SRCMS·轻响应V1.6正式版

修复外部报告的多个严重安全缺陷
2016-01-26 14:09:59 +08:00
parent e650f04553
commit f46a67c7ec
31 changed files with 924 additions and 114 deletions
--- a/.htaccess
+++ b/.htaccess
@@ -0,0 +1,8 @@
+<IfModule mod_rewrite.c>
+  Options +FollowSymlinks
+  RewriteEngine On
+
+  RewriteCond %{REQUEST_FILENAME} !-d
+  RewriteCond %{REQUEST_FILENAME} !-f
+  RewriteRule ^(.*)$ index.php/$1 [QSA,PT,L]
+</IfModule>
--- a/Application/Admin/Common/function.php
+++ b/Application/Admin/Common/function.php
@@ -1,11 +1,170 @@
 <?php
-//<2F><><EFBFBD>ı<EFBFBD>XSS<53><53><EFBFBD><EFBFBD>
-function waf($arr) 
-{
-     
-   $ra=Array('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/','/<script/i','/javascript:/i','/vbscript:/i','/expression/i','/applet/','/meta/','/xml/','/blink/','/<link/i','/<embed/i','/<object/i','/frame/i','/iframe/i','/layer/','/title/','/bgsound/','/base/','/onload=/i','/onunload=/i','/onchange=/i','/onsubmit=/i','/onreset=/','/onselect=/i','/onblur=/i','/onfocus=/i','/onabort=/i','/onkeydown=/i','/onkeypress=/i','/onkeyup=/i','/onclick=/i','/ondblclick=/i','/onmousedown=/','/onmousemove=/i','/onmouseout=/i','/onmouseover=/i','/onmouseup=/i','/onunload=/i','/alert/i','/<input/i');
-   
-   $value       = preg_replace($ra,'',$arr);     
-   echo $value;
+/**
+ * PHP <20><><EFBFBD>ı<EFBFBD>XSS<53><53><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
+ *
+ * @package XssHtml
+ * @version 1.0.0 
+ * @link http://phith0n.github.io/XssHtml
+ * @since 20140621
+ * @copyright (c) Phithon All Rights Reserved
+ *
+ */
+
+class XssHtml {
+	private $m_dom;
+	private $m_xss;
+	private $m_ok;
+	private $m_AllowAttr = array('title', 'src', 'href', 'id', 'class', 'style', 'width', 'height', 'alt', 'target', 'align');
+	private $m_AllowTag = array('a', 'img', 'br', 'strong', 'b', 'code', 'pre', 'p', 'div', 'em', 'span', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'table', 'ul', 'ol', 'tr', 'th', 'td', 'hr', 'li', 'u');
+
+	/**
+     * <20><><EFBFBD>캯<EFBFBD><ECBAAF>
+     *
+     * @param string $html <20><><EFBFBD><EFBFBD><EFBFBD>˵<EFBFBD><CBB5>ı<EFBFBD>
+     * @param string $charset <20>ı<EFBFBD><C4B1><EFBFBD><EFBFBD>룬Ĭ<EBA3AC><C4AC>utf-8
+     * @param array $AllowTag <20><><EFBFBD><EFBFBD><EFBFBD>ı<EFBFBD>ǩ<EFBFBD><C7A9><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>뱣<EFBFBD><EBB1A3>Ĭ<EFBFBD>ϣ<EFBFBD>Ĭ<EFBFBD><C4AC><EFBFBD>Ѻ<EFBFBD><D1BA>Ǵ󲿷ֹ<F3B2BFB7><D6B9>ܣ<EFBFBD><DCA3><EFBFBD>Ҫ<EFBFBD><D2AA><EFBFBD><EFBFBD>Σ<EFBFBD>ձ<EFBFBD>ǩ
+     */
+	public function __construct($html, $charset = 'utf-8', $AllowTag = array()){
+		$this->m_AllowTag = empty($AllowTag) ? $this->m_AllowTag : $AllowTag;
+		$this->m_xss = strip_tags($html, '<' . implode('><', $this->m_AllowTag) . '>');
+		if (empty($this->m_xss)) {
+			$this->m_ok = FALSE;
+			return ;
+		}
+		$this->m_xss = "<meta http-equiv=\"Content-Type\" content=\"text/html;charset={$charset}\"><nouse>" . $this->m_xss . "</nouse>";
+		$this->m_dom = new DOMDocument();
+		$this->m_dom->strictErrorChecking = FALSE;
+		$this->m_ok = @$this->m_dom->loadHTML($this->m_xss);
+	}
+
+	/**
+     * <20><><EFBFBD>ù<EFBFBD><C3B9>˺<EFBFBD><CBBA><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
+     */
+	public function getHtml()
+	{
+		if (!$this->m_ok) {
+			return '';
+		}
+		$nodeList = $this->m_dom->getElementsByTagName('*');
+		for ($i = 0; $i < $nodeList->length; $i++){
+			$node = $nodeList->item($i);
+			if (in_array($node->nodeName, $this->m_AllowTag)) {
+				if (method_exists($this, "__node_{$node->nodeName}")) {
+					call_user_func(array($this, "__node_{$node->nodeName}"), $node);
+				}else{
+					call_user_func(array($this, '__node_default'), $node);
+				}
+			}
+		}
+		$html = strip_tags($this->m_dom->saveHTML(), '<' . implode('><', $this->m_AllowTag) . '>');
