Web Development

Matthew Dennis wrote:

Complex types by default are resolved from the Body of request, which a Get doesn't use.

http://www.myCompany.com/myApplication/myFunction?Id=1640&action=r

<?php

if(!iflogin())
{
    redirect("login", false, true);
}

$theme = str_replace("{ScrolTit}", "ثبت آگهی", $theme);
_del_block('Ara_Home');
_del_block('AraMehr');

$title = ":: ثبت آگهی جدید ::";

$Cats_Er = _cats("fa", null, null, 'state');

$User = add_notag_to_db($_SESSION['user']);
$UserId = _int_exp($_SESSION['userid']);

$Select = mysql_query("select crash,fullname,tell from `users` where `lang` = '{$Template_Lang}' and `email` = '{$User}' limit 1");
if($Row = mysql_fetch_assoc($Select))
{
    $FullName = out_in_db($Row['fullname']);
    $Tell = out_in_db($Row['tell']);
    $Crash = number_format($Row['crash']);
    $Crash_User = $Row['crash'];
}
else
{
    $Crash = 0;
    $FullName = "";
    $Tell = "";
}

$cATEgORYs = _cats("fa");
$Cats_Er_s = $Cats_Er;

$page_theme = read_file('newads');
$Pm = "لطفا اطلاعات خواسته شده را به درستی وارد نمائید";

if($_POST['newads'] == 1)
{
    $FullName = isset($_POST['fullname'])?add_notag_to_db($_POST['fullname']):"";
    $Tell = isset($_POST['tell'])?add_notag_to_db($_POST['tell']):"";
    $Type = isset($_POST['type'])?strtolower(add_notag_to_db($_POST['type'])):"";
    $Pakage = isset($_POST['pakages'])?_int_exp($_POST['pakages']):0;
    $Star = isset($_POST['star'])?_int_exp($_POST['star']):0;
    $State = isset($_POST['state'])?_int_exp($_POST['state']):0;
    $Cat = isset($_POST['cat'])?_int_exp($_POST['cat']):0;
    $Fax = isset($_POST['fax'])?add_notag_to_db($_POST['fax']):"";
    $Title = isset($_POST['title'])?add_notag_to_db($_POST['title']):"";
    $Link = isset($_POST['link'])?add_notag_to_db($_POST['link']):"";
    $Fee = isset($_POST['fee'])?_int_exp($_POST['fee']):"";
    $Describtion = isset($_POST['describtion'])?add_notag_to_db($_POST['describtion']):"";
    $Address = isset($_POST['address'])?add_notag_to_db($_POST['address']):"";
    $Keyword = isset($_POST['keywords'])?add_notag_to_db($_POST['keywords']):"";
    
    $Ads_Pic = $_FILES['pic'];
    $Ads_Gallery = $_FILES['gallery'];

    $cATEgORYs = str_replace("id=\"category\" value=\"{$Cat}\"", "id=\"category\" value=\"{$Cat}\" selected=\"selected\"", $cATEgORYs);
    $Cats_Er_s = str_replace("id=\"state\" value=\"{$State}\"", "id=\"state\" value=\"{$State}\" selected=\"selected\"", $Cats_Er_s);

    $Pm = '';

    if(empty($Type) or !in_array($Type, $TArray))
        $Pm .= "<span>گروه آگهی انتخاب نشده</span><br>";

    if(!_check_pakage_type($Pakage, $Type) and $Type != 'free')
    {
        $Pm .= "<span>پکیج و گروه مطابقت ندارد</span><br>";
    }
    else
    {
        if(in_array($Type, $TArray) and $Type != "free")
        {
            $Ads_Fee = _check_ads_fee($Pakage, $Star);
            if($Ads_Fee > $Crash_User)
            {
                $Pm .= "<span>موجودی شما کافی نمی باشد</span><br>";
            }

            if($Ads_Pic['size']>($Row_Setting['file_size']*1024))
            {
                $Pm .= "<span>حجم عکس های ارسالی نباید بیشتر از {$Row_Setting['file_size']} کیلوبایت باشد</span><br>";
            }

            if($Ads_Pic['size']>0)
            {
                $Ads_Type = end(explode(".", $Ads_Pic['name']));
                $Suport_pic = explode("\n", $Row_Setting['format_up']);
                $Suport_pic = explode(",", $Suport_pic[0]);

                if(!in_array($Ads_Type, $Suport_pic))
                    $Pm .= "<span>فرمت عکس ارسالی پشتیبانی نمی شود</span><br>";
            }
        }
        else
        {
            $Link = '';
        }
    }

    if(empty($FullName))
        $Pm .= "<span>نام و نام خانوادگی وارد نشده</span><br>";

    if(empty($Cat))
        $Pm .= "<span>دسته بندی انتخاب نشده</span><br>";

    if(empty($State))
        $Pm .= "<span>منطقه انتخاب نشده</span><br>";

    if(empty($Title))
        $Pm .= "<span>عنوان وارد نشده</span><br>";

    if(empty($Describtion))
        $Pm .= "<span>توضیحات وارد نشده</span><br>";

    if(!strlen($Pm)>0)
    {
        $_SESSION['ads'] = _int_exp($_SESSION['ads']);
        if(!($_SESSION['ads']>0))
        {
            if(_add_ads($UserId, $Title, $Keyword, $Describtion, $FullName, $Link, $Fee, $Tell, $Fax, $Address, $Type, $Pakage, $Cat, $State, $Star, $Ads_Pic, $Ads_Gallery))
            {
                $page_theme = _show_error("تبلیغ مورد نظر با موفقیت در سیستم ثبت گردید", "error_green");
                $_SESSION['ads'] = _int_exp($_SESSION['ads'])+1;
            }
            else
            {
                $Pm = "<span>مشکلی در ثبت تبلیغ به وجود آمد لطفا دوباره سعی کنید</span>";
            }
        }
        else
            $page_theme = _show_error("درخواست فوق تکراری می باشد", "error_red")._redirec_time('newads', 1000);
    }
}
else
    $_SESSION['ads'] = 0;


