From 3f830d2cee30f1335ba7b388f8c19376757852b9 Mon Sep 17 00:00:00 2001 From: Martin Zhou <1009465756@qq.com> Date: Fri, 2 Dec 2016 12:24:27 +0800 Subject: [PATCH] =?UTF-8?q?SRCMS=C2=B7=E8=BD=BB=E5=93=8D=E5=BA=94=20V1.7?= =?UTF-8?q?=E6=AD=A3=E5=BC=8F=E7=89=88?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 修复 1. 前台验证码刷新无效问题 2. 前台用户在后台管理界面密码修改逻辑缺陷 3. 前台用户上传附件越权查看漏洞 新增: 1. 用户密码存储加盐 --- .../Controller/LoginController.class.php | 7 +- .../Controller/MemberController.class.php | 7 +- .../Controller/OrderController.class.php | 46 ++++- .../Admin/Controller/PostController.class.php | 1 - Application/Admin/Model/MemberModel.class.php | 2 - .../Admin/Model/PostViewModel.class.php | 2 +- Application/Admin/View/Check/view.html | 8 +- Application/Admin/View/Index/index.html | 26 ++- Application/Admin/View/Order/index.html | 4 +- Application/Admin/View/Order/jifen.html | 18 ++ Application/Admin/View/Order/update.html | 66 +++++++ Application/Admin/View/Post/index.html | 2 +- Application/Admin/View/Post/update.html | 6 + Application/Admin/View/Public/footer.html | 9 +- Application/Admin/View/Public/header.html | 4 +- Application/Admin/View/Public/sidebar.html | 4 +- Application/Admin/View/Setting/index.html | 1 - .../Home/Controller/HallController.class.php | 2 +- .../Home/Controller/PostController.class.php | 49 +++++ Application/Home/View/Blog/index.html | 18 +- Application/Home/View/Blog/view.html | 18 +- Application/Home/View/Gift/index.html | 18 +- Application/Home/View/Hall/index.html | 5 +- Application/Home/View/Index/index.html | 38 +--- Application/Home/View/Page/index.html | 5 +- Application/Home/View/Page/view.html | 18 +- Application/Home/View/Post/index.html | 75 ++++++++ Application/Home/View/Post/view.html | 86 +++++++++ .../Home/2a94b8bda04ff446dcedd42276fc99ee.php | 176 ++++++++++++++++++ .../User/63cae4db13549785c8d2f557008ad9dc.php | 45 +++++ .../User/75853594bae9aad973428536ebdf8f6d.php | 125 +++++++++++++ .../User/91abf6e2f8336b1f62da52353bbf3815.php | 106 +++++++++++ .../User/cd7f950d5de11f03979102b93709231a.php | 110 +++++++++++ .../User/d7a7632f153cf12d0db44c934c28bcfe.php | 163 ++++++++++++++++ .../Runtime/Data/_fields/srcms.hall.php | 1 + .../Runtime/Data/_fields/srcms.links.php | 1 + .../Runtime/Data/_fields/srcms.member.php | 1 + .../Runtime/Data/_fields/srcms.post.php | 1 + .../Runtime/Data/_fields/srcms.setting.php | 1 + Application/Runtime/common~runtime.php | 1 + .../Controller/ForgetController.class.php | 23 ++- .../User/Controller/GiftController.class.php | 2 +- .../User/Controller/IndexController.class.php | 3 +- .../User/Controller/LoginController.class.php | 18 +- .../User/Controller/RegController.class.php | 72 ++++++- Application/User/View/Change/index.html | 3 +- Application/User/View/Forget/index.html | 82 ++++---- Application/User/View/Gift/add.html | 2 +- Application/User/View/Index/index.html | 3 +- Application/User/View/Login/index.html | 2 +- Application/User/View/Post/add.html | 2 +- Application/User/View/Public/footer.html | 2 +- Application/User/View/Public/header.html | 3 - Application/User/View/Reg/index.html | 54 +++--- DB/srcms.sql | 47 +++-- Public/Home/images/iphone.jpg | Bin 0 -> 3517 bytes Public/Home/js/jquery.min.js | 6 + admin.php | 2 +- 58 files changed, 1359 insertions(+), 243 deletions(-) create mode 100644 Application/Admin/View/Order/jifen.html create mode 100644 Application/Admin/View/Order/update.html