From 9cc8998300448c74644ca72e41e94680ee0a175f Mon Sep 17 00:00:00 2001 From: Martin Zhou <1009465756@qq.com> Date: Sat, 3 Dec 2016 21:42:04 +0800 Subject: [PATCH] =?UTF-8?q?SRCMS=C2=B7=E8=BD=BB=E5=93=8D=E5=BA=94=20V1.8?= =?UTF-8?q?=E6=AD=A3=E5=BC=8F=E7=89=88?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 修复: 1. 后台无法查看生成的工单 2. 前端页面JS远程资源失效问题 3. 前台用户密码修改设计缺陷(Issued By 藏形匿影) 优化: 1. 多处代码提升二次开发可读性 新增: 1. 安全工单模块中动态更新功能 --- .../Admin/Controller/BaseController.class.php | 8 +-- .../Admin/Controller/BlogController.class.php | 8 +-- .../Controller/CategoryController.class.php | 8 +-- .../Controller/CheckController.class.php | 37 ++++++++-- .../Admin/Controller/HallController.class.php | 8 +-- .../Controller/IndexController.class.php | 8 +-- .../Admin/Controller/InfoController.class.php | 8 +-- .../Controller/LoginController.class.php | 8 +-- .../Controller/ManagerController.class.php | 8 +-- .../Controller/MemberController.class.php | 8 +-- .../Controller/OrderController.class.php | 8 +-- .../Admin/Controller/PageController.class.php | 8 +-- .../Admin/Controller/PostController.class.php | 14 ++-- .../Controller/SettingController.class.php | 8 +-- Application/Admin/View/Check/view.html | 72 +++++++++++++++++-- Application/Admin/View/Index/index.html | 18 +---- Application/Admin/View/Post/index.html | 2 +- Application/Admin/View/Post/update.html | 6 -- Application/Admin/View/Public/sidebar.html | 2 +- Application/Common/Conf/config.php | 34 ++++----- .../Home/Controller/BlogController.class.php | 28 +++----- .../Home/Controller/GiftController.class.php | 8 +-- .../Home/Controller/HallController.class.php | 21 +++--- .../Home/Controller/IndexController.class.php | 8 +-- .../Home/Controller/PageController.class.php | 28 +++----- Application/Home/View/Blog/index.html | 16 +---- Application/Home/View/Blog/view.html | 10 +-- Application/Home/View/Gift/index.html | 5 +- Application/Home/View/Hall/index.html | 14 ---- Application/Home/View/Index/index.html | 1 - Application/Home/View/Page/index.html | 28 ++++---- Application/Home/View/Page/view.html | 3 +- .../User/Controller/BaseController.class.php | 8 +-- .../Controller/ChangeController.class.php | 32 +++++---- .../Controller/ForgetController.class.php | 11 +-- .../User/Controller/GiftController.class.php | 8 +-- .../User/Controller/IndexController.class.php | 8 +-- .../User/Controller/InfoController.class.php | 8 +-- .../User/Controller/LoginController.class.php | 8 +-- .../User/Controller/PostController.class.php | 8 +-- .../User/Controller/RegController.class.php | 15 ++-- Application/User/View/Change/index.html | 2 +- Application/User/View/Public/header.html | 7 +- DB/srcms.sql | 54 ++++++++++---- README.md | 38 +++++++--- admin.php | 15 ++-- index.php | 15 ++-- user.php | 17 ++--- 48 files changed, 372 insertions(+), 333 deletions(-) diff --git a/Application/Admin/Controller/BaseController.class.php b/Application/Admin/Controller/BaseController.class.php index ab33760..7fa8ed6 100644 --- a/Application/Admin/Controller/BaseController.class.php +++ b/Application/Admin/Controller/BaseController.class.php @@ -3,10 +3,10 @@ namespace Admin\Controller; use Think\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.5 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ diff --git a/Application/Admin/Controller/BlogController.class.php b/Application/Admin/Controller/BlogController.class.php index 98d6844..969c60d 100644 --- a/Application/Admin/Controller/BlogController.class.php +++ b/Application/Admin/Controller/BlogController.class.php @@ -3,10 +3,10 @@ namespace Admin\Controller; use Admin\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.5 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ /** diff --git a/Application/Admin/Controller/CategoryController.class.php b/Application/Admin/Controller/CategoryController.class.php index f82ab85..38824d7 100644 --- a/Application/Admin/Controller/CategoryController.class.php +++ b/Application/Admin/Controller/CategoryController.class.php @@ -3,10 +3,10 @@ namespace Admin\Controller; use Admin\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.5 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ /** diff --git a/Application/Admin/Controller/CheckController.class.php b/Application/Admin/Controller/CheckController.class.php index a56a8dd..c096f28 100644 --- a/Application/Admin/Controller/CheckController.class.php +++ b/Application/Admin/Controller/CheckController.class.php @@ -3,10 +3,10 @@ namespace Admin\Controller; use Think\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.5 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ class CheckController extends Controller @@ -15,9 +15,34 @@ class CheckController extends Controller * 临时查看漏洞报告 */ public function view(){ - $id = I('get.session_id',0,'intval'); + $id = I('get.session_id',0,'number_int'); //seesion token防注入 $model = M('post')->where('session='.$id)->find(); + $flow = M('wflow')->where('session='.$id)->select(); + $this->assign('wflow',$flow); $this->assign('model',$model); - $this->display(); + $this->display(); + } + /** + * 添加漏洞处理进展 + */ + public function add() + { + //默认显示添加表单 + if (!IS_POST) { + $this->display(); + } + if (IS_POST) { + $model = D("wflow"); + if (!