卷曲图像下载

Question

我用的是代码，这给我带来了问题，用卷发来获取图片。

public function getRemoteFile($url, $dest, $authmode = null, $cookies = null)
{
    $context = $this->createContext($url);
    $ch=$context['curlhandle'];
    $dl_opts = $context['opts']['dl'];
    $outname = $dest;

    if ($cookies)
    {

        if (substr($url, 0, 4) == "http")
        {
            $dl_opts[CURLOPT_COOKIE] = $cookies;
        }
    }

    $fp = fopen($outname, "w");
    if ($fp == false)
    {
        $this->destroyContext($context);
       throw new Exception("Cannot write file:$outname");
    }
    $dl_opts[CURLOPT_FILE] = $fp;
    $this->setURLOptions($url, $dl_opts);
    $this->setAuthOptions($context,$dl_opts);


    // Download the file , force expect to nothing to avoid buffer save problem
    curl_setopt_array($ch, $dl_opts);
    $inf = curl_getinfo($ch);
    if (!curl_exec($ch))
    {
       if (curl_error($ch) != "")
       {
           $err = "Cannot fetch $url :" . curl_error($ch);
       }
       else
       {
           $err = "CURL Error downloading $url";
       }
       $this->destroyContext($context);
       fclose($fp);
       unlink($dest);
       throw new Exception($err);
    }
    else
    {
     $proto=$context['scheme'];
     if($proto=='http' || $proto=='https')
      {
        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        $ok = ($httpCode < 400);
        if(!$ok)
        {
            fclose($fp);
            @unlink($outname);
            throw new Exception('Cannot fetch URL :'.$url);
        }
      }
    }

    fclose($fp); 
    $this->destroyContext($context);

    return true;
}

我得到了这个输出：

警告: /usr/home/shop.domain.com/web/productimport/inc/remotefilegetter.php中的curl_setopt_array()：当safe_mode启用或在第290号行中设置open_basedir时，无法激活safe_mode

我还试图查看在$dl_opts上可以得到什么，因为当我调用时会出现错误：

curl_setopt_array($ch, $dl_opts);

所以在$dl_opts里面：

Array ( [80] => 1 [42] => 0 [44] => 0 [52] => 1 [10023] => Array ( [0] => Expect: ) [19913] => [19914] => 1 [10001] => Resource id #261 [10002] => http://domain/picture/static/l0033.jpg )

信息：

• PHP 5.3.29
• safe_mode关闭
• /usr/home/shop.domain.com/:/home/shop.domain.com/:/usr/home/services/:/usr/share/php53/ :open_basedir

Answer 1

显然，使用CURLOPT_FOLLOWLOCATION允许301和302重定向将遵循重定向到文件://URL。(发现这个提交给PHP源：https://github.com/php/php-src/commit/fba290c061027c24e4c8effdba37addd3430c3d4 )

如果允许重定向到file:// URL，那么控制最初请求的URL的人可以让PHP脚本从服务器的本地磁盘中获取一个文件。从用户那里获取URL并显示内容的web服务可以用于从PHP可访问的服务器磁盘读取任何文件。

解决办法：

• 上面的链接中显示的提交修复了这个问题。更新PHP以修复
• 禁用CURLOPT_FOLLOWLOCATION
• 见老问题：FOLLOWLOCATION error