create mode 100644 Application/Home/Controller/PostController.class.php create mode 100644 Application/Home/View/Post/index.html create mode 100644 Application/Home/View/Post/view.html create mode 100644 Application/Runtime/Cache/Home/2a94b8bda04ff446dcedd42276fc99ee.php create mode 100644 Application/Runtime/Cache/User/63cae4db13549785c8d2f557008ad9dc.php create mode 100644 Application/Runtime/Cache/User/75853594bae9aad973428536ebdf8f6d.php create mode 100644 Application/Runtime/Cache/User/91abf6e2f8336b1f62da52353bbf3815.php create mode 100644 Application/Runtime/Cache/User/cd7f950d5de11f03979102b93709231a.php create mode 100644 Application/Runtime/Cache/User/d7a7632f153cf12d0db44c934c28bcfe.php create mode 100644 Application/Runtime/Data/_fields/srcms.hall.php create mode 100644 Application/Runtime/Data/_fields/srcms.links.php create mode 100644 Application/Runtime/Data/_fields/srcms.member.php create mode 100644 Application/Runtime/Data/_fields/srcms.post.php create mode 100644 Application/Runtime/Data/_fields/srcms.setting.php create mode 100644 Application/Runtime/common~runtime.php create mode 100644 Public/Home/images/iphone.jpg create mode 100644 Public/Home/js/jquery.min.js diff --git a/Application/Admin/Controller/LoginController.class.php b/Application/Admin/Controller/LoginController.class.php index 43aa27a..93b80cf 100644 --- a/Application/Admin/Controller/LoginController.class.php +++ b/Application/Admin/Controller/LoginController.class.php @@ -49,9 +49,10 @@ class LoginController extends Controller { //如果数据更新成功 跳转到后台主页 if($member->save($data)){ session('adminId',$user['id']); - session('username',$user['username']); + session('adminname',$user['username']); //发送验证码邮件 - import('ORG.Net.Mail'); + //import('ORG.Net.Mail'); + require "./././././ThinkPHP/Library/Org/Net/Mail.class.php"; $ip = get_client_ip(); $time = date("Y-m-d h:i:sa"); $con='您好,您的后台管理账户 '.$username.' 于 '.$time.' 被登录,登录IP地址为 '.$ip.' 如果该操作非您本人操作,可能帐号信息已经被泄露,请您及时修改密码。 '; @@ -78,7 +79,7 @@ class LoginController extends Controller { public function logout(){ session('adminId',null); - session('username',null); + session('adminname',null); redirect(U('Login/index')); } } \ No newline at end of file diff --git a/Application/Admin/Controller/MemberController.class.php b/Application/Admin/Controller/MemberController.class.php index 5471296..587367d 100644 --- a/Application/Admin/Controller/MemberController.class.php +++ b/Application/Admin/Controller/MemberController.class.php @@ -78,6 +78,7 @@ class MemberController extends BaseController } if (IS_POST) { $model = D("Member"); + $user = M('member')->find(I('id')); if (!$model->create()) { $this->error($model->getError()); }else{ @@ -85,17 +86,17 @@ class MemberController extends BaseController $data = I(); unset($data['password']); if(I('password') != ""){ - $data['password'] = md5(I('password')); + $data['password'] = md5(md5(md5($user['salt']).md5(I('password'))."SR")."CMS"); } //强制更改超级管理员用户类型 if(C('SUPER_ADMIN_ID') == I('id')){ - $data['type'] = 2; + $data['type'] = 1; } //更新 if ($model->save($data)) { $this->success("用户信息更新成功", U('member/index')); } else { - $this->error("未做任何修改,用户信息更新失败"); + $this->error("用户信息更新失败"); } } } diff --git a/Application/Admin/Controller/OrderController.class.php b/Application/Admin/Controller/OrderController.class.php index c80d15b..ce4baca 100644 --- a/Application/Admin/Controller/OrderController.class.php +++ b/Application/Admin/Controller/OrderController.class.php @@ -36,16 +36,58 @@ class OrderController extends BaseController $this->assign('page',$show); $this->display(); } + + public function update() + { + $id = I('get.id',0,'intval'); + //默认显示添加表单 + if (!IS_POST) { + $model = M('order')->where('id='.