Language: PHP
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
			$userRootShow = _get($GLOBALS,'isRoot') && $GLOBALS['config']["ADMIN_ALLOW_SOURCE"];
			if(!$userRootShow){
				if( !$pathInfo['auth'] || $pathInfo['auth']['authValue'] == 0){ // 放过-1; 打开通路;
					continue;// 没有权限;
				}
			}
			
			// 没有子文件夹; 则获取是否有子部门;
			// if( !$pathInfo['hasFolder'] && !$pathInfo['hasFile'] ){
			if( !$pathInfo['hasFolder'] ){
				$groupInfo = Model('Group')->getInfo($groupID);
				$pathInfo['hasFolder']  = $groupInfo ? $groupInfo['hasChildren']:false;
			}
			$result[] = $pathInfo;
		}
		// pr($result,$groupSource,$group,$groupArray);exit;
		return $result;
	}