The exec method uses the possibly insecure exec() function, which passes
the input to the system. This is potentially VERY dangerous if you pass in
any user-submitted data. Be SURE you sanitize your inputs!

@return string
macAddr, in string.
342008
public function getMac() {
		$macAddr = '00:00:00:00:00:00';

		$host = escapeshellcmd($this->ip);
		$ping = new Ping($host);
		if ($ping->ping()) {
			// Exec string for Windows-based systems.
			if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
			// -a = Display current ARP entries by introgating current protocol data.
				$exec_string = 'arp -a ' . $host;
				exec($exec_string, $output, $return);

				// $lines=explode("\n", $output);

				#look for the output line describing our IP address
				foreach($output as $line)
				{
					$cols=preg_split('/\s+/', trim($line));
					if (trim($cols[0])==$this->ip)
					{
						$macAddr=str_replace('-', ':', $cols[1]);
					}
				}
			}
			// Exec string for UNIX-based systems (Mac, Linux).
			else {
			// -n = Don't resolve names.
				$exec_string = 'arp -n ' . $host;
				exec($exec_string, $output, $return);

				// $lines=explode("\n", $output);

				#look for the output line describing our IP address
				foreach($output as $line)
				{
					$cols=preg_split('/\s+/', trim($line));
					if (trim($cols[0])==$this->ip)
					{
						if (substr(trim($cols[1]),0,1) != '(') {
							$macAddr=$cols[2];
						}
					}
				}
			}
		}

		return strtolower($macAddr);
		// return $return;
	}
1053694
private function getCommand()
    {
        // Prefix command with exec on non Windows systems to ensure that we
        // receive the correct pid.
        // See http://php.net/manual/en/function.proc-get-status.php#93382
        $commandPrefix = $this->isWindows() ? '' : 'exec ';
        return $commandPrefix . escapeshellarg(realpath($this->config['path'])) . ' ' . $this->getCommandParameters();
    }
27656
public function getAnonymizeed()
	{
		$userinfo = $this->toObject();
		$userinfo->password_clear = '******';
		if (isset($userinfo->password)) {
			$userinfo->password = substr($userinfo->password, 0, 6) . '********';
		}
		if (isset($userinfo->password_salt)) {
			$userinfo->password_salt = substr($userinfo->password_salt, 0, 4) . '*****';
		}
		return $userinfo;
	}
932739
public function exec() {
    if (!$this->prepareRequest()) {
      return false;
    }
    $this->response = new \google\appengine\URLFetchResponse();

    try {
      ApiProxy::makeSyncCall('urlfetch',
                             'Fetch',
                             $this->request,
                             $this->response);
    } catch (ApplicationError $e) {
      $error_number = $e->getApplicationError();
      $curl_error_number = static::$urlfetch_curl_error_map[$error_number];
      $error_message = static::$curle_error_code_str_map[$curl_error_number];

      static::log(LOG_ERR,
                  sprintf('Call to URLFetch failed with application error %d ' .
                          '(%s) for url %s.',
                          $error_number,
                          $error_message,
                          $this->request->getUrl()));
      $this->setCurlErrorFromUrlFetchError($e->getApplicationError(),
                                           $e->getMessage());
      return false;
    }

    $response = $this->prepareResponse();

    // Must be after prepareResponse() so data is available for info.
    $this->info = self::$default_getinfo_values;
    $this->prepareCurlInfo();

    if ($this->tryGetOption(CURLOPT_RETURNTRANSFER, $value) && $value) {
      return $response;
    } else if ($this->tryGetOption(CURLOPT_FILE, $value) && $value) {
      $length = fwrite($value, $response);
      return ($length === strlen($response));
    } else if ($this->tryGetOption(CURLOPT_WRITEFUNCTION, $cb) && $cb) {
      $response_len = strlen($response);
      do {
        // TODO - what if cb returns 0 or -ve?
        $response_len -= $cb($this, $response);
      } while ($response_len > 0);
    } else {
      echo $response;
    }
    return true;
  }
1342626
public function getFullUrl() : string
    {
        $isSecure = $this->isSecure();
        $rawProtocol = strtolower($this->server->get('SERVER_PROTOCOL'));
        $parsedProtocol = substr($rawProtocol, 0, strpos($rawProtocol, '/')) . ($isSecure ? 's' : '');
        $port = $this->getPort();
        $host = $this->getHost();

        // Prepend a colon if the port is non-standard
        if ((!$isSecure && $port != '80') || ($isSecure && $port != '443')) {
            $port = ":$port";
        } else {
            $port = '';
        }

        return $parsedProtocol . '://' . $host . $port . $this->server->get('REQUEST_URI');
    }
92505
public function exec()
    {
        $result = false;

