禁止脚本文件上传

src/system/common.func.php

@@ -112,6 +112,9 @@ function get_mime_type($filename)
     }
     $finfo = finfo_open(FILEINFO_MIME_TYPE);
     $mimeType = finfo_file($finfo, $filename);
+    if (preg_match('#\.(php|pl|cgi|asp|aspx|jsp|php5|php4|php3|shtm|shtml)$#i', trim($filename))) {
+        return 'forbid/octet-stream';
+    }
     finfo_close($finfo);
     return $mimeType;
 }