new file code

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/.gitattributes

@@ -0,0 +1,15 @@
+# Set default behaviour, in case users don't have core.autocrlf set.
+* text=auto
+
+# Explicitly declare text files we want to always be normalized and converted 
+# to native line endings on checkout.
+*.php text eol=lf
+*.js text eol=lf
+*.css text eol=lf
+*.html text eol=lf
+*.xml text eol=lf
+
+# Denote all files that are truly binary and should not be modified.
+*.png binary
+*.jpg binary
+

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/.gitignore

@@ -0,0 +1,28 @@
+.*.swp
+.*.swo
+._*
+.DS_Store
+/ImgCache/
+/Backup_rar/
+/Debug/
+/debug/
+/upload/
+/avatar/
+/.idea/
+.svn/
+*.orig
+*.aps
+*.APS
+*.chm
+*.exp
+*.pdb
+*.rar
+*.mo
+*.po
+*.pot
+.smbdelete*
+*.sublime*
+.sass-cache
+config.rb
+/config.inc.php
+/usr/uploads/

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/.travis.yml

@@ -0,0 +1,12 @@
+language: php
+
+php:
+  - 5.6
+  - 5.5
+  - 5.4
+  - 5.3
+  - 5.2
+  - hhvm
+
+script: cd ./tools/ && set -e && make test
+

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/README.md

@@ -0,0 +1,15 @@
+Typecho Blogging Platform
+=========================
+
+####Homepage
+http://typecho.org/
+
+####Document
+http://docs.typecho.org/
+
+####Forum
+http://forum.typecho.org/
+
+####Download
+http://typecho.org/download
+

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/category.php

@@ -0,0 +1,23 @@
+<?php
+include 'common.php';
+include 'header.php';
+include 'menu.php';
+?>
+
+<div class="main">
+    <div class="body container">
+        <?php include 'page-title.php'; ?>
+        <div class="row typecho-page-main" role="form">
+            <div class="col-mb-12 col-tb-6 col-tb-offset-3">
+                <?php Typecho_Widget::widget('Widget_Metas_Category_Edit')->form()->render(); ?>
+            </div>
+        </div>
+    </div>
+</div>
+
+<?php
+include 'copyright.php';
+include 'common-js.php';
+include 'form-js.php';
+include 'footer.php';
+?>

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/common-js.php

@@ -0,0 +1,105 @@
+<?php if(!defined('__TYPECHO_ADMIN__')) exit; ?>
+<script src="<?php $options->adminStaticUrl('js', 'jquery.js?v=' . $suffixVersion); ?>"></script>
+<script src="<?php $options->adminStaticUrl('js', 'jquery-ui.js?v=' . $suffixVersion); ?>"></script>
+<script src="<?php $options->adminStaticUrl('js', 'typecho.js?v=' . $suffixVersion); ?>"></script>
+<script>
+    (function () {
+        $(document).ready(function() {
+            // 处理消息机制
+            (function () {
+                var prefix = '<?php echo Typecho_Cookie::getPrefix(); ?>',
+                    cookies = {
+                        notice      :   $.cookie(prefix + '__typecho_notice'),
+                        noticeType  :   $.cookie(prefix + '__typecho_notice_type'),
+                        highlight   :   $.cookie(prefix + '__typecho_notice_highlight')
+                    },
+                    path = '<?php echo Typecho_Cookie::getPath(); ?>';
+
+                if (!!cookies.notice && 'success|notice|error'.indexOf(cookies.noticeType) >= 0) {
+                    var head = $('.typecho-head-nav'),
+                        p = $('<div class="message popup ' + cookies.noticeType + '">'
+                        + '<ul><li>' + $.parseJSON(cookies.notice).join('</li><li>') 
+                        + '</li></ul></div>'), offset = 0;
+
+                    if (head.length > 0) {
+                        p.insertAfter(head);
+                        offset = head.outerHeight();
+                    } else {
+                        p.prependTo(document.body);
+                    }
+
+                    function checkScroll () {
+                        if ($(window).scrollTop() >= offset) {
+                            p.css({
+                                'position'  :   'fixed',
+                                'top'       :   0
+                            });
+                        } else {
+                            p.css({
+                                'position'  :   'absolute',
+                                'top'       :   offset
+                            });
+                        }
+                    }
+
+                    $(window).scroll(function () {
+                        checkScroll();
+                    });
+
+                    checkScroll();
+
+                    p.slideDown(function () {
+                        var t = $(this), color = '#C6D880';
+                        
+                        if (t.hasClass('error')) {
+                            color = '#FBC2C4';
+                        } else if (t.hasClass('notice')) {
+                            color = '#FFD324';
+                        }
+
+                        t.effect('highlight', {color : color})
+                            .delay(5000).slideUp(function () {
+                            $(this).remove();
+                        });
+                    });
+
+                    
+                    $.cookie(prefix + '__typecho_notice', null, {path : path});
+                    $.cookie(prefix + '__typecho_notice_type', null, {path : path});
+                }
+
+                if (cookies.highlight) {
+                    $('#' + cookies.highlight).effect('highlight', 1000);
+                    $.cookie(prefix + '__typecho_notice_highlight', null, {path : path});
+                }
+            })();
+
+
+            // 导航菜单 tab 聚焦时展开下拉菜单
+            (function () {
+                $('#typecho-nav-list').find('.parent a').focus(function() {
+                    $('#typecho-nav-list').find('.child').hide();
+                    $(this).parents('.root').find('.child').show();
+                });
+                $('.operate').find('a').focus(function() {
+                    $('#typecho-nav-list').find('.child').hide();
+                });
+            })();
+
+
+            if ($('.typecho-login').length == 0) {
+                $('a').each(function () {
+                    var t = $(this), href = t.attr('href');
+
+                    if ((href && href[0] == '#')
+                        || /^<?php echo preg_quote($options->adminUrl, '/'); ?>.*$/.exec(href) 
+                            || /^<?php echo substr(preg_quote(Typecho_Common::url('s', $options->index), '/'), 0, -1); ?>action\/[_a-zA-Z0-9\/]+.*$/.exec(href)) {
+                        return;
+                    }
+
+                    t.attr('target', '_blank');
+                });
+            }
+        });
+    })();
+</script>

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/common.php

@@ -0,0 +1,59 @@
+<?php
+if (!defined('__DIR__')) {
+    define('__DIR__', dirname(__FILE__));
+}
+
+define('__TYPECHO_ADMIN__', true);
+
+/** 载入配置文件 */
+if (!defined('__TYPECHO_ROOT_DIR__') && !@include_once __DIR__ . '/../config.inc.php') {
+    file_exists(__DIR__ . '/../install.php') ? header('Location: ../install.php') : print('Missing Config File');
+    exit;
+}
+
+/** 初始化组件 */
+Typecho_Widget::widget('Widget_Init');
+
+/** 注册一个初始化插件 */
+Typecho_Plugin::factory('admin/common.php')->begin();
+
+Typecho_Widget::widget('Widget_Options')->to($options);
+Typecho_Widget::widget('Widget_User')->to($user);
+Typecho_Widget::widget('Widget_Security')->to($security);
+Typecho_Widget::widget('Widget_Menu')->to($menu);
+
+/** 初始化上下文 */
+$request = $options->request;
+$response = $options->response;
+
+/** 检测是否是第一次登录 */
+$currentMenu = $menu->getCurrentMenu();
+list($prefixVersion, $suffixVersion) = explode('/', $options->version);
+$params = parse_url($currentMenu[2]);
+$adminFile = basename($params['path']);
+
+if (!$user->logged && !Typecho_Cookie::get('__typecho_first_run') && !empty($currentMenu)) {
+    
+    if ('welcome.php' != $adminFile) {
+        $response->redirect(Typecho_Common::url('welcome.php', $options->adminUrl));
+    } else {
+        Typecho_Cookie::set('__typecho_first_run', 1);
+    }
+    
+} else {
+
+    /** 检测版本是否升级 */
+    if ($user->pass('administrator', true) && !empty($currentMenu)) {
+        $mustUpgrade = (!defined('Typecho_Common::VERSION') || version_compare(str_replace('/', '.', Typecho_Common::VERSION),
+        str_replace('/', '.', $options->version), '>'));
+
+        if ($mustUpgrade && 'upgrade.php' != $adminFile) {
+            $response->redirect(Typecho_Common::url('upgrade.php', $options->adminUrl));
+        } else if (!$mustUpgrade && 'upgrade.php' == $adminFile) {
+            $response->redirect($options->adminUrl);
+        } else if (!$mustUpgrade && 'welcome.php' == $adminFile && $user->logged) {
+            $response->redirect($options->adminUrl);
+        }
+    }
+
+}

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/copyright.php

@@ -0,0 +1,13 @@
+<?php if(!defined('__TYPECHO_ADMIN__')) exit; ?>
+<div class="typecho-foot" role="contentinfo">
+    <div class="copyright">
+        <a href="http://typecho.org" class="i-logo-s">Typecho</a>
+        <p><?php _e('由 <a href="http://typecho.org">%s</a> 强力驱动, 版本 %s (%s)', $options->software, $prefixVersion, $suffixVersion); ?></p>
+    </div>
+    <nav class="resource">
+        <a href="http://docs.typecho.org"><?php _e('帮助文档'); ?></a> &bull;
+        <a href="http://forum.typecho.org"><?php _e('支持论坛'); ?></a> &bull;
+        <a href="https://github.com/typecho/typecho/issues"><?php _e('报告错误'); ?></a> &bull;
+        <a href="http://extends.typecho.org"><?php _e('资源下载'); ?></a>
+    </nav>
+</div>

