Language: PHP
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
	public function checkAccessToken(){
		$config = Model('Plugin')->getConfig('fileView');
		if(!$config['apiKey']) return;

		$timeTo = isset($this->in['timeTo'])?intval($this->in['timeTo']):'';
		$token = md5($this->in['path'].$timeTo.$config['apiKey']);
		if($token != $this->in['token']){
			show_tips('token ' . LNG('common.error'));
		}
		if($timeTo != '' && $timeTo <= time()){
			show_tips('token ' . LNG('common.expired'));
		}
	}