HEX
Server: Apache
System: Linux uyu7574470001-7d78c9ff74-xfpwm 4.19.91-21.al7.x86_64 #1 SMP Wed Sep 2 19:47:49 CST 2020 x86_64
User: ()
PHP: 7.4.16
Disabled: chmod,exec,system,passthru,shell_exec,escapeshellarg,escapeshellcmd,proc_close,proc_open,ini_alter,dl,popen,pcntl_exec,socket_accept,socket_bind,socket_clear_error,socket_close,socket_connect,socket_create_listen,socket_create_pair,socket_create,socket_get_option,socket_getpeername,socket_getsockname,socket_last_error,socket_listen,socket_read,socket_recv,socket_recvfrom,socket_select,socket_send,socket_sendto,socket_set_block,socket_set_nonblock,socket_set_option,socket_shutdown,socket_strerror,socket_write,stream_socket_client,stream_socket_server,pfsockopen,disk_total_space,disk_free_space,chown,diskfreespace,getrusage,get_current_user,getmyuid,getmypid,dl,leak,listen,chgrp,link,symlink,dlopen,proc_nice,proc_get_stats,proc_terminate,shell_exec,sh2_exec,posix_getpwuid,posix_getgrgid,posix_kill,ini_restore,mkfifo,dbmopen,dbase_open,filepro,filepro_rowcount,posix_mkfifo,putenv,sleep,fsockopen
Upload Files
File: /usr/home/uyu7574470001/htdocs/wp-content/plugins/wp-file-manager/classes/files-backup.php
<?php 
class wp_file_manager_files_backup {

    public function zipData($source, $destination) {
        $source = str_replace('..', '', $source);
        $destination = str_replace('..', '', $destination);
        if (extension_loaded('zip') === true) {
            if (file_exists($source) === true) {
                $zip = new ZipArchive();
                if ($zip->open($destination, ZIPARCHIVE::CREATE) === true) {
                    $source = str_replace('\\', '/', realpath($source));
                    if (is_dir($source) === true) {
                        $files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($source), RecursiveIteratorIterator::SELF_FIRST);
                        foreach ($files as $file) {
                            if(strpos($file,'fm_backup') === false && (strpos($file,'opt') === false || strpos($file,'opt'))) {
                                $file = str_replace('\\', '/', realpath($file));
                                $relative_path = substr($file, strlen($source) + 1);
                                if (is_dir($file) === true) {
                                    if($relative_path !== false){
                                        $zip->addEmptyDir($relative_path);
                                    }
                                } else if (is_file($file) === true) {
                                    $zip->addFromString(str_replace($source . '/', '', $file), file_get_contents($file));
                                }
                            }
                        }
                    } else if (is_file($source) === true) {
                        $zip->addFromString(basename($source), file_get_contents($source));
                    }
                }
                return $zip->close();
            }
        }
        return false;
    }
    public function zipOther($source, $destination) {
        $source = str_replace('..', '', $source);
        $destination = str_replace('..', '', $destination);
        if (extension_loaded('zip') === true) {
            if (file_exists($source) === true) {
                $zip = new ZipArchive();
                if ($zip->open($destination, ZIPARCHIVE::CREATE) === true) {
                    $source = str_replace('\\', '/', realpath($source));
                    if (is_dir($source) === true) {
                        $files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($source), RecursiveIteratorIterator::SELF_FIRST); 
                        foreach ($files as $file) {
                           $file = str_replace('\\', '/', realpath($file));
                           $allfolders= explode("wp-content",$file);
                           if(isset($allfolders[1])){
                                $allfoldersdata= explode("/",$allfolders[1]);
                                if(isset($allfoldersdata[1]) && ($allfoldersdata[1] != 'themes' && $allfoldersdata[1] != 'plugins' && $allfoldersdata[1] != 'uploads')){
                                    $file = str_replace('\\', '/', realpath($file));
                                    $relative_path = substr($file, strlen($source) + 1);
                                    if (is_dir($file) === true) {
                                        if($relative_path !== false){
                                            $zip->addEmptyDir($relative_path);
                                        }
                                    } else if (is_file($file) === true) {
                                        $zip->addFromString(str_replace($source . '/', '', $file), file_get_contents($file));
                                    }
                                }
                            }

                        }
                    } else if (is_file($source) === true) {
                        $zip->addFromString(basename($source), file_get_contents($source));
                    }
                }
                return $zip->close();
            }
        }
        return false;
    }
}