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/css/grid.css

@@ -0,0 +1,748 @@
+/*
+ * Bento Grid System
+ * Source: https://github.com/fenbox/bento
+ * Version: 1.2.8
+ * Update: 2013.11.25
+ */
+/* line 23, ../scss/grid.scss */
+.container, .row [class*="col-"] {
+  -webkit-box-sizing: border-box;
+  -moz-box-sizing: border-box;
+  box-sizing: border-box; }
+
+/* line 31, ../scss/grid.scss */
+.container {
+  margin-left: auto;
+  margin-right: auto;
+  padding-left: 10px;
+  padding-right: 10px; }
+
+/* line 40, ../scss/grid.scss */
+.row {
+  margin-right: -10px;
+  margin-left: -10px; }
+
+/* line 46, ../scss/grid.scss */
+.row [class*="col-"] {
+  float: left;
+  min-height: 1px;
+  padding-right: 10px;
+  padding-left: 10px; }
+
+/* line 54, ../scss/grid.scss */
+.row [class*="-push-"],
+.row [class*="-pull-"] {
+  position: relative; }
+
+/*
+ * Mobile and up
+ */
+/* line 65, ../scss/grid.scss */
+.col-mb-1 {
+  width: 8.33333%; }
+
+/* line 65, ../scss/grid.scss */
+.col-mb-2 {
+  width: 16.66667%; }
+
+/* line 65, ../scss/grid.scss */
+.col-mb-3 {
+  width: 25%; }
+
+/* line 65, ../scss/grid.scss */
+.col-mb-4 {
+  width: 33.33333%; }
+
+/* line 65, ../scss/grid.scss */
+.col-mb-5 {
+  width: 41.66667%; }
+
+/* line 65, ../scss/grid.scss */
+.col-mb-6 {
+  width: 50%; }
+
+/* line 65, ../scss/grid.scss */
+.col-mb-7 {
+  width: 58.33333%; }
+
+/* line 65, ../scss/grid.scss */
+.col-mb-8 {
+  width: 66.66667%; }
+
+/* line 65, ../scss/grid.scss */
+.col-mb-9 {
+  width: 75%; }
+
+/* line 65, ../scss/grid.scss */
+.col-mb-10 {
+  width: 83.33333%; }
+
+/* line 65, ../scss/grid.scss */
+.col-mb-11 {
+  width: 91.66667%; }
+
+/* line 65, ../scss/grid.scss */
+.col-mb-12 {
+  width: 100%; }
+
+/*
+ * Tablet and up
+ */
+@media (min-width: 768px) {
+  /* line 76, ../scss/grid.scss */
+  .container {
+    max-width: 728px; }
+
+  /* line 82, ../scss/grid.scss */
+  .col-tb-1 {
+    width: 8.33333%; }
+
+  /* line 82, ../scss/grid.scss */
+  .col-tb-2 {
+    width: 16.66667%; }
+
+  /* line 82, ../scss/grid.scss */
+  .col-tb-3 {
+    width: 25%; }
+
+  /* line 82, ../scss/grid.scss */
+  .col-tb-4 {
+    width: 33.33333%; }
+
+  /* line 82, ../scss/grid.scss */
+  .col-tb-5 {
+    width: 41.66667%; }
+
+  /* line 82, ../scss/grid.scss */
+  .col-tb-6 {
+    width: 50%; }
+
+  /* line 82, ../scss/grid.scss */
+  .col-tb-7 {
+    width: 58.33333%; }
+
+  /* line 82, ../scss/grid.scss */
+  .col-tb-8 {
+    width: 66.66667%; }
+
+  /* line 82, ../scss/grid.scss */
+  .col-tb-9 {
+    width: 75%; }
+
+  /* line 82, ../scss/grid.scss */
+  .col-tb-10 {
+    width: 83.33333%; }
+
+  /* line 82, ../scss/grid.scss */
+  .col-tb-11 {
+    width: 91.66667%; }
+
+  /* line 82, ../scss/grid.scss */
+  .col-tb-12 {
+    width: 100%; }
+
+  /* line 89, ../scss/grid.scss */
+  .col-tb-offset-0 {
+    margin-left: 0%; }
+
+  /* line 89, ../scss/grid.scss */
+  .col-tb-offset-1 {
+    margin-left: 8.33333%; }
+
+  /* line 89, ../scss/grid.scss */
+  .col-tb-offset-2 {
+    margin-left: 16.66667%; }
+
+  /* line 89, ../scss/grid.scss */
+  .col-tb-offset-3 {
+    margin-left: 25%; }
+
+  /* line 89, ../scss/grid.scss */
+  .col-tb-offset-4 {
+    margin-left: 33.33333%; }
+
+  /* line 89, ../scss/grid.scss */
+  .col-tb-offset-5 {
+    margin-left: 41.66667%; }
+
+  /* line 89, ../scss/grid.scss */
+  .col-tb-offset-6 {
+    margin-left: 50%; }
+
+  /* line 89, ../scss/grid.scss */
+  .col-tb-offset-7 {
+    margin-left: 58.33333%; }
+
+  /* line 89, ../scss/grid.scss */
+  .col-tb-offset-8 {
+    margin-left: 66.66667%; }
+
+  /* line 89, ../scss/grid.scss */
+  .col-tb-offset-9 {
+    margin-left: 75%; }
+
+  /* line 89, ../scss/grid.scss */
+  .col-tb-offset-10 {
+    margin-left: 83.33333%; }
+
+  /* line 89, ../scss/grid.scss */
+  .col-tb-offset-11 {
+    margin-left: 91.66667%; }
+
+  /* line 89, ../scss/grid.scss */
+  .col-tb-offset-12 {
+    margin-left: 100%; }
+
+  /* line 96, ../scss/grid.scss */
+  .col-tb-pull-0 {
+    right: 0%; }
+
+  /* line 96, ../scss/grid.scss */
+  .col-tb-pull-1 {
+    right: 8.33333%; }
+
+  /* line 96, ../scss/grid.scss */
+  .col-tb-pull-2 {
+    right: 16.66667%; }
+
+  /* line 96, ../scss/grid.scss */
+  .col-tb-pull-3 {
+    right: 25%; }
+
+  /* line 96, ../scss/grid.scss */
+  .col-tb-pull-4 {
+    right: 33.33333%; }
+
+  /* line 96, ../scss/grid.scss */
+  .col-tb-pull-5 {
+    right: 41.66667%; }
+
+  /* line 96, ../scss/grid.scss */
+  .col-tb-pull-6 {
+    right: 50%; }
+
+  /* line 96, ../scss/grid.scss */
+  .col-tb-pull-7 {
+    right: 58.33333%; }
+
+  /* line 96, ../scss/grid.scss */
+  .col-tb-pull-8 {
+    right: 66.66667%; }
+
+  /* line 96, ../scss/grid.scss */
+  .col-tb-pull-9 {
+    right: 75%; }
+
+  /* line 96, ../scss/grid.scss */
+  .col-tb-pull-10 {
+    right: 83.33333%; }
+
+  /* line 96, ../scss/grid.scss */
+  .col-tb-pull-11 {
+    right: 91.66667%; }
+
+  /* line 96, ../scss/grid.scss */
+  .col-tb-pull-12 {
+    right: 100%; }
+
+  /* line 103, ../scss/grid.scss */
+  .col-tb-push-0 {
+    left: 0%; }
+
+  /* line 103, ../scss/grid.scss */
+  .col-tb-push-1 {
+    left: 8.33333%; }
+
+  /* line 103, ../scss/grid.scss */
+  .col-tb-push-2 {
+    left: 16.66667%; }
+
+  /* line 103, ../scss/grid.scss */
+  .col-tb-push-3 {
+    left: 25%; }
+
+  /* line 103, ../scss/grid.scss */
+  .col-tb-push-4 {
+    left: 33.33333%; }
+
+  /* line 103, ../scss/grid.scss */
+  .col-tb-push-5 {
+    left: 41.66667%; }
+
+  /* line 103, ../scss/grid.scss */
+  .col-tb-push-6 {
+    left: 50%; }
+
+  /* line 103, ../scss/grid.scss */
+  .col-tb-push-7 {
+    left: 58.33333%; }
+
+  /* line 103, ../scss/grid.scss */
+  .col-tb-push-8 {
+    left: 66.66667%; }
+
+  /* line 103, ../scss/grid.scss */
+  .col-tb-push-9 {
+    left: 75%; }
+
+  /* line 103, ../scss/grid.scss */
+  .col-tb-push-10 {
+    left: 83.33333%; }
+
+  /* line 103, ../scss/grid.scss */
+  .col-tb-push-11 {
+    left: 91.66667%; }
+
+  /* line 103, ../scss/grid.scss */
+  .col-tb-push-12 {
+    left: 100%; } }
+/*
+ * Desktop and up
+ */
+@media (min-width: 992px) {
+  /* line 115, ../scss/grid.scss */
+  .container {
+    max-width: 952px; }
+
+  /* line 121, ../scss/grid.scss */
+  .col-1 {
+    width: 8.33333%; }
+
+  /* line 121, ../scss/grid.scss */
+  .col-2 {
+    width: 16.66667%; }
+
+  /* line 121, ../scss/grid.scss */
+  .col-3 {
+    width: 25%; }
+
+  /* line 121, ../scss/grid.scss */
+  .col-4 {
+    width: 33.33333%; }
+
+  /* line 121, ../scss/grid.scss */
+  .col-5 {
+    width: 41.66667%; }
+
+  /* line 121, ../scss/grid.scss */
+  .col-6 {
+    width: 50%; }
+
+  /* line 121, ../scss/grid.scss */
+  .col-7 {
+    width: 58.33333%; }
+
+  /* line 121, ../scss/grid.scss */
+  .col-8 {
+    width: 66.66667%; }
+
+  /* line 121, ../scss/grid.scss */
+  .col-9 {
+    width: 75%; }
+
+  /* line 121, ../scss/grid.scss */
+  .col-10 {
+    width: 83.33333%; }
+
+  /* line 121, ../scss/grid.scss */
+  .col-11 {
+    width: 91.66667%; }
+
+  /* line 121, ../scss/grid.scss */
+  .col-12 {
+    width: 100%; }
+
+  /* line 128, ../scss/grid.scss */
+  .col-offset-0 {
+    margin-left: 0%; }
+
+  /* line 128, ../scss/grid.scss */
+  .col-offset-1 {
+    margin-left: 8.33333%; }
+
+  /* line 128, ../scss/grid.scss */
+  .col-offset-2 {
+    margin-left: 16.66667%; }
+
+  /* line 128, ../scss/grid.scss */
+  .col-offset-3 {
+    margin-left: 25%; }
+
+  /* line 128, ../scss/grid.scss */
+  .col-offset-4 {
+    margin-left: 33.33333%; }
+
+  /* line 128, ../scss/grid.scss */
+  .col-offset-5 {
+    margin-left: 41.66667%; }
+
+  /* line 128, ../scss/grid.scss */
+  .col-offset-6 {
+    margin-left: 50%; }
+
+  /* line 128, ../scss/grid.scss */
+  .col-offset-7 {
+    margin-left: 58.33333%; }
+
+  /* line 128, ../scss/grid.scss */
+  .col-offset-8 {
+    margin-left: 66.66667%; }
+
+  /* line 128, ../scss/grid.scss */
+  .col-offset-9 {
+    margin-left: 75%; }
+
+  /* line 128, ../scss/grid.scss */
+  .col-offset-10 {
+    margin-left: 83.33333%; }
+
+  /* line 128, ../scss/grid.scss */
+  .col-offset-11 {
+    margin-left: 91.66667%; }
+
+  /* line 128, ../scss/grid.scss */
+  .col-offset-12 {
+    margin-left: 100%; }
+
+  /* line 135, ../scss/grid.scss */
+  .col-pull-0 {
+    right: 0%; }
+
+  /* line 135, ../scss/grid.scss */
+  .col-pull-1 {
+    right: 8.33333%; }
+
+  /* line 135, ../scss/grid.scss */
+  .col-pull-2 {
+    right: 16.66667%; }
+
+  /* line 135, ../scss/grid.scss */
+  .col-pull-3 {
+    right: 25%; }
+
+  /* line 135, ../scss/grid.scss */
+  .col-pull-4 {
+    right: 33.33333%; }
+
+  /* line 135, ../scss/grid.scss */
+  .col-pull-5 {
+    right: 41.66667%; }
+
+  /* line 135, ../scss/grid.scss */
+  .col-pull-6 {
+    right: 50%; }
+
+  /* line 135, ../scss/grid.scss */
+  .col-pull-7 {
+    right: 58.33333%; }
+
+  /* line 135, ../scss/grid.scss */
+  .col-pull-8 {
+    right: 66.66667%; }
+
+  /* line 135, ../scss/grid.scss */
+  .col-pull-9 {
+    right: 75%; }
+
+  /* line 135, ../scss/grid.scss */
+  .col-pull-10 {
+    right: 83.33333%; }
+
+  /* line 135, ../scss/grid.scss */
+  .col-pull-11 {
+    right: 91.66667%; }
+
+  /* line 135, ../scss/grid.scss */
+  .col-pull-12 {
+    right: 100%; }
+
+  /* line 142, ../scss/grid.scss */
+  .col-push-0 {
+    left: 0%; }
+
+  /* line 142, ../scss/grid.scss */
+  .col-push-1 {
+    left: 8.33333%; }
+
+  /* line 142, ../scss/grid.scss */
+  .col-push-2 {
+    left: 16.66667%; }
+
+  /* line 142, ../scss/grid.scss */
+  .col-push-3 {
+    left: 25%; }
+
+  /* line 142, ../scss/grid.scss */
+  .col-push-4 {
+    left: 33.33333%; }
+
+  /* line 142, ../scss/grid.scss */
+  .col-push-5 {
+    left: 41.66667%; }
+
+  /* line 142, ../scss/grid.scss */
+  .col-push-6 {
+    left: 50%; }
+
+  /* line 142, ../scss/grid.scss */
+  .col-push-7 {
+    left: 58.33333%; }
+
+  /* line 142, ../scss/grid.scss */
+  .col-push-8 {
+    left: 66.66667%; }
+
+  /* line 142, ../scss/grid.scss */
+  .col-push-9 {
+    left: 75%; }
+
+  /* line 142, ../scss/grid.scss */
+  .col-push-10 {
+    left: 83.33333%; }
+
+  /* line 142, ../scss/grid.scss */
+  .col-push-11 {
+    left: 91.66667%; }
+
+  /* line 142, ../scss/grid.scss */
+  .col-push-12 {
+    left: 100%; } }
+/*
+ * Widescreen and up
+ */
+@media (min-width: 1200px) {
+  /* line 154, ../scss/grid.scss */
+  .container {
+    max-width: 1160px; }
+
+  /* line 160, ../scss/grid.scss */
+  .col-wd-1 {
+    width: 8.33333%; }
+
+  /* line 160, ../scss/grid.scss */
+  .col-wd-2 {
+    width: 16.66667%; }
+
+  /* line 160, ../scss/grid.scss */
+  .col-wd-3 {
+    width: 25%; }
+
+  /* line 160, ../scss/grid.scss */
+  .col-wd-4 {
+    width: 33.33333%; }
+
+  /* line 160, ../scss/grid.scss */
+  .col-wd-5 {
+    width: 41.66667%; }
+
+  /* line 160, ../scss/grid.scss */
+  .col-wd-6 {
+    width: 50%; }
+
+  /* line 160, ../scss/grid.scss */
+  .col-wd-7 {
+    width: 58.33333%; }
+
+  /* line 160, ../scss/grid.scss */
+  .col-wd-8 {
+    width: 66.66667%; }
+
+  /* line 160, ../scss/grid.scss */
+  .col-wd-9 {
+    width: 75%; }
+
+  /* line 160, ../scss/grid.scss */
+  .col-wd-10 {
+    width: 83.33333%; }
+
+  /* line 160, ../scss/grid.scss */
+  .col-wd-11 {
+    width: 91.66667%; }
+
+  /* line 160, ../scss/grid.scss */
+  .col-wd-12 {
+    width: 100%; }
+
+  /* line 167, ../scss/grid.scss */
+  .col-wd-offset-0 {
+    margin-left: 0%; }
+
+  /* line 167, ../scss/grid.scss */
+  .col-wd-offset-1 {
+    margin-left: 8.33333%; }
+
+  /* line 167, ../scss/grid.scss */
+  .col-wd-offset-2 {
+    margin-left: 16.66667%; }
+
+  /* line 167, ../scss/grid.scss */
+  .col-wd-offset-3 {
+    margin-left: 25%; }
+
+  /* line 167, ../scss/grid.scss */
+  .col-wd-offset-4 {
+    margin-left: 33.33333%; }
+
+  /* line 167, ../scss/grid.scss */
+  .col-wd-offset-5 {
+    margin-left: 41.66667%; }
+
+  /* line 167, ../scss/grid.scss */
+  .col-wd-offset-6 {
+    margin-left: 50%; }
+
+  /* line 167, ../scss/grid.scss */
+  .col-wd-offset-7 {
+    margin-left: 58.33333%; }
+
+  /* line 167, ../scss/grid.scss */
+  .col-wd-offset-8 {
+    margin-left: 66.66667%; }
+
+  /* line 167, ../scss/grid.scss */
+  .col-wd-offset-9 {
+    margin-left: 75%; }
+
+  /* line 167, ../scss/grid.scss */
+  .col-wd-offset-10 {
+    margin-left: 83.33333%; }
+
+  /* line 167, ../scss/grid.scss */
+  .col-wd-offset-11 {
+    margin-left: 91.66667%; }
+
+  /* line 167, ../scss/grid.scss */
+  .col-wd-offset-12 {
+    margin-left: 100%; }
+
+  /* line 174, ../scss/grid.scss */
+  .col-wd-pull-0 {
+    right: 0%; }
+
+  /* line 174, ../scss/grid.scss */
+  .col-wd-pull-1 {
+    right: 8.33333%; }
+
+  /* line 174, ../scss/grid.scss */
+  .col-wd-pull-2 {
+    right: 16.66667%; }
+
+  /* line 174, ../scss/grid.scss */
+  .col-wd-pull-3 {
+    right: 25%; }
+
+  /* line 174, ../scss/grid.scss */
+  .col-wd-pull-4 {
+    right: 33.33333%; }
+
+  /* line 174, ../scss/grid.scss */
+  .col-wd-pull-5 {
+    right: 41.66667%; }
+
+  /* line 174, ../scss/grid.scss */
+  .col-wd-pull-6 {
+    right: 50%; }
+
+  /* line 174, ../scss/grid.scss */
+  .col-wd-pull-7 {
+    right: 58.33333%; }
+
+  /* line 174, ../scss/grid.scss */
+  .col-wd-pull-8 {
+    right: 66.66667%; }
+
+  /* line 174, ../scss/grid.scss */
+  .col-wd-pull-9 {
+    right: 75%; }
+
+  /* line 174, ../scss/grid.scss */
+  .col-wd-pull-10 {
+    right: 83.33333%; }
+
+  /* line 174, ../scss/grid.scss */
+  .col-wd-pull-11 {
+    right: 91.66667%; }
+
+  /* line 174, ../scss/grid.scss */
+  .col-wd-pull-12 {
+    right: 100%; }
+
+  /* line 181, ../scss/grid.scss */
+  .col-wd-push-0 {
+    left: 0%; }
+
+  /* line 181, ../scss/grid.scss */
+  .col-wd-push-1 {
+    left: 8.33333%; }
+
+  /* line 181, ../scss/grid.scss */
+  .col-wd-push-2 {
+    left: 16.66667%; }
+
+  /* line 181, ../scss/grid.scss */
+  .col-wd-push-3 {
+    left: 25%; }
+
+  /* line 181, ../scss/grid.scss */
+  .col-wd-push-4 {
+    left: 33.33333%; }
+
+  /* line 181, ../scss/grid.scss */
+  .col-wd-push-5 {
+    left: 41.66667%; }
+
+  /* line 181, ../scss/grid.scss */
+  .col-wd-push-6 {
+    left: 50%; }
+
+  /* line 181, ../scss/grid.scss */
+  .col-wd-push-7 {
+    left: 58.33333%; }
+
+  /* line 181, ../scss/grid.scss */
+  .col-wd-push-8 {
+    left: 66.66667%; }
+
+  /* line 181, ../scss/grid.scss */
+  .col-wd-push-9 {
+    left: 75%; }
+
+  /* line 181, ../scss/grid.scss */
+  .col-wd-push-10 {
+    left: 83.33333%; }
+
+  /* line 181, ../scss/grid.scss */
+  .col-wd-push-11 {
+    left: 91.66667%; }
+
+  /* line 181, ../scss/grid.scss */
+  .col-wd-push-12 {
+    left: 100%; } }
+/*
+ * Responsive kit
+ */
+@media (max-width: 767px) {
+  /* line 194, ../scss/grid.scss */
+  .kit-hidden-mb {
+    display: none; } }
+@media (max-width: 991px) {
+  /* line 201, ../scss/grid.scss */
+  .kit-hidden-tb {
+    display: none; } }
+@media (max-width: 1199px) {
+  /* line 208, ../scss/grid.scss */
+  .kit-hidden {
+    display: none; } }
+/*
+ * Clearfix
+ */
+/* line 217, ../scss/grid.scss */
+.clearfix, .row {
+  zoom: 1; }
+  /* line 219, ../scss/grid.scss */
+  .clearfix:before, .row:before, .clearfix:after, .row:after {
+    content: " ";
+    display: table; }
+  /* line 223, ../scss/grid.scss */
+  .clearfix:after, .row:after {
+    clear: both; }

