我在Joomla中得到这个错误:
Illegal variable `_files` or `_env` or `_get` or `_post` or `_cookie`
or `_server` or `_session` or `globals` passed to script.
我没有得到多少帮助。
如果您试图指定一个名称仅由数字组成的URL参数,则会看到此错误,例如
http://www.example.com/?1234567=test
或者如果您尝试使用joomla保留的变量,例如
http://www.example.com/?_files=test
这不是一个伟大的错误信息。如果您可以访问unix终端,您可以使用一些命令行工具来调试这些问题,例如
$ find /var/www/html -exec grep -l 'Illegal variable' {} ;
/var/www/html/libraries/joomla/environment/request.php
这是一个虚构的joomla安装,假设有一个相当标准的DocumentRoot
。结果立即确认这是Joomla错误,并报告导致错误的文件。从该文件中提取:
static $banned = array( '_files', '_env', '_get', '_post', '_cookie', '_server', '_session', 'globals' );
foreach ($array as $key => $value)
{
// PHP GLOBALS injection bug
$failed = in_array( strtolower( $key ), $banned );
// PHP Zend_Hash_Del_Key_Or_Index bug
$failed |= is_numeric( $key );
if ($failed) {
jexit( 'Illegal variable <b>' . implode( '</b> or <b>', $banned ) . '</b> passed to script.' );
}
...
}
请注意,错误消息特别容易误导,因为不仅在保留变量名的情况下抛出,而且在参数名是数字的情况下也会抛出。
这不是PHP生成的错误,它似乎属于Joomla!我在谷歌上搜索"非法变量"20秒后找到了这个页面。
我必须为joomla 1.5修复这个问题
我是这样做的
查找文件/{your_joomla_folder}/libraries/joomla/environment/request.php
并使错误更友好
function clean()
{
JRequest::_cleanArray( $_FILES , false, 'FILES');
JRequest::_cleanArray( $_ENV , false, 'ENV' );
JRequest::_cleanArray( $_GET , false, 'GET' );
JRequest::_cleanArray( $_POST , false, 'POST' );
JRequest::_cleanArray( $_COOKIE , false, 'COOKIE' );
JRequest::_cleanArray( $_SERVER , false, 'SERVER' );
if (isset( $_SESSION )) {
JRequest::_cleanArray( $_SESSION , false, 'SESSION' );
}
$REQUEST = $_REQUEST;
$GET = $_GET;
$POST = $_POST;
$COOKIE = $_COOKIE;
$FILES = $_FILES;
$ENV = $_ENV;
$SERVER = $_SERVER;
if (isset ( $_SESSION )) {
$SESSION = $_SESSION;
}
foreach ($GLOBALS as $key => $value)
{
if ( $key != 'GLOBALS' ) {
unset ( $GLOBALS [ $key ] );
}
}
$_REQUEST = $REQUEST;
$_GET = $GET;
$_POST = $POST;
$_COOKIE = $COOKIE;
$_FILES = $FILES;
$_ENV = $ENV;
$_SERVER = $SERVER;
if (isset ( $SESSION )) {
$_SESSION = $SESSION;
}
// Make sure the request hash is clean on file inclusion
$GLOBALS['_JREQUEST'] = array();
}
function _cleanArray( &$array, $globalise=false, $type=null )
{
static $banned = array( '_files', '_env', '_get', '_post', '_cookie', '_server', '_session', 'globals' );
foreach ($array as $key => $value)
{
// PHP GLOBALS injection bug
$failed = in_array( strtolower( $key ), $banned );
$is_injection = false;
if($failed){
$is_injection = true;
}
// PHP Zend_Hash_Del_Key_Or_Index bug
$failed |= is_numeric( $key );
if ($failed) {
if($type){
$str = $type;
}else{
$str = implode( '</b> or <b>', $banned );
}
throw new Exception( 'Illegal variable <b>' . $str . '</b> passed to script.'.(($is_injection)?' (globals injection)': ' key "'.$key.'" is numeric in '.$str) );
//jexit( 'Illegal variable <b>' . implode( '</b> or <b>', $banned ) . '</b> passed to script.' );
}
if ($globalise) {
$GLOBALS[$key] = $value;
}
}
}
在我的例子中,AJAX脚本将文件上传为
$_FILES = array(
0=>array(
[name] => 6767.bmp
[type] => image/bmp
[tmp_name] => /tmp/phpfbIzXU
[error] => 0
[size] => 12774
),
);
0会导致问题,所以因为这是一个最小的脚本,我可以简单地将信息从$_FILES
传输到其他地方,然后joomla加载
,例如:
$files = array();
foreach($_FILES as $f){
$files[] = $f;
}
$_FILES = array('files'=>$files);
... joomla launch code...
define( '_JEXEC', 1 );
define('JPATH_BASE', realpath(dirname(dirname(__FILE__).'/')));
define( 'DS', DIRECTORY_SEPARATOR );
require JPATH_BASE . DS . 'includes' . DS . 'defines.php';
require JPATH_BASE . DS . 'includes' . DS . 'framework.php';
请注意,您不能在包含/includes/framework.php
之后使用变量$files
,因为joomla将没有用null覆盖它
唯一有效的解决方案是将request.php文件
中的以下行注释掉查找文件/{your_joomla_folder}/libraries/joomla/environment/request.php
//$failed |= is_numeric($key);