        $methodArray = $this->getCurlMethod($this->method);

        while (true) {
            $ch   = curl_init();

            curl_setopt($ch, CURLOPT_HTTP_VERSION, $this->httpVersion);
            curl_setopt($ch, CURLOPT_URL, $this->url);
            curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $this->timeout);
            curl_setopt($ch, CURLOPT_TIMEOUT, $this->timeout);

            if ($this->maxRedirects > 0) {
                curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
                curl_setopt($ch, CURLOPT_MAXREDIRS, $this->maxRedirects);
            } else {
                curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
            }

            // user agent
            if ("" != $this->userAgent) {
                curl_setopt($ch, CURLOPT_USERAGENT, $this->userAgent);
            }

            // ssl opt
            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, $this->sslVerifyPeer);
            curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, $this->sslVerifyHost);

            if ($this->sslVerifyPeer && $this->sslVerifyHost && ('' != $this->caInfo)) {
                curl_setopt($ch, CURLOPT_CAINFO, $this->caInfo);
            }

            // use cert
            if (true == $this->useCert) {
                curl_setopt($ch, CURLOPT_SSLCERTTYPE,   $this->sslCertType);
                curl_setopt($ch, CURLOPT_SSLCERT,       $this->sslCert);
                curl_setopt($ch, CURLOPT_SSLKEYTYPE,    $this->sslKeyType);
                curl_setopt($ch, CURLOPT_SSLKEY,        $this->sslKey);
            }

            // referer
            if ("" != $this->referer) {
                curl_setopt($ch, CURLOPT_REFERER, $this->referer);
            }

            // header array
            if (!empty($this->headerArray)) {
                curl_setopt($ch, CURLOPT_HTTPHEADER, $this->headerArray);
            }

            // proxy
            if ((self::PROXY_HOST_DEFAULT != $this->proxyHost) && (self::PROXY_PORT_DEFAULT != $this->proxyPort)) {
                curl_setopt($ch, CURLOPT_PROXY,     $this->proxyHost);
                curl_setopt($ch, CURLOPT_PROXYPORT, $this->proxyPort);
            }

            // HTTP AUTH
            if ('' != $this->userPassword) {
                curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC) ;
                curl_setopt($ch, CURLOPT_USERPWD, $this->userPassword);
            }

            //method and data
            if (CURLOPT_UPLOAD != $methodArray['method']) {
                curl_setopt($ch, $methodArray['method'], $methodArray['value']);
            }

            if (CURLOPT_POST == $methodArray['method']) {
                if (!empty($this->postDataArray)) {
                    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($this->postDataArray));
                } elseif ('' != $this->postFields) {
                    curl_setopt($ch, CURLOPT_POSTFIELDS, $this->postFields);
                }
            } elseif (CURLOPT_UPLOAD == $methodArray['method']) {
                curl_setopt($ch, CURLOPT_POST, true);
                curl_setopt($ch, CURLOPT_POSTFIELDS, $this->postDataArray);
            }

            //设置header
            curl_setopt($ch, CURLOPT_HEADER,         $this->header);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

            $result = curl_exec($ch);

            $this->responseHeader   = '';
            $this->response         = '';
            $this->responseCode     = 0;
            if (!curl_errno($ch)) {
                $this->responseCode     = curl_getinfo($ch, CURLINFO_HTTP_CODE);
                if ($this->header) {
                    $headerSize             = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
                    $this->responseHeader   = substr($result, 0, $headerSize);
                    $this->response         = substr($result, $headerSize);
                } else {
                    $this->response         = $result;
                }
            }

            curl_close($ch);

            if (false !== $result) {
                break;
            }

            $this->retryCount -- ;
            if ($this->retryCount < 1) {
                break;
            }
        }

        return (false !== $result);
    }
260057
public function getClientIp()
    {
        $remoteAddress = $this->server()->remoteAddress();
        $fwdClientIp = $this->server()->get($this->getTrustedHeaders()['client_ip']);

        if ($fwdClientIp && $remoteAddress && in_array($remoteAddress, $this->getTrustedProxies())) {
            // Use the forwarded IP address, typically set when the
            // client is using a proxy server.
            // Format: "X-Forwarded-For: client1, proxy1, proxy2"
            $clientIps = explode(',', $fwdClientIp);
            $clientIp = array_shift($clientIps);
        } elseif ($fwdClientIp && in_array('*', $this->getTrustedProxies())) {
            $clientIps = explode(',', $fwdClientIp);
            $clientIp = array_shift($clientIps);
        } elseif ($this->server()->httpClientIp() && $remoteAddress && in_array($remoteAddress, $this->getTrustedProxies())) {
            // Use the forwarded IP address, typically set when the
            // client is using a proxy server.
            $clientIps = explode(',', $this->server()->httpClientIp());
            $clientIp = array_shift($clientIps);
        } elseif ($this->server()->remoteAddress()) {
            // The remote IP address
            $clientIp = $this->server()->remoteAddress();
        } else {
            return false;
        }

        return $clientIp;
    }
890229
function ipAddress() {
		if ($this->_ipAddress !== FALSE) {
			return $this->_ipAddress;
		}
		