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/css/normalize.css

@@ -0,0 +1,406 @@
+/*! normalize.css v2.1.3 | MIT License | git.io/normalize */
+
+/* ==========================================================================
+   HTML5 display definitions
+   ========================================================================== */
+
+/**
+ * Correct `block` display not defined in IE 8/9.
+ */
+
+article,
+aside,
+details,
+figcaption,
+figure,
+footer,
+header,
+hgroup,
+main,
+nav,
+section,
+summary {
+    display: block;
+}
+
+/**
+ * Correct `inline-block` display not defined in IE 8/9.
+ */
+
+audio,
+canvas,
+video {
+    display: inline-block;
+}
+
+/**
+ * Prevent modern browsers from displaying `audio` without controls.
+ * Remove excess height in iOS 5 devices.
+ */
+
+audio:not([controls]) {
+    display: none;
+    height: 0;
+}
+
+/**
+ * Address `[hidden]` styling not present in IE 8/9.
+ * Hide the `template` element in IE, Safari, and Firefox < 22.
+ */
+
+[hidden],
+template {
+    display: none;
+}
+
+/* ==========================================================================
+   Base
+   ========================================================================== */
+
+/**
+ * 1. Set default font family to sans-serif.
+ * 2. Prevent iOS text size adjust after orientation change, without disabling
+ *    user zoom.
+ */
+
+html {
+    font-family: sans-serif; /* 1 */
+    -ms-text-size-adjust: 100%; /* 2 */
+    -webkit-text-size-adjust: 100%; /* 2 */
+}
+
+/**
+ * Remove default margin.
+ */
+
+body {
+    margin: 0;
+}
+
+/* ==========================================================================
+   Links
+   ========================================================================== */
+
+/**
+ * Remove the gray background color from active links in IE 10.
+ */
+
+a {
+    background: transparent;
+}
+
+/**
+ * Address `outline` inconsistency between Chrome and other browsers.
+ */
+
+a:focus {
+    outline: thin dotted;
+}
+
+/**
+ * Improve readability when focused and also mouse hovered in all browsers.
+ */
+
+a:active,
+a:hover {
+    outline: 0;
+}
+
+/* ==========================================================================
+   Typography
+   ========================================================================== */
+
+/**
+ * Address variable `h1` font-size and margin within `section` and `article`
+ * contexts in Firefox 4+, Safari 5, and Chrome.
+ */
+
+h1 {
+    font-size: 2em;
+    margin: 0.67em 0;
+}
+
+/**
+ * Address styling not present in IE 8/9, Safari 5, and Chrome.
+ */
+
+abbr[title] {
+    border-bottom: 1px dotted;
+}
+
+/**
+ * Address style set to `bolder` in Firefox 4+, Safari 5, and Chrome.
+ */
+
+b,
+strong {
+    font-weight: bold;
+}
+
+/**
+ * Address styling not present in Safari 5 and Chrome.
+ */
+
+dfn {
+    font-style: italic;
+}
+
+/**
+ * Address differences between Firefox and other browsers.
+ */
+
+hr {
+    -moz-box-sizing: content-box;
+    box-sizing: content-box;
+    height: 0;
+}
+
+/**
+ * Address styling not present in IE 8/9.
+ */
+
+mark {
+    background: #ff0;
+    color: #000;
+}
+
+/**
+ * Correct font family set oddly in Safari 5 and Chrome.
+ */
+
+code,
+kbd,
+pre,
+samp {
+    font-family: monospace, serif;
+    font-size: 1em;
+}
+
+/**
+ * Improve readability of pre-formatted text in all browsers.
+ */
+
+pre {
+    white-space: pre-wrap;
+}
+
+/**
+ * Set consistent quote types.
+ */
+
+q {
+    quotes: "\201C" "\201D" "\2018" "\2019";
+}
+
+/**
+ * Address inconsistent and variable font size in all browsers.
+ */
+
+small {
+    font-size: 80%;
+}
+
+/**
+ * Prevent `sub` and `sup` affecting `line-height` in all browsers.
+ */
+
+sub,
+sup {
+    font-size: 75%;
+    line-height: 0;
+    position: relative;
+    vertical-align: baseline;
+}
+
+sup {
+    top: -0.5em;
+}
+
+sub {
+    bottom: -0.25em;
+}
+
+/* ==========================================================================
+   Embedded content
+   ========================================================================== */
+
+/**
+ * Remove border when inside `a` element in IE 8/9.
+ */
+
+img {
+    border: 0;
+}
+
+/**
+ * Correct overflow displayed oddly in IE 9.
+ */
+
+svg:not(:root) {
+    overflow: hidden;
+}
+
+/* ==========================================================================
+   Figures
+   ========================================================================== */
+
+/**
+ * Address margin not present in IE 8/9 and Safari 5.
+ */
+
+figure {
+    margin: 0;
+}
+
+/* ==========================================================================
+   Forms
+   ========================================================================== */
+
+/**
+ * Define consistent border, margin, and padding.
+ */
+
+fieldset {
+    border: 1px solid #c0c0c0;
+    margin: 0 2px;
+    padding: 0.35em 0.625em 0.75em;
+}
+
+/**
+ * 1. Correct `color` not being inherited in IE 8/9.
+ * 2. Remove padding so people aren't caught out if they zero out fieldsets.
+ */
+
+legend {
+    border: 0; /* 1 */
+    padding: 0; /* 2 */
+}
+
+/**
+ * 1. Correct font family not being inherited in all browsers.
+ * 2. Correct font size not being inherited in all browsers.
+ * 3. Address margins set differently in Firefox 4+, Safari 5, and Chrome.
+ */
+
+button,
+input,
+select,
+textarea {
+    font-family: inherit; /* 1 */
+    font-size: 100%; /* 2 */
+    margin: 0; /* 3 */
+}
+
+/**
+ * Address Firefox 4+ setting `line-height` on `input` using `!important` in
+ * the UA stylesheet.
+ */
+
+button,
+input {
+    line-height: normal;
+}
+
+/**
+ * Address inconsistent `text-transform` inheritance for `button` and `select`.
+ * All other form control elements do not inherit `text-transform` values.
+ * Correct `button` style inheritance in Chrome, Safari 5+, and IE 8+.
+ * Correct `select` style inheritance in Firefox 4+ and Opera.
+ */
+
+button,
+select {
+    text-transform: none;
+}
+
+/**
+ * 1. Avoid the WebKit bug in Android 4.0.* where (2) destroys native `audio`
+ *    and `video` controls.
+ * 2. Correct inability to style clickable `input` types in iOS.
+ * 3. Improve usability and consistency of cursor style between image-type
+ *    `input` and others.
+ */
+
+button,
+html input[type="button"], /* 1 */
+input[type="reset"],
+input[type="submit"] {
+    -webkit-appearance: button; /* 2 */
+    cursor: pointer; /* 3 */
+}
+
+/**
+ * Re-set default cursor for disabled elements.
+ */
+
+button[disabled],
+html input[disabled] {
+    cursor: default;
+}
+
+/**
+ * 1. Address box sizing set to `content-box` in IE 8/9/10.
+ * 2. Remove excess padding in IE 8/9/10.
+ */
+
+input[type="checkbox"],
+input[type="radio"] {
+    box-sizing: border-box; /* 1 */
+    padding: 0; /* 2 */
+}
+
+/**
+ * 1. Address `appearance` set to `searchfield` in Safari 5 and Chrome.
+ * 2. Address `box-sizing` set to `border-box` in Safari 5 and Chrome
+ *    (include `-moz` to future-proof).
+ */
+
+input[type="search"] {
+    -webkit-appearance: textfield; /* 1 */
+    -moz-box-sizing: content-box;
+    -webkit-box-sizing: content-box; /* 2 */
+    box-sizing: content-box;
+}
+
+/**
+ * Remove inner padding and search cancel button in Safari 5 and Chrome
+ * on OS X.
+ */
+
+input[type="search"]::-webkit-search-cancel-button,
+input[type="search"]::-webkit-search-decoration {
+    -webkit-appearance: none;
+}
+
+/**
+ * Remove inner padding and border in Firefox 4+.
+ */
+
+button::-moz-focus-inner,
+input::-moz-focus-inner {
+    border: 0;
+    padding: 0;
+}
+
+/**
+ * 1. Remove default vertical scrollbar in IE 8/9.
+ * 2. Improve readability and alignment in all browsers.
+ */
+
+textarea {
+    overflow: auto; /* 1 */
+    vertical-align: top; /* 2 */
+}
+
+/* ==========================================================================
+   Tables
+   ========================================================================== */
+
+/**
+ * Remove most spacing between table cells.
+ */
+
+table {
+    border-collapse: collapse;
+    border-spacing: 0;
+}

