Андрей Л

<?php

// Получаем токен, он живет 3600 сек, можно кешировать
/*
  "token_type": "Bearer",
  "expires_in": 3599,
  "ext_expires_in": 0,
  "access_token": "eyJ0eXAiOi..."
*/
$url='https://login.microsoftonline.com/botframework.com/oauth2/v2.0/token';
$params=array
    (
    'client_id' => 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx', //your-app-id
    'client_secret' => 'xxxxxxxxxxxxxxxxx',          // your-app-secret
    'grant_type'=>'client_credentials',                     //client_credentials&
    'scope'=>'https://api.botframework.com/.default'
    );
$result=file_get_contents($url, false, stream_context_create(array('http' => array
    (
    'method' => 'POST',
    'header' => 'Content-type: application/x-www-form-urlencoded',
    'content' => http_build_query($params)
    ))));

$token = json_decode($result, TRUE);

// Соответствия входящему массиву из вызова
// $IN['CHANNEL_NAME']
// $IN['CHANNEL']  = ['conversation']['id']
// $IN['URL'] = ['serviceUrl']
// $IN['TO'] = ['recipient']['id']
// $IN['FROM_ID'] = ['from']['id']

$url =$IN['URL'].'/v3/conversations/'.$IN['CHANNEL'].'/activities/';
$data_string = '
{
  "type": "message",
  "from": {
    "id": "'.$IN['TO'].'",
    "name": "Echo Bot"
  },
  "conversation": {
    "id": "'.$IN['CHANNEL'].'"
  },
  "recipient": {
    "id": "'.$IN['CHANNEL'].'",
    "name": "User Name"
  },
  "text": "'.$OUT['MSG'].'",
  "replyToId": "'.$IN['FROM_ID'].'"
}
';

$ch = curl_init($url);                                                                      
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");                                                                     
curl_setopt($ch, CURLOPT_POSTFIELDS, $data_string);                                                                  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);                                                                      
curl_setopt($ch, CURLOPT_HTTPHEADER, array(                                                                          
    'Content-Type: application/json',
	'Authorization: Bearer '.$token['access_token'].'',
    'Content-Length: ' . strlen($data_string))                                                                       
);        

$result = curl_exec($ch); // должен вернуть {"id":"0:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}

<form action="feedback/index.php" method="get" name="form-2" enctype="multipart/form-data">

echo '<pre>';
print_r($_GET);
print_r($_POST);
print_r($_FILES);
echo '</pre>';

DirectoryIndex app.php

<IfModule mod_rewrite.c>
…

echo '<meta http-equiv="refresh" content="0;URL=/shablon.php?'.$_GET.'">';

$_GET = '<script>alert("XSS")</script>';
echo '<meta http-equiv="refresh" content="0;URL=/shablon.php?'.$_GET.'">';