From 9607e2c25184ed09fe695a77aad0fa13c5b31825 Mon Sep 17 00:00:00 2001
From: wikiboss <zacow@163.com>
Date: Mon, 26 Oct 2026 09:42:22 +0800
Subject: [PATCH] =?UTF-8?q?test:=20=E5=A2=9E=E5=8A=A0=20PHP2Shell(CVE-2026?=
 =?UTF-8?q?-109618/109619)=20=E5=AE=89=E5=85=A8=E5=9F=BA=E7=BA=BF=E4=B8=8E?=
 =?UTF-8?q?=20php.ini=20=E9=98=B2=E6=8A=A4=E6=B5=8B=E8=AF=95=E7=94=A8?=
 =?UTF-8?q?=E4=BE=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tests/SecurityPhpIniTest.php | 67 ++++++++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 tests/SecurityPhpIniTest.php

diff --git a/tests/SecurityPhpIniTest.php b/tests/SecurityPhpIniTest.php
new file mode 100644
index 0000000..dded575
--- /dev/null
+++ b/tests/SecurityPhpIniTest.php
@@ -0,0 +1,67 @@
+<?php
+/**
+ * FastAdmin / PHP2Shell 安全配置验证测试 (严格遵循 TDD 模式)
+ * 对应社区安全提醒：https://ask.fastadmin.net/question/51687.html
+ * 漏洞防护目标：CVE-2026-109618 / CVE-2026-109619
+ */
+
+define('ROOT_PATH', __DIR__ . '/../');
+define('APP_PATH', ROOT_PATH . 'application/');
+define('DS', DIRECTORY_SEPARATOR);
+
+echo "====================================================\n";
+echo "【安全配置测试】PHP2Shell 安全基线验证 (TDD 模式)\n";
+echo "====================================================\n";
+
+$failedCount = 0;
+
+// 测试 1：session.upload_progress.enabled 必须被完全禁用 (Off / 0)
+$uploadProgress = ini_get('session.upload_progress.enabled');
+if ($uploadProgress === '1' || $uploadProgress === 1 || strtolower($uploadProgress) === 'on') {
+    echo "[FAIL] 测试 1 未通过: session.upload_progress.enabled 当前为 1 (On)，存在 PHP2Shell 远程代码执行风险，必须设置为 Off！\n";
+    $failedCount++;
+} else {
+    echo "[PASS] 测试 1 通过: session.upload_progress.enabled 已正确关闭 (Off / 0)\n";
+}
+
+// 测试 2：session.use_strict_mode 必须被启用 (1 / On)
+$strictMode = ini_get('session.use_strict_mode');
+if ($strictMode !== '1' && $strictMode !== 1 && strtolower($strictMode) !== 'on') {
+    echo "[FAIL] 测试 2 未通过: session.use_strict_mode 当前为 0 (Off)，未开启严格模式，必须设置为 1！\n";
+    $failedCount++;
+} else {
+    echo "[PASS] 测试 2 通过: session.use_strict_mode 已正确开启严格模式 (1)\n";
+}
+
+// 测试 3：检查 php.ini 配置文件内容中的明确配置声明
+$iniPath = php_ini_loaded_file();
+echo "当前加载的 php.ini 路径: " . ($iniPath ?: "未检测到 loaded php.ini") . "\n";
+
+if ($iniPath && file_exists($iniPath)) {
+    $iniContent = file_get_contents($iniPath);
+    
+    // 匹配有效（非注释）的 session.upload_progress.enabled = Off 或 0
+    if (!preg_match('/^\s*session\.upload_progress\.enabled\s*=\s*(Off|0)\s*(;.*)?$/mi', $iniContent)) {
+        echo "[FAIL] 测试 3.1 未通过: {$iniPath} 中未显式配置有效未注释的 `session.upload_progress.enabled = Off`\n";
+        $failedCount++;
+    } else {
+        echo "[PASS] 测试 3.1 通过: {$iniPath} 显式配置了 `session.upload_progress.enabled = Off`\n";
+    }
+
+    // 匹配有效（非注释）的 session.use_strict_mode = 1 或 On
+    if (!preg_match('/^\s*session\.use_strict_mode\s*=\s*(1|On)\s*(;.*)?$/mi', $iniContent)) {
+        echo "[FAIL] 测试 3.2 未通过: {$iniPath} 中未显式配置有效未注释的 `session.use_strict_mode = 1`\n";
+        $failedCount++;
+    } else {
+        echo "[PASS] 测试 3.2 通过: {$iniPath} 显式配置了 `session.use_strict_mode = 1`\n";
+    }
+}
+
+echo "====================================================\n";
+if ($failedCount > 0) {
+    echo "【测试结论】共 {$failedCount} 项安全指标不符合要求，存在安全隐患！\n";
+    exit(1);
+} else {
+    echo "【测试结论】所有安全防护指标均已满足，安全基线通过！\n";
+    exit(0);
+}