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/custom-fields-js.php

@@ -0,0 +1,44 @@
+<?php if(!defined('__TYPECHO_ADMIN__')) exit; ?>
+<script>
+$(document).ready(function () {
+    // 自定义字段
+    $('#custom-field-expand').click(function() {
+        var btn = $('i', this);
+        if (btn.hasClass('i-caret-right')) {
+            btn.removeClass('i-caret-right').addClass('i-caret-down');
+        } else {
+            btn.removeClass('i-caret-down').addClass('i-caret-right');
+        }
+        $(this).parent().toggleClass('fold');
+        return false;
+    });
+
+    function attachDeleteEvent (el) {
+        $('button.btn-xs', el).click(function () {
+            if (confirm('<?php _e('确认要删除此字段吗?'); ?>')) {
+                $(this).parents('tr').fadeOut(function () {
+                    $(this).remove();
+                });
+            }
+        });
+    }
+
+    $('#custom-field table tbody tr').each(function () {
+        attachDeleteEvent(this);
+    });
+
+    $('#custom-field button.operate-add').click(function () {
+        var html = '<tr><td><input type="text" name="fieldNames[]" placeholder="<?php _e('字段名称'); ?>" class="text-s w-100"></td>'
+                + '<td><select name="fieldTypes[]" id="">'
+                + '<option value="str"><?php _e('字符'); ?></option>'
+                + '<option value="int"><?php _e('整数'); ?></option>'
+                + '<option value="float"><?php _e('小数'); ?></option>'
+                + '</select></td>'
+                + '<td><textarea name="fieldValues[]" placeholder="<?php _e('字段值'); ?>" class="text-s w-100" rows="2"></textarea></td>'
+                + '<td><button type="button" class="btn btn-xs"><?php _e('删除'); ?></button></td></tr>',
+            el = $(html).hide().appendTo('#custom-field table tbody').fadeIn();
+
+        attachDeleteEvent(el);
+    });
+});
+</script>

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/custom-fields.php

@@ -0,0 +1,73 @@
+<?php if(!defined('__TYPECHO_ADMIN__')) exit; ?>
+<?php
+$fields = isset($post) ? $post->getFieldItems() : $page->getFieldItems();
+$defaultFields = isset($post) ? $post->getDefaultFieldItems() : $page->getDefaultFieldItems();
+?>
+                    <section id="custom-field" class="typecho-post-option<?php if (empty($defaultFields) && empty($fields)): ?> fold<?php endif; ?>">
+                        <label id="custom-field-expand" class="typecho-label"><a href="##"><i class="i-caret-right"></i> <?php _e('自定义字段'); ?></a></label>
+                        <table class="typecho-list-table mono">
+                            <colgroup>
+                                <col width="25%"/>
+                                <col width="10%"/>
+                                <col width="55%"/>
+                                <col width="10%"/>
+                            </colgroup>
+                            <?php foreach ($defaultFields as $field): ?>
+                            <?php list ($label, $input) = $field; ?>
+                            <tr>
+                                <td><?php $label->render(); ?></td>
+                                <td colspan="3"><?php $input->render(); ?></td>
+                            </tr>
+                            <?php endforeach; ?>
+                            <?php foreach ($fields as $field): ?>
+                            <tr>
+                                <td>
+                                    <label for="fieldname" class="sr-only"><?php _e('字段名称'); ?></label>
+                                    <input type="text" name="fieldNames[]" value="<?php echo htmlspecialchars($field['name']); ?>" id="fieldname" class="text-s w-100">
+                                </td>
+                                <td>
+                                    <label for="fieldtype" class="sr-only"><?php _e('字段类型'); ?></label>
+                                    <select name="fieldTypes[]" id="fieldtype">
+                                        <option value="str"<?php if ('str' == $field['type']): ?> selected<?php endif; ?>><?php _e('字符'); ?></option>
+                                        <option value="int"<?php if ('int' == $field['type']): ?> selected<?php endif; ?>><?php _e('整数'); ?></option>
+                                        <option value="float"<?php if ('float' == $field['type']): ?> selected<?php endif; ?>><?php _e('小数'); ?></option>
+                                    </select>
+                                </td>
+                                <td>
+                                    <label for="fieldvalue" class="sr-only"><?php _e('字段值'); ?></label>
+                                    <textarea name="fieldValues[]" id="fieldvalue" class="text-s w-100" rows="2"><?php echo htmlspecialchars($field[$field['type'] . '_value']); ?></textarea>
+                                </td>
+                                <td>
+                                    <button type="button" class="btn btn-xs"><?php _e('删除'); ?></button>
+                                </td>
+                            </tr>
+                            <?php endforeach; ?>
+                            <?php if (empty($defaultFields) && empty($fields)): ?>
+                            <tr>
+                                <td>
+                                    <label for="fieldname" class="sr-only"><?php _e('字段名称'); ?></label>
+                                    <input type="text" name="fieldNames[]" placeholder="<?php _e('字段名称'); ?>" id="fieldname" class="text-s w-100">
+                                </td>
+                                <td>
+                                    <label for="fieldtype" class="sr-only"><?php _e('字段类型'); ?></label>
+                                    <select name="fieldTypes[]" id="fieldtype">
+                                        <option value="str"><?php _e('字符'); ?></option>
+                                        <option value="int"><?php _e('整数'); ?></option>
+                                        <option value="float"><?php _e('小数'); ?></option>
+                                    </select>
+                                </td>
+                                <td>
+                                    <label for="fieldvalue" class="sr-only"><?php _e('字段值'); ?></label>
+                                    <textarea name="fieldValues[]" placeholder="<?php _e('字段值'); ?>" id="fieldvalue" class="text-s w-100" rows="2"></textarea>
+                                </td>
+                                <td>
+                                    <button type="button" class="btn btn-xs"><?php _e('删除'); ?></button>
+                                </td>
+                            </tr>
+                            <?php endif; ?>
+                        </table>
+                        <div class="description clearfix">
+                            <button type="button" class="btn btn-xs operate-add"><?php _e('+添加字段'); ?></button>
+                            <?php _e('自定义字段可以扩展你的模板功能, 使用方法参见 <a href="http://docs.typecho.org/help/custom-fields">帮助文档</a>'); ?>
+                        </div>
+                    </section>

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/editor-js.php

@@ -0,0 +1,330 @@
+<?php if(!defined('__TYPECHO_ADMIN__')) exit; ?>
+<?php $content = !empty($post) ? $post : $page; if ($options->markdown): ?>
+<script src="<?php $options->adminStaticUrl('js', 'pagedown.js?v=' . $suffixVersion); ?>"></script>
+<script src="<?php $options->adminStaticUrl('js', 'stmd.js?v=' . $suffixVersion); ?>"></script>
+<script src="<?php $options->adminStaticUrl('js', 'diff.js?v=' . $suffixVersion); ?>"></script>
+<script>
+$(document).ready(function () {
+    var textarea = $('#text'),
+        toolbar = $('<div class="editor" id="wmd-button-bar" />').insertBefore(textarea.parent()),
+        preview = $('<div id="wmd-preview" class="wmd-hidetab" />').insertAfter('.editor');
+
+    var options = {}, isMarkdown = <?php echo intval($content->isMarkdown || !$content->have()); ?>;
+
+    options.strings = {
+        bold: '<?php _e('加粗'); ?> <strong> Ctrl+B',
+        boldexample: '<?php _e('加粗文字'); ?>',
+            
+        italic: '<?php _e('斜体'); ?> <em> Ctrl+I',
+        italicexample: '<?php _e('斜体文字'); ?>',
+
+        link: '<?php _e('链接'); ?> <a> Ctrl+L',
+        linkdescription: '<?php _e('请输入链接描述'); ?>',
+
+        quote:  '<?php _e('引用'); ?> <blockquote> Ctrl+Q',
+        quoteexample: '<?php _e('引用文字'); ?>',
+
+        code: '<?php _e('代码'); ?> <pre><code> Ctrl+K',
+        codeexample: '<?php _e('请输入代码'); ?>',
+
+        image: '<?php _e('图片'); ?> <img> Ctrl+G',
+        imagedescription: '<?php _e('请输入图片描述'); ?>',
+
+        olist: '<?php _e('数字列表'); ?> <ol> Ctrl+O',
+        ulist: '<?php _e('普通列表'); ?> <ul> Ctrl+U',
+        litem: '<?php _e('列表项目'); ?>',
+
+        heading: '<?php _e('标题'); ?> <h1>/<h2> Ctrl+H',
+        headingexample: '<?php _e('标题文字'); ?>',
+
+        hr: '<?php _e('分割线'); ?> <hr> Ctrl+R',
+        more: '<?php _e('摘要分割线'); ?> <!--more--> Ctrl+M',
+
+        undo: '<?php _e('撤销'); ?> - Ctrl+Z',
+        redo: '<?php _e('重做'); ?> - Ctrl+Y',
+        redomac: '<?php _e('重做'); ?> - Ctrl+Shift+Z',
+
+        fullscreen: '<?php _e('全屏'); ?> - Ctrl+J',
+        exitFullscreen: '<?php _e('退出全屏'); ?> - Ctrl+E',
+        fullscreenUnsupport: '<?php _e('此浏览器不支持全屏操作'); ?>',
+
+        imagedialog: '<p><b><?php _e('插入图片'); ?></b></p><p><?php _e('请在下方的输入框内输入要插入的远程图片地址'); ?></p><p><?php _e('您也可以使用附件功能插入上传的本地图片'); ?></p>',
+        linkdialog: '<p><b><?php _e('插入链接'); ?></b></p><p><?php _e('请在下方的输入框内输入要插入的链接地址'); ?></p>',
+
+        ok: '<?php _e('确定'); ?>',
+        cancel: '<?php _e('取消'); ?>',
+
+        help: '<?php _e('Markdown语法帮助'); ?>'
+    };
+
+    var converter = new Typecho.Markdown,
+        editor = new Markdown.Editor(converter, '', options),
+        diffMatch = new diff_match_patch(), last = '', preview = $('#wmd-preview'),
+        mark = '@mark' + Math.ceil(Math.random() * 100000000) + '@',
+        span = '<span class="diff" />',
+        cache = {};
+    
+
+    // 自动跟随
+    converter.hooks.chain('postConversion', function (html) {
+        // clear special html tags
+        html = html.replace(/<\/?(\!doctype|html|head|body|link|title|input|select|button|textarea|style|noscript)[^>]*>/ig, function (all) {
+            return all.replace(/&/g, '&amp;')
+                .replace(/</g, '&lt;')
+                .replace(/>/g, '&gt;')
+                .replace(/'/g, '&#039;')
+                .replace(/"/g, '&quot;');
+        });
+
+        // clear hard breaks
+        html = html.replace(/\s*((?:<br>\n)+)\s*(<\/?(?:p|div|h[1-6]|blockquote|pre|table|dl|ol|ul|address|form|fieldset|iframe|hr|legend|article|section|nav|aside|hgroup|header|footer|figcaption|li|dd|dt)[^\w])/gm, '$2');
+
+        if (html.indexOf('<!--more-->') > 0) {
+            var parts = html.split(/\s*<\!\-\-more\-\->\s*/),
+                summary = parts.shift(),
+                details = parts.join('');
+
+            html = '<div class="summary">' + summary + '</div>'
+                + '<div class="details">' + details + '</div>';
+        }
+
+
+        var diffs = diffMatch.diff_main(last, html);
+        last = html;
+
+        if (diffs.length > 0) {
+            var stack = [], markStr = mark;
+            
+            for (var i = 0; i < diffs.length; i ++) {
+                var diff = diffs[i], op = diff[0], str = diff[1]
+                    sp = str.lastIndexOf('<'), ep = str.lastIndexOf('>');
+
+                if (op != 0) {
+                    if (sp >=0 && sp > ep) {
+                        if (op > 0) {
+                            stack.push(str.substring(0, sp) + markStr + str.substring(sp));
+                        } else {
+                            var lastStr = stack[stack.length - 1], lastSp = lastStr.lastIndexOf('<');
+                            stack[stack.length - 1] = lastStr.substring(0, lastSp) + markStr + lastStr.substring(lastSp);
+                        }
+                    } else {
+                        if (op > 0) {
+                            stack.push(str + markStr);
+                        } else {
+                            stack.push(markStr);
+                        }
+                    }
+                    
+                    markStr = '';
+                } else {
+                    stack.push(str);
+                }
+            }
+
+            html = stack.join('');
+
+            if (!markStr) {
+                var pos = html.indexOf(mark), prev = html.substring(0, pos),
+                    next = html.substr(pos + mark.length),
+                    sp = prev.lastIndexOf('<'), ep = prev.lastIndexOf('>');
+
+                if (sp >= 0 && sp > ep) {
+                    html = prev.substring(0, sp) + span + prev.substring(sp) + next;
+                } else {
+                    html = prev + span + next;
+                }
+            }
+        }
+
+        // 替换img
+        html = html.replace(/<(img)\s+([^>]*)\s*src="([^"]+)"([^>]*)>/ig, function (all, tag, prefix, src, suffix) {
+            if (!cache[src]) {
+                cache[src] = false;
+            } else {
+                return '<span class="cache" data-width="' + cache[src][0] + '" data-height="' + cache[src][1] + '" '
+                    + 'style="background:url(' + src + ') no-repeat left top; width:'
+                    + cache[src][0] + 'px; height:' + cache[src][1] + 'px; display: inline-block; max-width: 100%;'
+                    + '-webkit-background-size: contain;-moz-background-size: contain;-o-background-size: contain;background-size: contain;" />';
+            }
+
+            return all;
+        });
+
+        // 替换block
+        html = html.replace(/<(iframe|embed)\s+([^>]*)>/ig, function (all, tag, src) {
+            if (src[src.length - 1] == '/') {
+                src = src.substring(0, src.length - 1);
+            }
+
+            return '<div style="background: #ddd; height: 40px; overflow: hidden; line-height: 40px; text-align: center; font-size: 12px; color: #777">'
+                + tag + ' : ' + $.trim(src) + '</div>';
+        });
+
+        return html;
+    });
+
+    function cacheResize() {
+        var t = $(this), w = parseInt(t.data('width')), h = parseInt(t.data('height')),
+            ow = t.width();
+
+        t.height(h * ow / w);
+    }
+
+    var to;
+    editor.hooks.chain('onPreviewRefresh', function () {
+        var diff = $('.diff', preview), scrolled = false;
+
+        if (to) {
+            clearTimeout(to);
+        }
+
+        $('img', preview).load(function () {
+            var t = $(this), src = t.attr('src');
+
+            if (scrolled) {
+                preview.scrollTo(diff, {
+                    offset  :   - 50
+                });
+            }
+
+            if (!!src && !cache[src]) {
+                cache[src] = [this.width, this.height];
+            }
+        });
+
+        $('.cache', preview).resize(cacheResize).each(cacheResize);
+        
+        var changed = $('.diff', preview).parent();
+        if (!changed.is(preview)) {
+            changed.css('background-color', 'rgba(255,230,0,0.5)');
+            to = setTimeout(function () {
+                changed.css('background-color', 'transparent');
+            }, 4500);
+        }
+
+        if (diff.length > 0) {
+            var p = diff.position(), lh = diff.parent().css('line-height');
+            lh = !!lh ? parseInt(lh) : 0;
+
+            if (p.top < 0 || p.top > preview.height() - lh) {
+                preview.scrollTo(diff, {
+                    offset  :   - 50
+                });
+                scrolled = true;
+            }
+        }
+    });
+
+    <?php Typecho_Plugin::factory('admin/editor-js.php')->markdownEditor($content); ?>
+
+    var input = $('#text'), th = textarea.height(), ph = preview.height(),
+        uploadBtn = $('<button type="button" id="btn-fullscreen-upload" class="btn btn-link">'
+            + '<i class="i-upload"><?php _e('附件'); ?></i></button>')
+            .prependTo('.submit .right')
+            .click(function() {
+                $('a', $('.typecho-option-tabs li').not('.active')).trigger('click');
+                return false;
+            });
+
+    $('.typecho-option-tabs li').click(function () {
+        uploadBtn.find('i').toggleClass('i-upload-active',
+            $('#tab-files-btn', this).length > 0);
+    });
+
+    editor.hooks.chain('enterFakeFullScreen', function () {
+        th = textarea.height();
+        ph = preview.height();
+        $(document.body).addClass('fullscreen');
+        var h = $(window).height() - toolbar.outerHeight();
+        
+        textarea.css('height', h);
+        preview.css('height', h);
+    });
+
+    editor.hooks.chain('enterFullScreen', function () {
+        $(document.body).addClass('fullscreen');
+        
+        var h = window.screen.height - toolbar.outerHeight();
+        textarea.css('height', h);
+        preview.css('height', h);
+    });
+
+    editor.hooks.chain('exitFullScreen', function () {
+        $(document.body).removeClass('fullscreen');
+        textarea.height(th);
+        preview.height(ph);
+    });
+
+    function initMarkdown() {
+        editor.run();
+
+        var imageButton = $('#wmd-image-button'),
+            linkButton = $('#wmd-link-button');
+
+        Typecho.insertFileToEditor = function (file, url, isImage) {
+            var button = isImage ? imageButton : linkButton;
+
+            options.strings[isImage ? 'imagename' : 'linkname'] = file;
+            button.trigger('click');
+
+            var checkDialog = setInterval(function () {
+                if ($('.wmd-prompt-dialog').length > 0) {
+                    $('.wmd-prompt-dialog input').val(url).select();
+                    clearInterval(checkDialog);
+                    checkDialog = null;
+                }
+            }, 10);
+        };
+
+        Typecho.uploadComplete = function (file) {
+            Typecho.insertFileToEditor(file.title, file.url, file.isImage);
+        };
+
+        // 编辑预览切换
+        var edittab = $('.editor').prepend('<div class="wmd-edittab"><a href="#wmd-editarea" class="active"><?php _e('撰写'); ?></a><a href="#wmd-preview"><?php _e('预览'); ?></a></div>'),
+            editarea = $(textarea.parent()).attr("id", "wmd-editarea");
+
+        $(".wmd-edittab a").click(function() {
+            $(".wmd-edittab a").removeClass('active');
+            $(this).addClass("active");
+            $("#wmd-editarea, #wmd-preview").addClass("wmd-hidetab");
+        
+            var selected_tab = $(this).attr("href"),
+                selected_el = $(selected_tab).removeClass("wmd-hidetab");
+
+            // 预览时隐藏编辑器按钮
+            if (selected_tab == "#wmd-preview") {
+                $("#wmd-button-row").addClass("wmd-visualhide");
+            } else {
+                $("#wmd-button-row").removeClass("wmd-visualhide");
+            }
+
+            // 预览和编辑窗口高度一致
+            $("#wmd-preview").outerHeight($("#wmd-editarea").innerHeight());
+
+            return false;
+        });
+    }
+
+    if (isMarkdown) {
+        initMarkdown();
+    } else {
+        var notice = $('<div class="message notice"><?php _e('这篇文章不是由Markdown语法创建的, 继续使用Markdown编辑它吗?'); ?> '
+            + '<button class="btn btn-xs primary yes"><?php _e('是'); ?></button> ' 
+            + '<button class="btn btn-xs no"><?php _e('否'); ?></button></div>')
+            .hide().insertBefore(textarea).slideDown();
+
+        $('.yes', notice).click(function () {
+            notice.remove();
+            $('<input type="hidden" name="markdown" value="1" />').appendTo('.submit');
+            initMarkdown();
+        });
+
+        $('.no', notice).click(function () {
+            notice.remove();
+        });
+    }
+});
+</script>
+<?php endif; ?>
+