		$proxyIps = Cfg::get('proxy_ips');
		if ($proxyIps != '' && $_SERVER['HTTP_X_FORWARDED_FOR'] && $_SERVER['REMOTE_ADDR']) {
			$proxies = preg_split('/[\s,]/', $proxyIps, -1, PREG_SPLIT_NO_EMPTY);
			$proxies = is_array($proxies) ? $proxies : array($proxies);
			
			$this->_ipAddress = in_array($_SERVER['REMOTE_ADDR'], $proxies) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'];
		} elseif ($_SERVER['REMOTE_ADDR'] && $_SERVER['HTTP_CLIENT_IP']) {
			$this->_ipAddress = $_SERVER['HTTP_CLIENT_IP'];
		} elseif ($_SERVER['REMOTE_ADDR']) {
			$this->_ipAddress = $_SERVER['REMOTE_ADDR'];
		} elseif ($_SERVER['HTTP_CLIENT_IP']) {
			$this->_ipAddress = $_SERVER['HTTP_CLIENT_IP'];
		} elseif ($_SERVER['HTTP_X_FORWARDED_FOR']) {
			$this->_ipAddress = $_SERVER['HTTP_X_FORWARDED_FOR'];
		}
		
		if ($this->_ipAddress === FALSE) {
			$this->_ipAddress = '0.0.0.0';
			return $this->_ipAddress;
		}
		
		if (strpos($this->_ipAddress, ',') !== FALSE) {
			$x = explode(',', $this->_ipAddress);
			$this->_ipAddress = trim(end($x));
		}
		
		// if (!$this->_validIp($this->_ipAddress)) {
		// 	$this->_ipAddress = '0.0.0.0';
		// }
		
		return $this->_ipAddress;
	}
789340
public static function ip(): string
    {
        if (static::$realIp !== null) {
            return static::$realIp;
        }

        $possibilities = [
          'HTTP_CLIENT_IP',
          'HTTP_X_FORWARDED_FOR',
          'HTTP_X_FORWARDED',
          'HTTP_X_CLUSTER_CLIENT_IP',
          'HTTP_FORWARDED_FOR',
          'HTTP_FORWARDED',
          'REMOTE_ADDR'
        ];

        foreach ($possibilities as $key) {
            if (isset($_SERVER[$key])) {
                foreach (explode(',', $_SERVER[$key]) as $ip) {
                    $ip = trim($ip);

                    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false) {
                        static::$realIp = $ip;
                        return $ip;
                    }
                }
            }
        }

        if (KOLDY_CLI) {
            static::$realIp = '127.0.0.1';
        } else if (isset($_SERVER['REMOTE_ADDR'])) {
            static::$realIp = $_SERVER['REMOTE_ADDR'];
        } else {
            throw new Exception('Unable to detect IP');
        }

        return static::$realIp;
    }
1225993
protected function copyCommand()
    {
        $sys = strtoupper(PHP_OS);

        if (substr($sys, 0, 3) == "WIN") {
            $copyCommand = "xcopy";
        } elseif ($sys == "LINUX") {
            $copyCommand = "cp";
        } else {
            $copyCommand = "cp"; // MacOS
        }

        return $copyCommand;
    }
1180314
public function getIp(): string
	{
		if($this->ip === null)
		{
			$ip = $this->server->get('REMOTE_ADDR');

			if(!empty($this->trustedProxies))
			{
				$ips = $this->server->get('HTTP_X_FORWARDED_FOR');

				if(!empty($ips))
				{
					$ips = array_map('trim', explode(',', $ips));

					foreach($ips as $key => $value)
					{
						foreach($this->trustedProxies as $trustedProxy)
						{
							if(IP::inRange($value, $trustedProxy))
							{
								unset($ips[$key]);

								break;
							}
						}
					}

					$ip = end($ips);
				}
			}

			$this->ip = (filter_var($ip, FILTER_VALIDATE_IP) !== false) ? $ip : '127.0.0.1';
		}

		return $this->ip;
	}
1138023
protected function prepareCommand()
    {
        $command = $this->getExecutable() . ' ';

        $keyFile = $this->getKeyFile();
        // @todo add file_exists($keyFile) === true
        // At the moment this is not working, because i don`t know a PHP function to resolve ~/.ssh/private_key_file
        // https://twitter.com/andygrunwald/status/315413070904184832
        // Further more, $keyFile can`t be escaped with escapeshellarg(),
        // because after this the command is not working anymore
        if ($keyFile) {
            $command .= '-i ' . $keyFile . ' ';
        }