$model->create()) { + $this->error($model->getError()); + exit(); + } else { + if ($model->add()) { + $this->success("添加成功", U('post/index')); + } else { + $this->error("添加失败", U('post/index')); + } + } + } } } diff --git a/Application/Admin/Controller/HallController.class.php b/Application/Admin/Controller/HallController.class.php index c9ef63f..cda2a15 100644 --- a/Application/Admin/Controller/HallController.class.php +++ b/Application/Admin/Controller/HallController.class.php @@ -3,10 +3,10 @@ namespace Admin\Controller; use Admin\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.5 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ /** diff --git a/Application/Admin/Controller/IndexController.class.php b/Application/Admin/Controller/IndexController.class.php index 9102bbb..826db92 100644 --- a/Application/Admin/Controller/IndexController.class.php +++ b/Application/Admin/Controller/IndexController.class.php @@ -3,10 +3,10 @@ namespace Admin\Controller; use Admin\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.5 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ class IndexController extends BaseController{ diff --git a/Application/Admin/Controller/InfoController.class.php b/Application/Admin/Controller/InfoController.class.php index 116fd0c..633e2c8 100644 --- a/Application/Admin/Controller/InfoController.class.php +++ b/Application/Admin/Controller/InfoController.class.php @@ -3,10 +3,10 @@ namespace Admin\Controller; use Admin\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.5 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ /** diff --git a/Application/Admin/Controller/LoginController.class.php b/Application/Admin/Controller/LoginController.class.php index 93b80cf..5e14df8 100644 --- a/Application/Admin/Controller/LoginController.class.php +++ b/Application/Admin/Controller/LoginController.class.php @@ -3,10 +3,10 @@ namespace Admin\Controller; use Think\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.5 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ class LoginController extends Controller { diff --git a/Application/Admin/Controller/ManagerController.class.php b/Application/Admin/Controller/ManagerController.class.php index 61b2ce4..b1ec70e 100644 --- a/Application/Admin/Controller/ManagerController.class.php +++ b/Application/Admin/Controller/ManagerController.class.php @@ -3,10 +3,10 @@ namespace Admin\Controller; use Admin\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/26 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.6 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ /** diff --git a/Application/Admin/Controller/MemberController.class.php b/Application/Admin/Controller/MemberController.class.php index 587367d..df51121 100644 --- a/Application/Admin/Controller/MemberController.class.php +++ b/Application/Admin/Controller/MemberController.class.php @@ -3,10 +3,10 @@ namespace Admin\Controller; use Admin\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.5 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ /** diff --git a/Application/Admin/Controller/OrderController.class.php b/Application/Admin/Controller/OrderController.class.php index ce4baca..5c7d6f9 100644 --- a/Application/Admin/Controller/OrderController.class.php +++ b/Application/Admin/Controller/OrderController.class.php @@ -2,10 +2,10 @@ namespace Admin\Controller; use Admin\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.5 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ /** diff --git a/Application/Admin/Controller/PageController.class.php b/Application/Admin/Controller/PageController.class.php index 18bfc1c..61726e1 100644 --- a/Application/Admin/Controller/PageController.class.php +++ b/Application/Admin/Controller/PageController.class.php @@ -2,10 +2,10 @@ namespace Admin\Controller; use Admin\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.5 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ /** diff --git a/Application/Admin/Controller/PostController.class.php b/Application/Admin/Controller/PostController.class.php index 3cb2cd3..7767af5 100644 --- a/Application/Admin/Controller/PostController.class.php +++ b/Application/Admin/Controller/PostController.class.php @@ -2,10 +2,10 @@ namespace Admin\Controller; use Admin\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.5 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ class PostController extends BaseController @@ -130,10 +130,12 @@ class PostController extends BaseController */ public function session(){ $id = I('get.id',0,'intval'); - $str = '!@#$%^&*abcdefghijklmnopqrstuvwxyz'; - $session = md5($str[rand(0,35)].$str[rand(0,35)].$str[rand(0,35)].$str[rand(0,35)].$str[rand(0,35)].$str[rand(0,35)]); + $str = '1234567890'; + $session = $str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)].$str[rand(0,10)]; + $visible = 1; $model = M('post'); $model->session = $session; + $model->visible = $visible; $result = $model->where('id='.$id)->save(); if($result){ $this->success("授权成功", U('Check/view?session_id='.$session)); diff --git a/Application/Admin/Controller/SettingController.class.php b/Application/Admin/Controller/SettingController.class.php index a70d6a1..146c8d2 100644 --- a/Application/Admin/Controller/SettingController.class.php +++ b/Application/Admin/Controller/SettingController.class.php @@ -3,10 +3,10 @@ namespace Admin\Controller; use Admin\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 - * @copyright 2105-2018 SRCMS - * @homepage http://www.src.pw - * @version 1.5 + * @Author: Zhou Yuyang <1009465756@qq.com> 10:28 2016/12/03 + * @Copyright 2015-2020 SISMO + * @Project homepage https://github.com/CNSISMO + * @Version 1.8 */ /** diff --git a/Application/Admin/View/Check/view.html b/Application/Admin/View/Check/view.html index 39eaba0..06bd540 100644 --- a/Application/Admin/View/Check/view.html +++ b/Application/Admin/View/Check/view.html @@ -4,13 +4,11 @@
#修复建议 / 修补期限: #修复建议 / 修补期限:
#处理进展 / @{$v.time} / 状态变更:
+ {$v.content|htmlspecialchars_decode|waf}
+
+ 注意事项:
@@ -77,5 +122,20 @@