+		$html = preg_replace('/^\n(.*)\n$/s', '$1', $html);
+		return $html;
+	}
+
+	private function __true_url($url){
+		if (preg_match('#^https?://.+#is', $url)) {
+			return $url;
+		}else{
+			return 'http://' . $url;
+		}
+	}
+
+	private function __get_style($node){
+		if ($node->attributes->getNamedItem('style')) {
+			$style = $node->attributes->getNamedItem('style')->nodeValue;
+			$style = str_replace('\\', ' ', $style);
+			$style = str_replace(array('&#', '/*', '*/'), ' ', $style);
+			$style = preg_replace('#e.*x.*p.*r.*e.*s.*s.*i.*o.*n#Uis', ' ', $style);
+			return $style;
+		}else{
+			return '';
+		}
+	}
+
+	private function __get_link($node, $att){
+		$link = $node->attributes->getNamedItem($att);
+		if ($link) {
+			return $this->__true_url($link->nodeValue);
+		}else{
+			return '';
+		}
+	}
+
+	private function __setAttr($dom, $attr, $val){
+		if (!empty($val)) {
+			$dom->setAttribute($attr, $val);
+		}
+	}
+
+	private function __set_default_attr($node, $attr, $default = '')
+	{
+		$o = $node->attributes->getNamedItem($attr);
+		if ($o) {
+			$this->__setAttr($node, $attr, $o->nodeValue);
+		}else{
+			$this->__setAttr($node, $attr, $default);
+		}
+	}
+
+	private function __common_attr($node)
+	{
+		$list = array();
+		foreach ($node->attributes as $attr) {
+			if (!in_array($attr->nodeName, 
+				$this->m_AllowAttr)) {
+				$list[] = $attr->nodeName;
+			}
+		}
+		foreach ($list as $attr) {
+			$node->removeAttribute($attr);
+		}
+		$style = $this->__get_style($node);
+		$this->__setAttr($node, 'style', $style);
+		$this->__set_default_attr($node, 'title');
+		$this->__set_default_attr($node, 'id');
+		$this->__set_default_attr($node, 'class');
+	}
+
+	private function __node_img($node){
+		$this->__common_attr($node);
+
+		$this->__set_default_attr($node, 'src');
+		$this->__set_default_attr($node, 'width');
+		$this->__set_default_attr($node, 'height');
+		$this->__set_default_attr($node, 'alt');
+		$this->__set_default_attr($node, 'align');
+
+	}
+
+	private function __node_a($node){
+		$this->__common_attr($node);
+		$href = $this->__get_link($node, 'href');
+
+		$this->__setAttr($node, 'href', $href);
+		$this->__set_default_attr($node, 'target', '_blank');
+	}
+
+	private function __node_embed($node){
+		$this->__common_attr($node);
+		$link = $this->__get_link($node, 'src');
+
+		$this->__setAttr($node, 'src', $link);
+		$this->__setAttr($node, 'allowscriptaccess', 'never');
+		$this->__set_default_attr($node, 'width');
+		$this->__set_default_attr($node, 'height');
+	}
+
+	private function __node_default($node){
+		$this->__common_attr($node);
+	}
 }
+
+function waf($data) 
+{
+     $xss = new XssHtml($data);
+     $html = $xss->getHtml();
+	 echo $html;
+   
+}
+
 ?>
--- a/Application/Admin/Controller/LoginController.class.php
+++ b/Application/Admin/Controller/LoginController.class.php
@@ -17,7 +17,7 @@ class LoginController extends Controller {
    //登陆验证
    public function login(){
        if(!IS_POST)$this->error("非法请求");
-        $member = M('member');
+        $member = M('manager');
        $username =I('username');
        $password =I('password','','md5');
        $code = I('verify','','strtolower');
@@ -32,12 +32,12 @@ class LoginController extends Controller {
            $this->error('账号或密码错误 :(') ;
        }
        //验证账户是否被禁用
-        if($user['status'] == 0){
-            $this->error('账号被禁用，请联系超级管理员 :(') ;
-        }
-        if($user['type'] == 1){
-            $this->error('您没权限登陆后台 :(') ;
-        }
+        //if($user['status'] == 0){
+            //$this->error('账号被禁用，请联系超级管理员 :(') ;
+        //}
+        //if($user['type'] == 1){
+            //$this->error('您没权限登陆后台 :(') ;
+        //}
        //验证是否为管理员
        //更新登陆信息
        $data =array(
@@ -55,7 +55,7 @@ class LoginController extends Controller {
 			$ip = get_client_ip();
