross Site Scripting (XSS) vulnerability exists in iBarn v1.5 due to improper sanitization of the $search parameter in the html/index.php, html/pay.php, and html/own.php files. Although the htmlspecialchars function is used to encode HTML entities, the developers utilized the flag ENT_NOQUOTES, which does not encode single or double quotes, leading to the vulnerability.

Details

The misuse of the htmlspecialchars function allows the injection of JavaScript code into the search field, which can be exploited for XSS attacks.

html/index.php:

   <input type="text" class="form-control" id="search" name="search" value="<?php echo htmlspecialchars($_REQUEST['search'], ENT_NOQUOTES); ?>" placeholder="<?php echo t('搜你想要'); ?>">

html/pay.php:

   <input type="text" class="form-control" id="search" name="search" value="<?php echo htmlspecialchars($_REQUEST['search'], ENT_NOQUOTES); ?>" placeholder="搜你想要">

html/own.php:

   <input type="text" class="form-control" id="search" name="search" value="<?php echo htmlspecialchars($_REQUEST['search'], ENT_NOQUOTES); ?>" placeholder="<?php echo t('搜你想要'); ?>">

Proof of Concept (PoC)

http(s)://ip:port/index.php?search=1%22%20onmouseover=alert(document.cookie)%20bad=%221

Differentiation from CVE-2024-26471

This vulnerability is distinct from CVE-2024-26471 as it specifically targets the $search parameter processed through the htmlspecialchars function and then bypasses filtering.
Although CVE-2024-26471 only mentioned that the search field in html/offer.php lacks any filtering, our investigation revealed that several other pages (shareme.php, recycle.php, collection.php, pub.php, myshare.php) also do not filter the $search parameter, leading to multiple cross-site scripting (XSS) vulnerabilities.

There is a Arbitrary File Upload vulnerability that can upload a php file and be executed.

you can upload any file as avatar at " /index.php?m=user&a=avatar". Althought the server's response show that you are fail to set avatar, but the file was uploaded,And the file can be easily to locate by uid which shows in your cookies.

/action/Core.class.php

 public function upload() {
        if (!$_REQUEST['uid']) {
            echo Response::json(LACK, array(tip('用户ID不能为空')));
            exit;
        }
        $_REQUEST['name'] = self::filterName(rawurldecode(self::trimSpace($_REQUEST['name'])));
        if (!$_REQUEST['name']) {
            echo Response::json(LACK, array(tip('文件名不能为空')));
            exit;
        }
        if (!$_REQUEST['type']) {
            if (!file_exists(DATA_DIR)) {
                $res = mkdir(DATA_DIR, 0777, true);
                if (!$res) {
                    echo Response::json(FAIL, array(tip('存储目录创建失败')));
                    exit;
                }
            }
        }
        if (!file_exists(UP_DIR)) {
            $res = mkdir(UP_DIR, 0777, true);
            if (!$res) {
                echo Response::json(FAIL, array(tip('存储目录创建失败')));
                exit;
            }
        }
        include LIB_PATH . 'plupload' . DS . 'PluploadHandler.php';
        PluploadHandler::no_cache_headers();
        PluploadHandler::cors_headers();
        if (!PluploadHandler::handle(array(
            'target_dir' => UP_DIR,
            //'allow_extensions' => 'jpg,jpeg,png'
        ))) {
            echo Response::json(FAIL, array(tip('上传失败')));
            exit;
        } else {
            echo Response::json(SUCC, array(tip('上传成功')));
        }
    }

if I logined uid is 185 and my upload filename is backdoor.php. Then http://mywebsite.com/files/18/05/backdoor.php is my really backdoor.

what's more:
I think the line "//'allow_extensions' => 'jpg,jpeg,png'" is not good to be commented.

右侧边框闪屏

http://www.godeye.org:82/

点击左侧的导航栏，右侧页面刷新时出现右侧边框有黑线闪一下。

http://xxx.xxx.xxx/admin或者admin.php进入不了后台

http://xxx.xxx.xxx/admin或者admin.php进入不了后台

iBarn-win-1.1win客户端如何使用？

请教 iBarn-win-1.1win客户端如何使用？

吐槽一下 二次开发 = "the two development"

太不专业了

有手机客户端吗

有手机客户端吗

差评

差评

分享至群組功能?

請問有分享至群組的功能嗎?我似乎只看到分享給個人的部份

懂什么叫开源？

怕是神经病吧，这垃圾玩意都开源了还，版权所有，翻版必究，未经同意不得用于商业项目

存储容量更新问题

似乎有个小问题，上传一个文件然后删除再还原，文件仍然存在，但是占用空间还原时并没有更新，需要重新上传个文件才会更新

对文件格式有限制吗

感谢版主开发的软件，反应很快。我在上传ziprar等格式文件提示目录不存在，上传png等图片正常。在uploadconfig里没有看到zip等设置，是不行吗？

PHP7使用

我承认这个源码很好，但是不支持mysqli是个很悲催的事情。对了flash现在越来越多的设备不用了，建议去掉flash.