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/extending.php

@@ -0,0 +1,13 @@
+<?php
+include 'common.php';
+
+$panel = $request->get('panel');
+$panelTable = unserialize($options->panelTable);
+
+if (!isset($panelTable['file']) || !in_array(urlencode($panel), $panelTable['file'])) {
+    throw new Typecho_Plugin_Exception(_t('页面不存在'), 404);
+}
+
+list ($pluginName, $file) = explode('/', trim($panel, '/'), 2);
+
+require_once $options->pluginDir($pluginName) . '/' . $panel;

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/file-upload-js.php

@@ -0,0 +1,208 @@
+<?php if(!defined('__TYPECHO_ADMIN__')) exit; ?>
+<?php
+if (isset($post) && $post instanceof Typecho_Widget && $post->have()) {
+    $fileParentContent = $post;
+} else if (isset($page) && $page instanceof Typecho_Widget && $page->have()) {
+    $fileParentContent = $page;
+}
+
+$phpMaxFilesize = function_exists('ini_get') ? trim(ini_get('upload_max_filesize')) : 0;
+
+if (preg_match("/^([0-9]+)([a-z]{1,2})$/i", $phpMaxFilesize, $matches)) {
+    $phpMaxFilesize = strtolower($matches[1] . $matches[2] . (1 == strlen($matches[2]) ? 'b' : ''));
+}
+?>
+
+<script src="<?php $options->adminStaticUrl('js', 'moxie.js?v=' . $suffixVersion); ?>"></script>
+<script src="<?php $options->adminStaticUrl('js', 'plupload.js?v=' . $suffixVersion); ?>"></script>
+<script>
+$(document).ready(function() {
+    function updateAttacmentNumber () {
+        var btn = $('#tab-files-btn'),
+            balloon = $('.balloon', btn),
+            count = $('#file-list li .insert').length;
+
+        if (count > 0) {
+            if (!balloon.length) {
+                btn.html($.trim(btn.html()) + ' ');
+                balloon = $('<span class="balloon"></span>').appendTo(btn);
+            }
+
+            balloon.html(count);
+        } else if (0 == count && balloon.length > 0) {
+            balloon.remove();
+        }
+    }
+
+    $('.upload-area').bind({
+        dragenter   :   function () {
+            $(this).parent().addClass('drag');
+        },
+
+        dragover    :   function (e) {
+            $(this).parent().addClass('drag');
+        },
+
+        drop        :   function () {
+            $(this).parent().removeClass('drag');
+        },
+        
+        dragend     :   function () {
+            $(this).parent().removeClass('drag');
+        },
+
+        dragleave   :   function () {
+            $(this).parent().removeClass('drag');
+        }
+    });
+
+    updateAttacmentNumber();
+
+    function fileUploadStart (file) {
+        $('<li id="' + file.id + '" class="loading">'
+            + file.name + '</li>').appendTo('#file-list');
+    }
+
+    function fileUploadError (error) {
+        var file = error.file, code = error.code, word; 
+        
+        switch (code) {
+            case plupload.FILE_SIZE_ERROR:
+                word = '<?php _e('文件大小超过限制'); ?>';
+                break;
+            case plupload.FILE_EXTENSION_ERROR:
+                word = '<?php _e('文件扩展名不被支持'); ?>';
+                break;
+            case plupload.FILE_DUPLICATE_ERROR:
+                word = '<?php _e('文件已经上传过'); ?>';
+                break;
+            case plupload.HTTP_ERROR:
+            default:
+                word = '<?php _e('上传出现错误'); ?>';
+                break;
+        }
+
+        var fileError = '<?php _e('%s 上传失败'); ?>'.replace('%s', file.name),
+            li, exist = $('#' + file.id);
+
+        if (exist.length > 0) {
+            li = exist.removeClass('loading').html(fileError);
+        } else {
+            li = $('<li>' + fileError + '<br />' + word + '</li>').appendTo('#file-list');
+        }
+
+        li.effect('highlight', {color : '#FBC2C4'}, 2000, function () {
+            $(this).remove();
+        });
+    }
+
+    var completeFile = null;
+    function fileUploadComplete (id, url, data) {
+        var li = $('#' + id).removeClass('loading').data('cid', data.cid)
+            .data('url', data.url)
+            .data('image', data.isImage)
+            .html('<input type="hidden" name="attachment[]" value="' + data.cid + '" />'
+                + '<a class="insert" target="_blank" href="###" title="<?php _e('点击插入文件'); ?>">' + data.title + '</a><div class="info">' + data.bytes
+                + ' <a class="file" target="_blank" href="<?php $options->adminUrl('media.php'); ?>?cid=' 
+                + data.cid + '" title="<?php _e('编辑'); ?>"><i class="i-edit"></i></a>'
+                + ' <a class="delete" href="###" title="<?php _e('删除'); ?>"><i class="i-delete"></i></a></div>')
+            .effect('highlight', 1000);
+            
+        attachInsertEvent(li);
+        attachDeleteEvent(li);
+        updateAttacmentNumber();
+
+        if (!completeFile) {
+            completeFile = data;
+        }
+    }
+
+    $('#tab-files').bind('init', function () {
+        var uploader = new plupload.Uploader({
+            browse_button   :   $('.upload-file').get(0),
+            url             :   '<?php $security->index('/action/upload'
+                . (isset($fileParentContent) ? '?cid=' . $fileParentContent->cid : '')); ?>',
+            runtimes        :   'html5,flash,html4',
+            flash_swf_url   :   '<?php $options->adminStaticUrl('js', 'Moxie.swf'); ?>',
+            drop_element    :   $('.upload-area').get(0),
+            filters         :   {
+                max_file_size       :   '<?php echo $phpMaxFilesize ?>',
+                mime_types          :   [{'title' : '<?php _e('允许上传的文件'); ?>', 'extensions' : '<?php echo implode(',', $options->allowedAttachmentTypes); ?>'}],
+                prevent_duplicates  :   true
+            },
+
+            init            :   {
+                FilesAdded      :   function (up, files) {
+                    plupload.each(files, function(file) {
+                        fileUploadStart(file);
+                    });
+
+                    completeFile = null;
+                    uploader.start();
+                },
+
+                UploadComplete  :   function () {
+                    if (completeFile) {
+                        Typecho.uploadComplete(completeFile);
+                    }
+                },
+
+                FileUploaded    :   function (up, file, result) {
+                    if (200 == result.status) {
+                        var data = $.parseJSON(result.response);
+
+                        if (data) {
+                            fileUploadComplete(file.id, data[0], data[1]);
+                            return;
+                        }
+                    }
+
+                    fileUploadError({
+                        code : plupload.HTTP_ERROR,
+                        file : file
+                    });
+                },
+
+                Error           :   function (up, error) {
+                    fileUploadError(error);
+                }
+            }
+        });
+
+        uploader.init();
+    });
+
+    function attachInsertEvent (el) {
+        $('.insert', el).click(function () {
+            var t = $(this), p = t.parents('li');
+            Typecho.insertFileToEditor(t.text(), p.data('url'), p.data('image'));
+            return false;
+        });
+    }
+
+    function attachDeleteEvent (el) {
+        var file = $('a.insert', el).text();
+        $('.delete', el).click(function () {
+            if (confirm('<?php _e('确认要删除文件 %s 吗?'); ?>'.replace('%s', file))) {
+                var cid = $(this).parents('li').data('cid');
+                $.post('<?php $security->index('/action/contents-attachment-edit'); ?>',
+                    {'do' : 'delete', 'cid' : cid},
+                    function () {
+                        $(el).fadeOut(function () {
+                            $(this).remove();
+                            updateAttacmentNumber();
+                        });
+                    });
+            }
+
+            return false;
+        });
+    }
+
+    $('#file-list li').each(function () {
+        attachInsertEvent(this);
+        attachDeleteEvent(this);
+    });
+});
+</script>
+