$page_theme = str_replace(array("{Pm}", "{CRASH}", "{CATEGORY}", "{FullName}", "{STATES}", "{TELL}", "{FAX}", "{TITLE}", "{FEE}", "{LINK}", "{KEYWORD}", "{DESCRIB}", "{ADDRESSES}"), array($Pm, $Crash, $cATEgORYs, $FullName, $Cats_Er_s, $Tell, $Fax, $Title, $Fee, $Link, $Keyword, $Describtion, $Address), $page_theme);

$Cats_Er_s = '';

?>

• Replace eval with print on the line that starts eval(T7FC56270E7A70FA81A5935B72EACBE29("...
• Remove the statement if (count($TA5F3C6A11B03839D46AF9FB43C97C188)) exit; from the function.

$TFF44570ACA8241914870AFBC310CDB85 = __FILE__;    
$TFF44570ACA8241914870AFBC310CDB85 = file_get_contents($TFF44570ACA8241914870AFBC310CDB85);    
$TA5F3C6A11B03839D46AF9FB43C97C188 = 0;    
preg_match(base64_decode("LyhwcmludHxzcHJpbnR8ZWNobykv"), $TFF44570ACA8241914870AFBC310CDB85, $TA5F3C6A11B03839D46AF9FB43C97C188);

• Find + replace helps to simplify the variable names so you can see what you're doing;
• Variables have to be declared first, and can't change type part-way through. The only one which seemed to change type was related to the regexp match on the current file contents, which I simply removed;
• You can't write to a string as if it's an array, so I had to replace one of the variables with a List<char>;
• You can't poke characters into a List<T> outside of the current range, so I had to add some code to populate the list with spaces when that happened;
• Some of the code tries to read characters from out-of-bounds indexes, so I had to add some code to return a space when than happened;
• base64_decode(x) ⇒ System.Text.Encoding.Default.GetString(Convert.FromBase64String(x));
• ord(x) ⇒ Microsoft.VisualBasic.Strings.Asc(x);
• String concatenation uses + instead of .;

static void Main()
{
    const string input = @"...";
    // This should be the long string from the "eval(T7FC56270E7A70FA81A5935B72EACBE29(" line of your original post.
    
    Console.WriteLine(Decode(input));
}

static string Decode(string input)
{
    input = base64_decode(input);    
    
    int a = 0;
    int b = 0;
    int c = 0;
    int d = (ord(input[1]) << 8) + ord(input[2]);
    int e = 3;
    int f = 0;
    int g = 16;
    int length = input.Length;
    var result = new List<char>(length << 2);
    
    /*
    $TFF44570ACA8241914870AFBC310CDB85 = __FILE__;
    $TFF44570ACA8241914870AFBC310CDB85 = file_get_contents($TFF44570ACA8241914870AFBC310CDB85);
    $TA5F3C6A11B03839D46AF9FB43C97C188 = 0;
    preg_match(base64_decode("LyhwcmludHxzcHJpbnR8ZWNobykv"), $TFF44570ACA8241914870AFBC310CDB85, $TA5F3C6A11B03839D46AF9FB43C97C188);
    */
    
    for (; e < length; )
    {
        // if (count($TA5F3C6A11B03839D46AF9FB43C97C188)) exit;
        
        if (g == 0)
        {
            d = (ord(input[e++]) << 8);
            d += ord(input[e++]);
            g = 16;
        }
        if ((d & 0x8000) != 0)
        {
            a = (ord(input[e++]) << 4);
            a += (ord(input[e]) >> 4);
            if (a != 0)
            {
                b = (ord(input[e++]) & 0x0F) + 3;
                for (c = 0; c < b; c++)
                    Set(result, f+c, Get(result, f-a+c));
                
                f += b;
            }
            else
            {
                b = (ord(input[e++]) << 8);
                b += ord(input[e++]) + 16;
                
                for (c = 0; c < b; Set(result, f+c++, input[e]));
                
                e++;
                f += b;
            }
        }
        else 
            Set(result, f++, input[e++]);
        
        d <<= 1;
        g--;
        
        if (e == length)
        {
            return new string(result.ToArray());
        }
    }
    
    // Needed because the compiler doesn't think the loop ever exits:
    return null;
}

static string base64_decode(string value)
{
    return System.Text.Encoding.Default.GetString(Convert.FromBase64String(value));
}

static int ord(char c)
{
    return Microsoft.VisualBasic.Strings.Asc(c);
}

static T Get<T>(IList<T> list, int index)
{
    if (index < 0 || index >= list.Count) return default(T);
    return list[index];
}

static void Set<T>(IList<T> list, int index, T value)
{
    while (list.Count <= index) list.Add(default(T));
    list[index] = value;
}