$id)->find(); + $this->assign('model',$model); + $this->display(); + } + if (IS_POST) { + $model = D("order"); + if (!$model->create()) { + $this->error($model->getError()); + }else{ + if ($model->save()) { + $this->success("更新成功", U('order/index')); + } else { + $this->error("更新失败"); + } + } + } + } public function delete() { $id = I('get.id',0,'intval'); $model = M('order'); - $result = $model->where("user_id=".$id)->delete(); + $result = $model->where("id=".$id)->delete(); if($result){ - $this->success("删除成功", U('info/index')); + $this->success("删除成功", U('order/index')); }else{ $this->error("删除失败"); } } + + /** + * 添加积分 + * @param [type] $id [description] + * @return [type] [description] + */ + public function jifen() + { + $user_id = I('post.user_id',0,'intval'); + $amount = I('post.amount',0,'intval'); + $model = M('member'); + $result = $model->where('id='.$user_id)->where('jifen>0')->setDec('jifen',$amount); + if($result){ + $this->success("扣除积分成功", U('post/index')); + }else{ + $this->error("扣除积分失败:余额不足"); + } + } + } diff --git a/Application/Admin/Controller/PostController.class.php b/Application/Admin/Controller/PostController.class.php index 838c263..3cb2cd3 100644 --- a/Application/Admin/Controller/PostController.class.php +++ b/Application/Admin/Controller/PostController.class.php @@ -125,7 +125,6 @@ class PostController extends BaseController } } - /** * 生成session key */ diff --git a/Application/Admin/Model/MemberModel.class.php b/Application/Admin/Model/MemberModel.class.php index 28375c8..e43154b 100644 --- a/Application/Admin/Model/MemberModel.class.php +++ b/Application/Admin/Model/MemberModel.class.php @@ -10,8 +10,6 @@ class MemberModel extends Model{ array('repassword','password','确认密码不正确',0,'confirm'), // 验证确认密码是否和密码一致 array('username','','用户名已存在!',0,'unique',self::MODEL_BOTH), // 在新增的时候验证name字段是否唯一 array('email','','邮箱已存在!',0,'unique',self::MODEL_BOTH), // 在新增的时候验证name字段是否唯一 - array('staus',array(0,1),'请勿恶意修改字段',3,'in'), // 当值不为空的时候判断是否在一个范围内 - array('type',array(1,2),'请勿恶意修改字段',3,'in'), // 当值不为空的时候判断是否在一个范围内 ); protected $_auto = array( diff --git a/Application/Admin/Model/PostViewModel.class.php b/Application/Admin/Model/PostViewModel.class.php index c01141c..6ce6778 100644 --- a/Application/Admin/Model/PostViewModel.class.php +++ b/Application/Admin/Model/PostViewModel.class.php @@ -3,7 +3,7 @@ namespace Admin\Model; use Think\Model\ViewModel; class PostViewModel extends ViewModel { public $viewFields = array( - 'post'=>array('id','session','title','content','user_id','cate_id','time','type'), + 'post'=>array('id','session','title','content','user_id','cate_id','time','type','visible'), 'category'=>array('name'=>'category_name','title'=>'category_title', '_on'=>'post.cate_id=category.id'), 'member'=>array('username', '_on'=>'post.user_id=member.id'), ); diff --git a/Application/Admin/View/Check/view.html b/Application/Admin/View/Check/view.html index bf807df..39eaba0 100644 --- a/Application/Admin/View/Check/view.html +++ b/Application/Admin/View/Check/view.html @@ -6,12 +6,12 @@