Ups. Gefährlich!

[Klaus1]

Hier der Source-Code für das gesamte PHP-Script:

<? header("Content-Type: text/html; charset=utf8"); ?>

<?
include "config.php";

function guidv4($data = null) {
    // Generate 16 bytes (128 bits) of random data or use the data passed into the function.
    $data = $data ?? random_bytes(16);
    assert(strlen($data) == 16);

    // Set version to 0100
    $data[6] = chr(ord($data[6]) & 0x0f | 0x40);
    // Set bits 6-7 to 10
    $data[8] = chr(ord($data[8]) & 0x3f | 0x80);

    // Output the 36 character UUID.
    return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($data), 4));
}



$folder = $_POST["folder"];
$pwd = $_POST["pwd"];
$zippen = $_POST["zippen"];
$totalSize = $_POST["totalSize"];

$verbindung = @mysqli_connect($server,$login,$pass,$dbname);

if (!empty($folder)) {
	$target_path = "/srv/www/htdocs/test/upload/".$folder;
	$zip_path = "/srv/www/htdocs/test/upload";
	if ($zippen == "JA") {
		$zip_name    = $folder . '.zip';
		$zip_files   = $target_path;
		$sys = 'zip ' 
			 . escapeshellarg( $target_path . '/' . $zip_name ) 
			 . ' -0 -j -q -mT ' . escapeshellarg( $zip_files) 
			 . '/*';
		$result = system( $sys );
	}
	$uploader = $_SERVER["REMOTE_ADDR"];
	$datum = date("Y-m-d");
	$token = guidv4();
	$abfrage = "insert into transferdb (token,folder,uploader,pwd,lastaccess) values ('$token','$folder','$uploader','$pwd','$datum')";
	$erg = mysqli_query($verbindung, $abfrage);
	echo "ID=".$token;
}

mysqli_close($verbindung);
?>