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/file-upload.php

@@ -0,0 +1,30 @@
+<?php if(!defined('__TYPECHO_ADMIN__')) exit; ?>
+
+<?php
+if (isset($post) || isset($page)) {
+    $cid = isset($post) ? $post->cid : $page->cid;
+    
+    if ($cid) {
+        Typecho_Widget::widget('Widget_Contents_Attachment_Related', 'parentId=' . $cid)->to($attachment);
+    } else {
+        Typecho_Widget::widget('Widget_Contents_Attachment_Unattached')->to($attachment);
+    }
+}
+?>
+
+<div id="upload-panel" class="p">
+    <div class="upload-area" draggable="true"><?php _e('拖放文件到这里<br>或者 %s选择文件上传%s', '<a href="###" class="upload-file">', '</a>'); ?></div>
+    <ul id="file-list">
+    <?php while ($attachment->next()): ?>
+        <li data-cid="<?php $attachment->cid(); ?>" data-url="<?php echo $attachment->attachment->url; ?>" data-image="<?php echo $attachment->attachment->isImage ? 1 : 0; ?>"><input type="hidden" name="attachment[]" value="<?php $attachment->cid(); ?>" />
+            <a class="insert" title="<?php _e('点击插入文件'); ?>" href="###"><?php $attachment->title(); ?></a>
+            <div class="info">
+                <?php echo number_format(ceil($attachment->attachment->size / 1024)); ?> Kb
+                <a class="file" target="_blank" href="<?php $options->adminUrl('media.php?cid=' . $attachment->cid); ?>" title="<?php _e('编辑'); ?>"><i class="i-edit"></i></a>
+                <a href="###" class="delete" title="<?php _e('删除'); ?>"><i class="i-delete"></i></a>
+            </div>
+        </li>
+    <?php endwhile; ?>
+    </ul>
+</div>
+

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/footer.php

@@ -0,0 +1,6 @@
+<?php if(!defined('__TYPECHO_ADMIN__')) exit; ?>
+    </body>
+</html>
+<?php
+/** 注册一个结束插件 */
+Typecho_Plugin::factory('admin/footer.php')->end();

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/form-js.php

@@ -0,0 +1,26 @@
+<?php if(!defined('__TYPECHO_ADMIN__')) exit; ?>
+<script>
+(function () {
+    $(document).ready(function () {
+        var error = $('.typecho-option .error:first');
+
+        if (error.length > 0) {
+            $('html,body').scrollTop(error.parents('.typecho-option').offset().top);
+        }
+
+        $('form').submit(function () {
+            if (this.submitted) {
+                return false;
+            } else {
+                this.submitted = true;
+            }
+        });
+
+        $('label input[type=text]').click(function (e) {
+            var check = $('#' + $(this).parents('label').attr('for'));
+            check.prop('checked', true);
+            return false;
+        });
+    });
+})();
+</script>

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/header.php

@@ -0,0 +1,31 @@
+<?php
+if (!defined('__TYPECHO_ADMIN__')) {
+    exit;
+}
+
+$header = '<link rel="stylesheet" href="' . Typecho_Common::url('normalize.css?v=' . $suffixVersion, $options->adminStaticUrl('css')) . '">
+<link rel="stylesheet" href="' . Typecho_Common::url('grid.css?v=' . $suffixVersion, $options->adminStaticUrl('css')) . '">
+<link rel="stylesheet" href="' . Typecho_Common::url('style.css?v=' . $suffixVersion, $options->adminStaticUrl('css')) . '">
+<!--[if lt IE 9]>
+<script src="' . Typecho_Common::url('html5shiv.js?v=' . $suffixVersion, $options->adminStaticUrl('js')) . '"></script>
+<script src="' . Typecho_Common::url('respond.js?v=' . $suffixVersion, $options->adminStaticUrl('js')) . '"></script>
+<![endif]-->';
+
+/** 注册一个初始化插件 */
+$header = Typecho_Plugin::factory('admin/header.php')->header($header);
+
+?><!DOCTYPE HTML>
+<html class="no-js">
+    <head>
+        <meta charset="<?php $options->charset(); ?>">
+        <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1">
+        <meta name="renderer" content="webkit">
+        <meta name="viewport" content="width=device-width, initial-scale=1">
+        <title><?php _e('%s - %s - Powered by Typecho', $menu->title, $options->title); ?></title>
+        <meta name="robots" content="noindex, nofollow">
+        <?php echo $header; ?>
+    </head>
+    <body<?php if (isset($bodyClass)) {echo ' class="' . $bodyClass . '"';} ?>>
+    <!--[if lt IE 9]>
+        <div class="message error browsehappy" role="dialog"><?php _e('当前网页 <strong>不支持</strong> 你正在使用的浏览器. 为了正常的访问, 请 <a href="http://browsehappy.com/">升级你的浏览器</a>'); ?>.</div>
+    <![endif]-->

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/img/typecho-logo.svg

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg width="110px" height="26px" viewBox="0 0 110 26" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:sketch="http://www.bohemiancoding.com/sketch/ns">
+    <title>typecho-logo</title>
+    <description>Created with Sketch (http://www.bohemiancoding.com/sketch)</description>
+    <defs></defs>
+    <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd" sketch:type="MSPage">
+        <path d="M34.75,5.288 C34.288,6.542 33.76,7.73 32.22,7.862 L32,9.468 L33.562,9.468 L33.562,15.342 C33.562,16.882 33.54,18.994 36.972,18.994 C38.006,18.994 39.106,18.686 39.766,18.224 L39.106,16.53 C38.754,16.75 38.204,16.992 37.61,16.992 C36.708,16.992 36.18,16.596 36.18,15.254 L36.18,9.468 L38.886,9.468 L39.106,7.62 L36.18,7.62 L36.18,5.288 L34.75,5.288 Z M48.258,18.268 C48.258,20.27 47.444,21.502 45.42,21.502 C44.76,21.502 44.276,21.436 43.858,21.282 C43.462,21.128 43.352,20.908 43.352,20.49 L43.352,19.434 L41.262,19.61 L41.262,22.668 C42.186,23.13 44.012,23.394 45.398,23.394 C48.676,23.394 50.502,21.898 50.502,18.268 L50.502,7.62 L46.63,7.62 L46.63,9.424 L47.334,9.468 C47.752,9.468 47.884,9.644 47.884,10.128 L47.884,14.11 C47.884,15.254 47.07,16.288 45.53,16.288 C44.122,16.288 43.902,15.276 43.902,13.934 L43.902,7.62 L40.03,7.62 L40.03,9.424 L40.734,9.468 C41.108,9.49 41.284,9.622 41.284,10.084 L41.284,14.506 C41.284,17.102 42.494,18.312 44.694,18.312 C46.146,18.312 47.488,17.696 48.258,16.596 L48.258,18.268 Z M54,20.776 C54,21.326 53.78,21.458 53.362,21.502 L52.636,21.568 L52.636,23.24 L58.312,23.24 L58.312,21.502 L56.53,21.414 L56.53,18.378 C57.102,18.73 58.026,19.016 58.884,19.016 C61.788,19.016 63.702,16.926 63.702,12.878 C63.702,8.94 62.162,7.29 59.72,7.29 C57.85,7.29 56.64,8.302 56.244,9.05 L56.244,7.62 L52.526,7.62 L52.526,9.402 L53.45,9.468 C53.868,9.468 54,9.644 54,10.128 L54,20.776 Z M60.974,13.098 C60.974,15.012 60.336,16.926 58.466,16.926 C57.894,16.926 57.102,16.75 56.53,16.376 L56.53,11.316 C56.53,10.304 57.498,9.424 58.752,9.424 C59.918,9.424 60.974,10.172 60.974,13.098 Z M70.786,7.29 C67.178,7.29 65.352,10.15 65.352,13.406 C65.352,16.684 66.804,18.972 70.544,18.972 C72.612,18.972 74.064,18.048 74.416,17.74 L73.58,15.958 C73.052,16.332 72.106,16.926 70.808,16.926 C68.938,16.926 68.19,15.76 68.102,14.33 C70.698,14.308 74.372,13.736 74.372,10.348 C74.372,8.39 72.942,7.29 70.786,7.29 Z M71.952,10.392 C71.952,12.086 69.642,12.46 68.014,12.482 C68.08,10.854 68.872,9.16 70.632,9.16 C71.424,9.16 71.952,9.578 71.952,10.392 Z M81.192,16.97 C79.234,16.97 78.354,15.43 78.354,13.032 C78.354,10.59 79.256,9.27 81.016,9.27 C81.346,9.27 81.61,9.314 81.874,9.402 C82.27,9.534 82.336,9.732 82.336,10.15 L82.336,11.206 L84.36,11.052 L84.36,8.192 C83.304,7.62 82.248,7.29 80.928,7.29 C78.442,7.29 75.692,8.83 75.692,13.296 C75.692,16.948 77.606,18.994 80.84,18.994 C82.468,18.994 83.81,18.422 84.668,17.718 L83.722,16.024 C82.82,16.684 82.05,16.97 81.192,16.97 Z M87.286,16.222 C87.286,16.772 87.066,16.904 86.648,16.948 L85.922,17.014 L85.922,18.686 L91.158,18.686 L91.158,16.926 L89.904,16.86 L89.904,11.536 C89.904,10.392 90.718,9.314 92.258,9.314 C93.666,9.314 93.974,10.348 93.974,11.69 L93.974,16.222 C93.974,16.772 93.754,16.904 93.336,16.948 L92.61,17.014 L92.61,18.686 L97.846,18.686 L97.846,16.926 L96.592,16.86 L96.592,11.118 C96.592,8.522 95.294,7.29 93.094,7.29 C91.642,7.29 90.542,7.972 89.882,8.918 L89.882,3 L85.966,3 L85.966,4.826 L86.736,4.87 C87.154,4.892 87.286,5.024 87.286,5.508 L87.286,16.222 Z M98.924,13.142 C98.924,17.124 100.86,19.016 103.808,19.016 C106.712,19.016 109.066,17.08 109.066,12.856 C109.066,7.796 105.788,7.29 104.16,7.29 C101.894,7.29 98.924,8.566 98.924,13.142 Z M103.984,17.08 C101.872,17.08 101.586,14.88 101.586,12.834 C101.586,10.722 102.29,9.226 104.028,9.226 C105.788,9.226 106.382,10.744 106.382,13.208 C106.382,15.496 105.7,17.08 103.984,17.08 Z" id="typecho" fill="#000000" sketch:type="MSShapeGroup"></path>
+        <path d="M13,26 C3.36833333,26 0,22.631 0,13 C0,3.36866667 3.36833333,0 13,0 C22.6316667,0 26,3.36866667 26,13 C26,22.631 22.6316667,26 13,26 Z M6,9 L20,9 L20,7 L6,7 L6,9 Z M6,14 L16,14 L16,12 L6,12 L6,14 Z M6,19 L18,19 L18,17 L6,17 L6,19 Z" id="icon" fill="#000000" sketch:type="MSShapeGroup"></path>
+    </g>
+</svg>

