Delete files from any directory in DatabaseModel.php

## make one test directory

Create a directory and create two file contents.

![newone](https://images.gitee.com/uploads/images/2020/0108/222933_b00d5e77_5619843.png "屏幕截图.png")

## delete "testtest" directory file

Enter the database backup file delete functionfirst of all,you need you backup the database and it will create database file like this.

![dbfile](https://images.gitee.com/uploads/images/2020/0108/223009_cf5ac895_5619843.png "屏幕截图.png")

Captured packets like this.

![packet](https://images.gitee.com/uploads/images/2020/0108/223149_f48c358f_5619843.png "屏幕截图.png")

Modify "data" parameter values like this

```
data=../testtest
```

![testtest](https://images.gitee.com/uploads/images/2020/0108/223243_87b91745_5619843.png "屏幕截图.png")

and it will success to delete this directory files.

## delete "upload" directory file

the upload directory files like this.

![upload](https://images.gitee.com/uploads/images/2020/0108/223519_7d75f90d_5619843.png "屏幕截图.png")

Modify "data" parameter values like this

```
data=../upload/2020-01-08
```

![upload-1](https://images.gitee.com/uploads/images/2020/0108/223535_5a65fcd0_5619843.png "屏幕截图.png")

look the upload directory

![upload-3](https://images.gitee.com/uploads/images/2020/0108/223655_83e9eb75_5619843.png "屏幕截图.png")

## Code analysis

find the delete database file in /app/admin/model/DatabaseModel.php.

![test](https://images.gitee.com/uploads/images/2020/0108/224045_e1d16267_5619843.png "屏幕截图.png")

And it will call the function delDir() in /framework/ext/Util.php.also this process is not filter anything.

![test2](https://images.gitee.com/uploads/images/2020/0108/224159_54e5353e_5619843.png "屏幕截图.png")

Finally lead to the deletion of arbitrary directory files.

## Solution

1）Filtering sensitive characters
2）Restricting deleted directories

王爷/DuxCMS2.1支持php7.0以上版本