PPC已解决Discuz!7.1与7.2远程执行漏洞

function showmessage($message,$url_forward = '',$extra = '',$forwardtype = 0) {
extract($GLOBALS,EXTR_SKIP);//危险的用法，未初始化的变量可以直接带进函数，直接导致了问题产生，from www.oldjun.com
global $hookscriptmessage,$extrahead,$discuz_uid,$discuz_action,$debuginfo,$seccode,$seccodestatus,$fid,$tid,$charset,$show_message,$inajax,$_DCACHE,$advlist;
define('CACHE_FORBIDDEN',TRUE);
$hookscriptmessage = $show_message = $message;$messagehandle = 0;
$msgforward = unserialize($_DCACHE['settings']['msgforward']);
$refreshtime = intval($msgforward['refreshtime']);
$refreshtime = empty($forwardtype) ? $refreshtime : ($refreshtime ? $refreshtime : 3);
$msgforward['refreshtime'] = $refreshtime * 1000;
$url_forward = empty($url_forward) ? '' : (empty($_DCOOKIE['sid']) && $transsidstatus ? transsid($url_forward) : $url_forward);
$seccodecheck = $seccodestatus & 2;
if($_DCACHE['settings']['funcsiteid'] && $_DCACHE['settings']['funckey'] && $funcstatinfo && !IS_ROBOT) {
$statlogfile = DISCUZ_ROOT.'./forumdata/funcstat.log';
if($fp = @fopen($statlogfile,'a')) {
@flock($fp,2);
if(is_array($funcstatinfo)) {
$funcstatinfo = array_unique($funcstatinfo);
foreach($funcstatinfo as $funcinfo) {
fwrite($fp,funcstat_query($funcinfo,$message)."");
}
} else {
fwrite($fp,funcstat_query($funcstatinfo,$message)."");
}
fclose($fp);
$funcstatinfo = $GLOBALS['funcstatinfo'] = '';
}
}

if(!defined('STAT_DISABLED') && STAT_ID > 0 && !IS_ROBOT) {
write_statlog($message);
}

if($url_forward && (!empty($quickforward) || empty($inajax) && $msgforward['quick'] && $msgforward['messages'] && @in_array($message,$msgforward['messages']))) {
updatesession();
dheader("location: ".str_replace('&','&',$url_forward));
}
if(!empty($infloat)) {
if($extra) {
$messagehandle = $extra;
}
$extra = '';
}
if(in_array($extra,array('HALTED','NOPERM'))) {
$discuz_action = 254;
} else {
$discuz_action = 255;
}

include language('messages');

$vars = explode(':',$message);//只要含:就可以了
if(count($vars) == 2 && isset($scriptlang[$vars[0]][$vars[1]])) {//两个数字即可，用:分割
eval("$show_message = "".str_replace('"','"',$scriptlang[$vars[0]][$vars[1]])."";");//$scriptlang未初始化，可以自定义，from www.oldjun.com
} elseif(isset($language[$message])) {
$pre = $inajax ? 'ajax_' : '';
eval("$show_message = "".(isset($language[$pre.$message]) ? $language[$pre.$message] : $language[$message])."";");
unset($pre);
}

......
}