thinkPHP5.0漏洞修复

1、在thinkphp/library/think/文件下找到App.php，

搜索// 获取控制器名

    $controller = strip_tags($result[1] ?: $config['default_controller']);
	//添加
	if (!preg_match('/^[A-Za-z](\w|\.)*$/', $controller)) {
   throw new HttpException(404, 'controller not exists:' . $controller);
}

2、在thinkphp/library/think/文件下找到Request.php

搜索// public function method($method = false)改成如下

   public function method($method = false)
{
    if (true === $method) {
        // 获取原始请求类型
        return $this->server('REQUEST_METHOD') ?: 'GET';
    } elseif (!$this->method) {
        if (isset($_POST[Config::get('var_method')])) {
            $method = strtoupper($_POST[Config::get('var_method')]);
            if (in_array($method, ['GET', 'POST', 'DELETE', 'PUT', 'PATCH'])) {
                $this->method = $method;
                $this->{$this->method}($_POST);
            } else {
                $this->method = 'POST';
            }
            unset($_POST[Config::get('var_method')]);
        } elseif (isset($_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE'])) {
            $this->method = strtoupper($_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE']);
        } else {
            $this->method = $this->server('REQUEST_METHOD') ?: 'GET';
        }
    }
    return $this->method;
}

3、网站根目录下面

 // 定义应用目录
	define('APP_PATH', __DIR__ . '/app/');
加载框架引导文件
	require __DIR__ . '/thinkphp/start.php';

注：只修改上面俩个方法