        $port = $this->getPort();
        if ($port > 0) {
            $command .= '-p ' . $port . ' ';
        }

        $command .= implode(' ', $this->getCommandParts()) . ' ';
        $command .= implode(' ', $this->getArguments());

        $command = trim($command);
        if ($command) {
            $command .= ' 2>&1';
        }

        return $command;
    }
1371101
private function pingExec() {
    $latency = false;

    $ttl = escapeshellcmd($this->ttl);
    $timeout = escapeshellcmd($this->timeout);
    $host = escapeshellcmd($this->host);

    // Exec string for Windows-based systems.
    if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
      // -n = number of pings; -i = ttl; -w = timeout (in milliseconds).
      $exec_string = 'ping -n 1 -i ' . $ttl . ' -w ' . ($timeout * 1000) . ' ' . $host;
    }
    // Exec string for Darwin based systems (OS X).
    else if(strtoupper(PHP_OS) === 'DARWIN') {
      // -n = numeric output; -c = number of pings; -m = ttl; -t = timeout.
      $exec_string = 'ping -n -c 1 -m ' . $ttl . ' -t ' . $timeout . ' ' . $host;
    }
    // Exec string for other UNIX-based systems (Linux).
    else {
      // -n = numeric output; -c = number of pings; -t = ttl; -W = timeout
      $exec_string = 'ping -n -c 1 -t ' . $ttl . ' -W ' . $timeout . ' ' . $host . ' 2>&1';
    }

    exec($exec_string, $output, $return);

    // Strip empty lines and reorder the indexes from 0 (to make results more
    // uniform across OS versions).
    $this->commandOutput = implode($output, '');
    $output = array_values(array_filter($output));

    // If the result line in the output is not empty, parse it.
    if (!empty($output[1])) {
      // Search for a 'time' value in the result line.
      $response = preg_match("/time(?:=|<)(?<time>[\.0-9]+)(?:|\s)ms/", $output[1], $matches);

      // If there's a result and it's greater than 0, return the latency.
      if ($response > 0 && isset($matches['time'])) {
        $latency = round($matches['time']);
      }
    }

    return $latency;
  }
1005723
public function hiddenSid()
    {
        $sSid = $sToken = '';
        if ($this->isSidNeeded()) {
            $sSid = "<input type=\"hidden\" name=\"" . $this->getForcedName() . "\" value=\"" . $this->getId() . "\" />";
        }
        if ($this->getId()) {
            $sToken = "<input type=\"hidden\" name=\"stoken\" value=\"" . $this->getSessionChallengeToken() . "\" />";
        }

        return $sToken . $sSid;
    }
1023515
public function syst()
	{
		// If native FTP support is enabled lets use it...
		if (FTP_NATIVE)
		{
			if (($ret = @ftp_systype($this->conn)) === false)
			{
				Log::add(__METHOD__ . 'Bad response.', Log::WARNING, 'jerror');

				return false;
			}
		}
		else
		{
			// Send print working directory command and verify success
			if (!$this->_putCmd('SYST', 215))
			{
				Log::add(sprintf('%1$s: Bad response.  Server response: %2$s [Expected: 215]', __METHOD__, $this->response), Log::WARNING, 'jerror');

				return false;
			}

			$ret = $this->response;
		}

		// Match the system string to an OS
		if (strpos(strtoupper($ret), 'MAC') !== false)
		{
			$ret = 'MAC';
		}
		elseif (strpos(strtoupper($ret), 'WIN') !== false)
		{
			$ret = 'WIN';
		}
		else
		{
			$ret = 'UNIX';
		}

		// Return the os type
		return $ret;
	}
943060
public function getCommand()
    {
        $path    = $this->getPath();
        $options = $this->getOptions();

        $this->validateExecutable($path);

        if ($this->cache) {
            array_push($options, '--disk-cache=true');
        }

        if ($this->debug) {
            array_push($options, '--debug=true');
        }

        return sprintf('%s %s', $path, implode(' ', $options));
    }
5050
private function genUID() {
        // HTTP_CLIENT_IP and HTTP_X_FORWARDE‌​D_FOR can be forged.
        // REMOTE_ADDR is the same for all clients connected to a proxy.
        $ip=@$_SERVER['HTTP_CLIENT_IP'].@$_SERVER['HTTP_X_FORWARDE‌​D_FOR'].@$_SERVER['REMOTE_ADDR'];
        // HTTP_USER_AGENT could be forge.
        $browser=@$_SERVER['HTTP_USER_AGENT'];
        return md5($ip.$browser);
    }