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/index.php

@@ -0,0 +1,159 @@
+<?php
+include 'common.php';
+include 'header.php';
+include 'menu.php';
+
+$stat = Typecho_Widget::widget('Widget_Stat');
+?>
+<div class="main">
+    <div class="container typecho-dashboard">
+        <?php include 'page-title.php'; ?>
+        <div class="row typecho-page-main">
+            <div class="col-mb-12 welcome-board" role="main">
+                <p><?php _e('目前有 <em>%s</em> 篇文章, 并有 <em>%s</em> 条关于你的评论在 <em>%s</em> 个分类中.',
+                $stat->myPublishedPostsNum, $stat->myPublishedCommentsNum, $stat->categoriesNum); ?>
+                <br><?php _e('点击下面的链接快速开始:'); ?></p>
+
+                <ul id="start-link" class="clearfix">
+                    <?php if($user->pass('contributor', true)): ?>
+                    <li><a href="<?php $options->adminUrl('write-post.php'); ?>"><?php _e('撰写新文章'); ?></a></li>
+                    <?php if($user->pass('editor', true) && 'on' == $request->get('__typecho_all_comments') && $stat->waitingCommentsNum > 0): ?>
+                        <li><a href="<?php $options->adminUrl('manage-comments.php?status=waiting'); ?>"><?php _e('待审核的评论'); ?></a>
+                        <span class="balloon"><?php $stat->waitingCommentsNum(); ?></span>
+                        </li>
+                    <?php elseif($stat->myWaitingCommentsNum > 0): ?>
+                        <li><a href="<?php $options->adminUrl('manage-comments.php?status=waiting'); ?>"><?php _e('待审核评论'); ?></a>
+                        <span class="balloon"><?php $stat->myWaitingCommentsNum(); ?></span>
+                        </li>
+                    <?php endif; ?>
+                    <?php if($user->pass('editor', true) && 'on' == $request->get('__typecho_all_comments') && $stat->spamCommentsNum > 0): ?>
+                        <li><a href="<?php $options->adminUrl('manage-comments.php?status=spam'); ?>"><?php _e('垃圾评论'); ?></a>
+                        <span class="balloon"><?php $stat->spamCommentsNum(); ?></span>
+                        </li>
+                    <?php elseif($stat->mySpamCommentsNum > 0): ?>
+                        <li><a href="<?php $options->adminUrl('manage-comments.php?status=spam'); ?>"><?php _e('垃圾评论'); ?></a>
+                        <span class="balloon"><?php $stat->mySpamCommentsNum(); ?></span>
+                        </li>
+                    <?php endif; ?>
+                    <?php if($user->pass('administrator', true)): ?>
+                    <li><a href="<?php $options->adminUrl('themes.php'); ?>"><?php _e('更换外观'); ?></a></li>
+                    <li><a href="<?php $options->adminUrl('plugins.php'); ?>"><?php _e('插件管理'); ?></a></li>
+                    <li><a href="<?php $options->adminUrl('options-general.php'); ?>"><?php _e('系统设置'); ?></a></li>
+                    <?php endif; ?>
+                    <?php endif; ?>
+                    <!--<li><a href="<?php $options->adminUrl('profile.php'); ?>"><?php _e('更新我的资料'); ?></a></li>-->
+                </ul>
+                <?php $version = Typecho_Cookie::get('__typecho_check_version'); ?>
+                <?php if ($version && $version['available']): ?>
+                <div class="update-check">
+                    <p class="message notice">
+                        <?php _e('您当前使用的版本是'); ?> <?php echo $version['current']; ?> &rarr;
+                        <strong><a href="<?php echo $version['link']; ?>"><?php _e('官方最新版本是'); ?> <?php echo $version['latest']; ?></a></strong>
+                    </p>
+                </div>
+                <?php endif; ?>
+            </div>
+
+            <div class="col-mb-12 col-tb-4" role="complementary">
+                <section class="latest-link">
+                    <h3><?php _e('最近发布的文章'); ?></h3>
+                    <?php Typecho_Widget::widget('Widget_Contents_Post_Recent', 'pageSize=10')->to($posts); ?>
+                    <ul>
+                    <?php if($posts->have()): ?>
+                    <?php while($posts->next()): ?>
+                        <li>
+                            <span><?php $posts->date('n.j'); ?></span>
+                            <a href="<?php $posts->permalink(); ?>" class="title"><?php $posts->title(); ?></a>
+                        </li>
+                    <?php endwhile; ?>
+                    <?php else: ?>
+                        <li><em><?php _e('暂时没有文章'); ?></em></li>
+                    <?php endif; ?>
+                    </ul>
+                </section>
+            </div>
+
+            <div class="col-mb-12 col-tb-4" role="complementary">
+                <section class="latest-link">
+                    <h3><?php _e('最近得到的回复'); ?></h3>
+                    <ul>
+                        <?php Typecho_Widget::widget('Widget_Comments_Recent', 'pageSize=10')->to($comments); ?>
+                        <?php if($comments->have()): ?>
+                        <?php while($comments->next()): ?>
+                        <li>
+                            <span><?php $comments->date('n.j'); ?></span>
+                            <a href="<?php $comments->permalink(); ?>" class="title"><?php $comments->author(true); ?></a>:
+                            <?php $comments->excerpt(35, '...'); ?>
+                        </li>
+                        <?php endwhile; ?>
+                        <?php else: ?>
+                        <li><?php _e('暂时没有回复'); ?></li>
+                        <?php endif; ?>
+                    </ul>
+                </section>
+            </div>
+
+            <div class="col-mb-12 col-tb-4" role="complementary">
+                <section class="latest-link">
+                    <h3><?php _e('官方最新日志'); ?></h3>
+                    <div id="typecho-message">
+                        <ul>
+                            <li><?php _e('读取中...'); ?></li>
+                        </ul>
+                    </div>
+                </section>
+            </div>
+        </div>
+    </div>
+</div>
+
+<?php
+include 'copyright.php';
+include 'common-js.php';
+?>
+
+<script>
+$(document).ready(function () {
+    var ul = $('#typecho-message ul'), cache = window.sessionStorage,
+        html = cache ? cache.getItem('feed') : '',
+        update = cache ? cache.getItem('update') : '';
+
+    if (!!html) {
+        ul.html(html);
+    } else {
+        html = '';
+        $.get('<?php $options->index('/action/ajax?do=feed'); ?>', function (o) {
+            for (var i = 0; i < o.length; i ++) {
+                var item = o[i];
+                html += '<li><span>' + item.date + '</span> <a href="' + item.link + '" target="_blank">' + item.title
+                    + '</a></li>';
+            }
+
+            ul.html(html);
+            cache.setItem('feed', html);
+        }, 'json');
+    }
+
+    function applyUpdate(update) {
+        if (update.available) {
+            $('<div class="update-check"><p>'
+                + '<?php _e('您当前使用的版本是 %s'); ?>'.replace('%s', update.current) + '<br />'
+                + '<strong><a href="' + update.link + '" target="_blank">'
+                + '<?php _e('官方最新版本是 %s'); ?>'.replace('%s', update.latest) + '</a></strong></p></div>')
+            .appendTo('.welcome-board').effect('highlight');
+        }
+    }
+
+    if (!!update) {
+        applyUpdate($.parseJSON(update));
+    } else {
+        update = '';
+        $.get('<?php $options->index('/action/ajax?do=checkVersion'); ?>', function (o, status, resp) {
+            applyUpdate(o);
+            cache.setItem('update', resp.responseText);
+        }, 'json');
+    }
+});
+
+</script>
+<?php include 'footer.php'; ?>

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/js/html5shiv.js

@@ -0,0 +1,301 @@
+/**
+* @preserve HTML5 Shiv v3.7.0 | @afarkas @jdalton @jon_neal @rem | MIT/GPL2 Licensed
+*/
+;(function(window, document) {
+/*jshint evil:true */
+  /** version */
+  var version = '3.7.0';
+
+  /** Preset options */
+  var options = window.html5 || {};
+
+  /** Used to skip problem elements */
+  var reSkip = /^<|^(?:button|map|select|textarea|object|iframe|option|optgroup)$/i;
+
+  /** Not all elements can be cloned in IE **/
+  var saveClones = /^(?:a|b|code|div|fieldset|h1|h2|h3|h4|h5|h6|i|label|li|ol|p|q|span|strong|style|table|tbody|td|th|tr|ul)$/i;
+
+  /** Detect whether the browser supports default html5 styles */
+  var supportsHtml5Styles;
+
+  /** Name of the expando, to work with multiple documents or to re-shiv one document */
+  var expando = '_html5shiv';
+
+  /** The id for the the documents expando */
+  var expanID = 0;
+
+  /** Cached data for each document */
+  var expandoData = {};
+
+  /** Detect whether the browser supports unknown elements */
+  var supportsUnknownElements;
+
+  (function() {
+    try {
+        var a = document.createElement('a');
+        a.innerHTML = '<xyz></xyz>';
+        //if the hidden property is implemented we can assume, that the browser supports basic HTML5 Styles
+        supportsHtml5Styles = ('hidden' in a);
+
+        supportsUnknownElements = a.childNodes.length == 1 || (function() {
+          // assign a false positive if unable to shiv
+          (document.createElement)('a');
+          var frag = document.createDocumentFragment();
+          return (
+            typeof frag.cloneNode == 'undefined' ||
+            typeof frag.createDocumentFragment == 'undefined' ||
+            typeof frag.createElement == 'undefined'
+          );
+        }());
+    } catch(e) {
+      // assign a false positive if detection fails => unable to shiv
+      supportsHtml5Styles = true;
+      supportsUnknownElements = true;
+    }
+
+  }());
+
+  /*--------------------------------------------------------------------------*/
+
+  /**
+   * Creates a style sheet with the given CSS text and adds it to the document.
+   * @private
+   * @param {Document} ownerDocument The document.
+   * @param {String} cssText The CSS text.
+   * @returns {StyleSheet} The style element.
+   */
+  function addStyleSheet(ownerDocument, cssText) {
+    var p = ownerDocument.createElement('p'),
+        parent = ownerDocument.getElementsByTagName('head')[0] || ownerDocument.documentElement;
+
+    p.innerHTML = 'x<style>' + cssText + '</style>';
+    return parent.insertBefore(p.lastChild, parent.firstChild);
+  }
+
+  /**
+   * Returns the value of `html5.elements` as an array.
+   * @private
+   * @returns {Array} An array of shived element node names.
+   */
+  function getElements() {
+    var elements = html5.elements;
+    return typeof elements == 'string' ? elements.split(' ') : elements;
+  }
+
+    /**
+   * Returns the data associated to the given document
+   * @private
+   * @param {Document} ownerDocument The document.
+   * @returns {Object} An object of data.
+   */
+  function getExpandoData(ownerDocument) {
+    var data = expandoData[ownerDocument[expando]];
+    if (!data) {
+        data = {};
+        expanID++;
+        ownerDocument[expando] = expanID;
+        expandoData[expanID] = data;
+    }
+    return data;
+  }
+
+  /**
+   * returns a shived element for the given nodeName and document
+   * @memberOf html5
+   * @param {String} nodeName name of the element
+   * @param {Document} ownerDocument The context document.
+   * @returns {Object} The shived element.
+   */
+  function createElement(nodeName, ownerDocument, data){
+    if (!ownerDocument) {
+        ownerDocument = document;
+    }
+    if(supportsUnknownElements){
+        return ownerDocument.createElement(nodeName);
+    }
+    if (!data) {
+        data = getExpandoData(ownerDocument);
+    }
+    var node;
+
+    if (data.cache[nodeName]) {
+        node = data.cache[nodeName].cloneNode();
+    } else if (saveClones.test(nodeName)) {
+        node = (data.cache[nodeName] = data.createElem(nodeName)).cloneNode();
+    } else {
+        node = data.createElem(nodeName);
+    }
+
+    // Avoid adding some elements to fragments in IE < 9 because
+    // * Attributes like `name` or `type` cannot be set/changed once an element
+    //   is inserted into a document/fragment
+    // * Link elements with `src` attributes that are inaccessible, as with
+    //   a 403 response, will cause the tab/window to crash
+    // * Script elements appended to fragments will execute when their `src`
+    //   or `text` property is set
+    return node.canHaveChildren && !reSkip.test(nodeName) ? data.frag.appendChild(node) : node;
+  }
+
+  /**
+   * returns a shived DocumentFragment for the given document
+   * @memberOf html5
+   * @param {Document} ownerDocument The context document.
+   * @returns {Object} The shived DocumentFragment.
+   */
+  function createDocumentFragment(ownerDocument, data){
+    if (!ownerDocument) {
+        ownerDocument = document;
+    }
+    if(supportsUnknownElements){
+        return ownerDocument.createDocumentFragment();
+    }
+    data = data || getExpandoData(ownerDocument);
+    var clone = data.frag.cloneNode(),
+        i = 0,
+        elems = getElements(),
+        l = elems.length;
+    for(;i<l;i++){
+        clone.createElement(elems[i]);
+    }
+    return clone;
+  }
+
+  /**
+   * Shivs the `createElement` and `createDocumentFragment` methods of the document.
+   * @private
+   * @param {Document|DocumentFragment} ownerDocument The document.
+   * @param {Object} data of the document.
+   */
+  function shivMethods(ownerDocument, data) {
+    if (!data.cache) {
+        data.cache = {};
+        data.createElem = ownerDocument.createElement;
+        data.createFrag = ownerDocument.createDocumentFragment;
+        data.frag = data.createFrag();
+    }
+
+
+    ownerDocument.createElement = function(nodeName) {
+      //abort shiv
+      if (!html5.shivMethods) {
+          return data.createElem(nodeName);
+      }
+      return createElement(nodeName, ownerDocument, data);
+    };
+
+    ownerDocument.createDocumentFragment = Function('h,f', 'return function(){' +
+      'var n=f.cloneNode(),c=n.createElement;' +
+      'h.shivMethods&&(' +
+        // unroll the `createElement` calls
+        getElements().join().replace(/[\w\-]+/g, function(nodeName) {
+          data.createElem(nodeName);
+          data.frag.createElement(nodeName);
+          return 'c("' + nodeName + '")';
+        }) +
+      ');return n}'
+    )(html5, data.frag);
+  }
+
+  /*--------------------------------------------------------------------------*/
+
+  /**
+   * Shivs the given document.
+   * @memberOf html5
+   * @param {Document} ownerDocument The document to shiv.
+   * @returns {Document} The shived document.
+   */
+  function shivDocument(ownerDocument) {
+    if (!ownerDocument) {
+        ownerDocument = document;
+    }
+    var data = getExpandoData(ownerDocument);
+
+    if (html5.shivCSS && !supportsHtml5Styles && !data.hasCSS) {
+      data.hasCSS = !!addStyleSheet(ownerDocument,
+        // corrects block display not defined in IE6/7/8/9
+        'article,aside,dialog,figcaption,figure,footer,header,hgroup,main,nav,section{display:block}' +
+        // adds styling not present in IE6/7/8/9
+        'mark{background:#FF0;color:#000}' +
+        // hides non-rendered elements
+        'template{display:none}'
+      );
+    }
+    if (!supportsUnknownElements) {
+      shivMethods(ownerDocument, data);
+    }
+    return ownerDocument;
+  }
+
+  /*--------------------------------------------------------------------------*/
+
+  /**
+   * The `html5` object is exposed so that more elements can be shived and
+   * existing shiving can be detected on iframes.
+   * @type Object
+   * @example
+   *
+   * // options can be changed before the script is included
+   * html5 = { 'elements': 'mark section', 'shivCSS': false, 'shivMethods': false };
+   */
+  var html5 = {
+
+    /**
+     * An array or space separated string of node names of the elements to shiv.
+     * @memberOf html5
+     * @type Array|String
+     */
+    'elements': options.elements || 'abbr article aside audio bdi canvas data datalist details dialog figcaption figure footer header hgroup main mark meter nav output progress section summary template time video',
+
+    /**
+     * current version of html5shiv
+     */
+    'version': version,
+
+    /**
+     * A flag to indicate that the HTML5 style sheet should be inserted.
+     * @memberOf html5
+     * @type Boolean
+     */
+    'shivCSS': (options.shivCSS !== false),
+
+    /**
+     * Is equal to true if a browser supports creating unknown/HTML5 elements
+     * @memberOf html5
+     * @type boolean
+     */
+    'supportsUnknownElements': supportsUnknownElements,
+
+    /**
+     * A flag to indicate that the document's `createElement` and `createDocumentFragment`
+     * methods should be overwritten.
+     * @memberOf html5
+     * @type Boolean
+     */
+    'shivMethods': (options.shivMethods !== false),
+
+    /**
+     * A string to describe the type of `html5` object ("default" or "default print").
+     * @memberOf html5
+     * @type String
+     */
+    'type': 'default',
+
+    // shivs the document according to the specified `html5` object options
+    'shivDocument': shivDocument,
+
+    //creates a shived element
+    createElement: createElement,
+
+    //creates a shived documentFragment
+    createDocumentFragment: createDocumentFragment
+  };
+
+  /*--------------------------------------------------------------------------*/
+
+  // expose html5
+  window.html5 = html5;
+
+  // shiv the document
+  shivDocument(document);
+
+}(this, document));