 			$time = date("Y-m-d h:i:sa");
            $con='您好,您的后台管理账户 '.$username.' 于 '.$time.' 被登录，登录IP地址为 '.$ip.' 如果该操作非您本人操作，可能帐号信息已经被泄露，请您及时修改密码。 ';  
-            SendMail('1009465756@qq.com','应急响应中心后台登录提示',$con,'应急响应中心'); 	//使用时注意将1009465756@qq.com修改为您的邮箱帐号
+            SendMail($user['email'],'应急响应中心后台登录提示',$con,'应急响应中心');
            $this->success("登陆成功",U('Index/index'));
        }
        //定向之后台主页
@@ -64,10 +64,10 @@ class LoginController extends Controller {
    }
    //验证码
    public function verify(){
-    	ob_clean();
+		ob_clean();
        $Verify = new \Think\Verify();
-        $Verify->codeSet = '0123456789';
-        $Verify->fontSize = 13;
+        $Verify->codeSet = 'AECDEFGHIGJ123456';
+        $Verify->fontSize = 16;
        $Verify->length = 4;
        $Verify->entry();
    }
@@ -81,4 +81,4 @@ class LoginController extends Controller {
        session('username',null);
        redirect(U('Login/index'));
    }
-}
+}
--- a/Application/Admin/Controller/ManagerController.class.php
+++ b/Application/Admin/Controller/ManagerController.class.php
@@ -0,0 +1,125 @@
+<?php
+namespace Admin\Controller;
+use Admin\Controller;
+
+/**
+ * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/26
+ * @copyright 2105-2018 SRCMS 
+ * @homepage http://www.src.pw
+ * @version 1.6
+ */
+
+/**
+ * 后台用户管理
+ */
+class ManagerController extends BaseController
+{
+    /**
+     * 用户列表
+     * @return [type] [description]
+     */
+    public function index($key="")
+    {
+        if($key == ""){
+            $model = M('manager');  
+        }else{
+            $where['username'] = array('like',"%$key%");
+            $where['email'] = array('like',"%$key%");
+            $where['_logic'] = 'or';
+            $model = M('member')->where($where); 
+        } 
+        
+        $count  = $model->where($where)->count();// 查询满足要求的总记录数
+        $Page = new \Extend\Page($count,15);// 实例化分页类 传入总记录数和每页显示的记录数(25)
+        $show = $Page->show();// 分页显示输出
+        $member = $model->limit($Page->firstRow.','.$Page->listRows)->where($where)->order('id DESC')->select();
+        $this->assign('member', $member);
+        $this->assign('page',$show);
+        $this->display();     
+    }
+
+    /**
+     * 添加用户
+     */
+    public function add()
+    {
+        //默认显示添加表单
+        if (!IS_POST) {
+            $this->display();
+        }
+        if (IS_POST) {
+            //如果用户提交数据
+            $model = D("Manager");
+            if (!$model->field('username,email,password,repassword')->create()) {
+                // 如果创建失败 表示验证没有通过 输出错误提示信息
+                $this->error($model->getError());
+                exit();
+            } else {
+                if ($model->add()) {
+                    $this->success("后台用户添加成功", U('manager/index'));
+                } else {
+                    $this->error("后台用户添加失败");
+                }
+            }
+        }
+    }
+    /**
+     * 更新后台用户信息
+     * @param  [type] $id [管理员ID]
+     * @return [type]     [description]
+     */
+    public function update()
+    {
+        //默认显示添加表单
+        if (!IS_POST) {
+            $model = M('manager')->find(I('id',0,'intval'));
+            $this->assign('model',$model);
+            $this->display();
+        }
+        if (IS_POST) {
+            $model = D("manager");
+            if (!$model->field('username,email,password')->create()) {
+                $this->error($model->getError());
+            }else{
+                //验证密码是否为空   
+                $data = I();
+                unset($data['password']);
+                if(I('password') != ""){
+                    $data['password'] = md5(I('password'));
+                }
+                //更新
+                if ($model->save($data)) {
+                    $this->success("用户信息更新成功", U('manager/index'));