PHP安全/PHP反序列化漏洞复现/Typecho-1.0-14.10.10/源码/typecho/admin/js/respond.js

@@ -0,0 +1,237 @@
+/*! Respond.js v1.4.2: min/max-width media query polyfill
+ * Copyright 2013 Scott Jehl
+ * Licensed under MIT
+ * http://j.mp/respondjs */
+
+/*! matchMedia() polyfill - Test a CSS media type/query in JS. Authors & copyright (c) 2012: Scott Jehl, Paul Irish, Nicholas Zakas. Dual MIT/BSD license */
+/*! NOTE: If you're already including a window.matchMedia polyfill via Modernizr or otherwise, you don't need this part */
+(function(w) {
+  "use strict";
+  w.matchMedia = w.matchMedia || function(doc, undefined) {
+    var bool, docElem = doc.documentElement, refNode = docElem.firstElementChild || docElem.firstChild, fakeBody = doc.createElement("body"), div = doc.createElement("div");
+    div.id = "mq-test-1";
+    div.style.cssText = "position:absolute;top:-100em";
+    fakeBody.style.background = "none";
+    fakeBody.appendChild(div);
+    return function(q) {
+      div.innerHTML = '&shy;<style media="' + q + '"> #mq-test-1 { width: 42px; }</style>';
+      docElem.insertBefore(fakeBody, refNode);
+      bool = div.offsetWidth === 42;
+      docElem.removeChild(fakeBody);
+      return {
+        matches: bool,
+        media: q
+      };
+    };
+  }(w.document);
+})(this);
+
+(function(w) {
+  "use strict";
+  var respond = {};
+  w.respond = respond;
+  respond.update = function() {};
+  var requestQueue = [], xmlHttp = function() {
+    var xmlhttpmethod = false;
+    try {
+      xmlhttpmethod = new w.XMLHttpRequest();
+    } catch (e) {
+      xmlhttpmethod = new w.ActiveXObject("Microsoft.XMLHTTP");
+    }
+    return function() {
+      return xmlhttpmethod;
+    };
+  }(), ajax = function(url, callback) {
+    var req = xmlHttp();
+    if (!req) {
+      return;
+    }
+    req.open("GET", url, true);
+    req.onreadystatechange = function() {
+      if (req.readyState !== 4 || req.status !== 200 && req.status !== 304) {
+        return;
+      }
+      callback(req.responseText);
+    };
+    if (req.readyState === 4) {
+      return;
+    }
+    req.send(null);
+  }, isUnsupportedMediaQuery = function(query) {
+    return query.replace(respond.regex.minmaxwh, "").match(respond.regex.other);
+  };
+  respond.ajax = ajax;
+  respond.queue = requestQueue;
+  respond.unsupportedmq = isUnsupportedMediaQuery;
+  respond.regex = {
+    media: /@media[^\{]+\{([^\{\}]*\{[^\}\{]*\})+/gi,
+    keyframes: /@(?:\-(?:o|moz|webkit)\-)?keyframes[^\{]+\{(?:[^\{\}]*\{[^\}\{]*\})+[^\}]*\}/gi,
+    comments: /\/\*[^*]*\*+([^/][^*]*\*+)*\//gi,
+    urls: /(url\()['"]?([^\/\)'"][^:\)'"]+)['"]?(\))/g,
+    findStyles: /@media *([^\{]+)\{([\S\s]+?)$/,
+    only: /(only\s+)?([a-zA-Z]+)\s?/,
+    minw: /\(\s*min\-width\s*:\s*(\s*[0-9\.]+)(px|em)\s*\)/,
+    maxw: /\(\s*max\-width\s*:\s*(\s*[0-9\.]+)(px|em)\s*\)/,
+    minmaxwh: /\(\s*m(in|ax)\-(height|width)\s*:\s*(\s*[0-9\.]+)(px|em)\s*\)/gi,
+    other: /\([^\)]*\)/g
+  };
+  respond.mediaQueriesSupported = w.matchMedia && w.matchMedia("only all") !== null && w.matchMedia("only all").matches;
+  if (respond.mediaQueriesSupported) {
+    return;
+  }
+  var doc = w.document, docElem = doc.documentElement, mediastyles = [], rules = [], appendedEls = [], parsedSheets = {}, resizeThrottle = 30, head = doc.getElementsByTagName("head")[0] || docElem, base = doc.getElementsByTagName("base")[0], links = head.getElementsByTagName("link"), lastCall, resizeDefer, eminpx, getEmValue = function() {
+    var ret, div = doc.createElement("div"), body = doc.body, originalHTMLFontSize = docElem.style.fontSize, originalBodyFontSize = body && body.style.fontSize, fakeUsed = false;
+    div.style.cssText = "position:absolute;font-size:1em;width:1em";
+    if (!body) {
+      body = fakeUsed = doc.createElement("body");
+      body.style.background = "none";
+    }
+    docElem.style.fontSize = "100%";
+    body.style.fontSize = "100%";
+    body.appendChild(div);
+    if (fakeUsed) {
+      docElem.insertBefore(body, docElem.firstChild);
+    }
+    ret = div.offsetWidth;
+    if (fakeUsed) {
+      docElem.removeChild(body);
+    } else {
+      body.removeChild(div);
+    }
+    docElem.style.fontSize = originalHTMLFontSize;
+    if (originalBodyFontSize) {
+      body.style.fontSize = originalBodyFontSize;
+    }
+    ret = eminpx = parseFloat(ret);
+    return ret;
+  }, applyMedia = function(fromResize) {
+    var name = "clientWidth", docElemProp = docElem[name], currWidth = doc.compatMode === "CSS1Compat" && docElemProp || doc.body[name] || docElemProp, styleBlocks = {}, lastLink = links[links.length - 1], now = new Date().getTime();
+    if (fromResize && lastCall && now - lastCall < resizeThrottle) {
+      w.clearTimeout(resizeDefer);
+      resizeDefer = w.setTimeout(applyMedia, resizeThrottle);
+      return;
+    } else {
+      lastCall = now;
+    }
+    for (var i in mediastyles) {
+      if (mediastyles.hasOwnProperty(i)) {
+        var thisstyle = mediastyles[i], min = thisstyle.minw, max = thisstyle.maxw, minnull = min === null, maxnull = max === null, em = "em";
+        if (!!min) {
+          min = parseFloat(min) * (min.indexOf(em) > -1 ? eminpx || getEmValue() : 1);
+        }
+        if (!!max) {
+          max = parseFloat(max) * (max.indexOf(em) > -1 ? eminpx || getEmValue() : 1);
+        }
+        if (!thisstyle.hasquery || (!minnull || !maxnull) && (minnull || currWidth >= min) && (maxnull || currWidth <= max)) {
+          if (!styleBlocks[thisstyle.media]) {
+            styleBlocks[thisstyle.media] = [];
+          }
+          styleBlocks[thisstyle.media].push(rules[thisstyle.rules]);
+        }
+      }
+    }
+    for (var j in appendedEls) {
+      if (appendedEls.hasOwnProperty(j)) {
+        if (appendedEls[j] && appendedEls[j].parentNode === head) {
+          head.removeChild(appendedEls[j]);
+        }
+      }
+    }
+    appendedEls.length = 0;
+    for (var k in styleBlocks) {
+      if (styleBlocks.hasOwnProperty(k)) {
+        var ss = doc.createElement("style"), css = styleBlocks[k].join("\n");
+        ss.type = "text/css";
+        ss.media = k;
+        head.insertBefore(ss, lastLink.nextSibling);
+        if (ss.styleSheet) {
+          ss.styleSheet.cssText = css;
+        } else {
+          ss.appendChild(doc.createTextNode(css));
+        }
+        appendedEls.push(ss);
+      }
+    }
+  }, translate = function(styles, href, media) {
+    var qs = styles.replace(respond.regex.comments, "").replace(respond.regex.keyframes, "").match(respond.regex.media), ql = qs && qs.length || 0;
+    href = href.substring(0, href.lastIndexOf("/"));
+    var repUrls = function(css) {
+      return css.replace(respond.regex.urls, "$1" + href + "$2$3");
+    }, useMedia = !ql && media;
+    if (href.length) {
+      href += "/";
+    }
+    if (useMedia) {
+      ql = 1;
+    }
+    for (var i = 0; i < ql; i++) {
+      var fullq, thisq, eachq, eql;
+      if (useMedia) {
+        fullq = media;
+        rules.push(repUrls(styles));
+      } else {
+        fullq = qs[i].match(respond.regex.findStyles) && RegExp.$1;
+        rules.push(RegExp.$2 && repUrls(RegExp.$2));
+      }
+      eachq = fullq.split(",");
+      eql = eachq.length;
+      for (var j = 0; j < eql; j++) {
+        thisq = eachq[j];
+        if (isUnsupportedMediaQuery(thisq)) {
+          continue;
+        }
+        mediastyles.push({
+          media: thisq.split("(")[0].match(respond.regex.only) && RegExp.$2 || "all",
+          rules: rules.length - 1,
+          hasquery: thisq.indexOf("(") > -1,
+          minw: thisq.match(respond.regex.minw) && parseFloat(RegExp.$1) + (RegExp.$2 || ""),
+          maxw: thisq.match(respond.regex.maxw) && parseFloat(RegExp.$1) + (RegExp.$2 || "")
+        });
+      }
+    }
+    applyMedia();
+  }, makeRequests = function() {
+    if (requestQueue.length) {
+      var thisRequest = requestQueue.shift();
+      ajax(thisRequest.href, function(styles) {
+        translate(styles, thisRequest.href, thisRequest.media);
+        parsedSheets[thisRequest.href] = true;
+        w.setTimeout(function() {
+          makeRequests();
+        }, 0);
+      });
+    }
+  }, ripCSS = function() {
+    for (var i = 0; i < links.length; i++) {
+      var sheet = links[i], href = sheet.href, media = sheet.media, isCSS = sheet.rel && sheet.rel.toLowerCase() === "stylesheet";
+      if (!!href && isCSS && !parsedSheets[href]) {
+        if (sheet.styleSheet && sheet.styleSheet.rawCssText) {
+          translate(sheet.styleSheet.rawCssText, href, media);
+          parsedSheets[href] = true;
+        } else {
+          if (!/^([a-zA-Z:]*\/\/)/.test(href) && !base || href.replace(RegExp.$1, "").split("/")[0] === w.location.host) {
+            if (href.substring(0, 2) === "//") {
+              href = w.location.protocol + href;
+            }
+            requestQueue.push({
+              href: href,
+              media: media
+            });
+          }
+        }
+      }
+    }
+    makeRequests();
+  };
+  ripCSS();
+  respond.update = ripCSS;
+  respond.getEmValue = getEmValue;
+  function callMedia() {
+    applyMedia(true);
+  }
+  if (w.addEventListener) {
+    w.addEventListener("resize", callMedia, false);
+  } else if (w.attachEvent) {
+    w.attachEvent("onresize", callMedia);
+  }
+})(this);