+                } else {
+                    $this->error("未做任何修改,用户信息更新失败");
+                }        
+            }
+        }
+    }
+    /**
+     * 删除后台用户
+     * @param  [type] $id [description]
+     * @return [type]     [description]
+     */
+    public function delete()
+    {
+		$id = I('get.id',0,'intval'); 
+    	if(C('SUPER_ADMIN_ID') == $id) $this->error("超级管理员不可禁用!");
+        $model = M('manager');
+        //查询status字段值
+        $result = $model->find($id);
+        //更新字段
+        $data['id']=$id;
+        if($result['status'] == 1){
+        	$data['status']=0;
+        }
+        if($result['status'] == 0){
+        	$data['status']=1;
+        }
+        if($model->save($data)){
+            $this->success("状态更新成功", U('manager/index'));
+        }else{
+            $this->error("状态更新失败");
+        }
+    }
+}
--- a/Application/Admin/Model/ManagerModel.class.php
+++ b/Application/Admin/Model/ManagerModel.class.php
@@ -0,0 +1,23 @@
+<?php
+namespace Admin\Model;
+use Think\Model;
+class ManagerModel extends Model{
+    protected $_validate = array(
+        array('username','require','请填写用户名！'), //默认情况下用正则进行验证
+        array('email','require','请填写邮箱！'), //默认情况下用正则进行验证
+        array('email','email','邮箱格式错误！'), //默认情况下用正则进行验证
+        array('password','require','请填写密码！','','',self::MODEL_INSERT), //默认情况下用正则进行验证
+     	array('repassword','password','确认密码不正确',0,'confirm'), // 验证确认密码是否和密码一致
+        array('staus',array(0,1),'请勿恶意修改字段',3,'in'), // 当值不为空的时候判断是否在一个范围内
+        array('type',array(1,2),'请勿恶意修改字段',3,'in'), // 当值不为空的时候判断是否在一个范围内
+    );
+
+    protected $_auto = array(
+    	array('password','md5',1,'function') , //添加时用md5函数处理 
+        array('update_at','time',2,'function'), //更新时
+        array('create_at','time',1,'function'), //新增时
+        array('login_ip','get_client_ip',3,'function'), //新增时
+    );
+
+
+}
--- a/Application/Admin/Model/MemberModel.class.php
+++ b/Application/Admin/Model/MemberModel.class.php
@@ -19,7 +19,6 @@ class MemberModel extends Model{
        array('update_at','time',2,'function'), //更新时
        array('create_at','time',1,'function'), //新增时
        array('login_ip','get_client_ip',3,'function'), //新增时
-      //  array('password','',2,'ignore')   //怎么不能用？
    );


--- a/Application/Admin/View/Manager/add.html
+++ b/Application/Admin/View/Manager/add.html
@@ -0,0 +1,28 @@
+<include file="Public/header" title="添加用户" />
+<div id="page-wrapper">
+<form action="{:U('manager/add')}" method="post">
+	<div class="form-group">
+		<label>用户名</label>
+		<input class="form-control" type="text" name="username" placeholder="后台用户名">
+	</div>
+	<div class="form-group">
+		<label>邮箱</label>
+		<input class="form-control" type="text" name="email" placeholder="邮箱">
+	</div>
+	<div class="form-group">
+		<label>密码</label>
+		<input class="form-control" type="password" name="password" placeholder="密码">
+	</div>
+	<div class="form-group">
+		<label>确认密码</label>
+		<input class="form-control" type="password" name="repassword" placeholder="重复密码">
+	</div>
+	<div class="form-group">
+		<button class="btn btn-success" type="submit" >添加</button>
+	</div>
+
+
+</form>
+</div>
+
+<include file="Public/footer" />
--- a/Application/Admin/View/Manager/index.html
+++ b/Application/Admin/View/Manager/index.html
@@ -0,0 +1,48 @@
+<include file="Public/header" title="前台用户管理" />
+<div id="page-wrapper">
+    <div class="row">
+        <div class="col-md-6">
+            <a href="{:U('manager/add')}" class="btn btn-success">添加用户</a>
+        </div>
+        <div class="col-md-6">
+            <form action="{:U('manager/index')}" method="post">
+                <div class="form-group input-group">
+                    <input type="text" class="form-control" name="key" placeholder="输入用户名或者邮箱关键词搜索">
+                    <span class="input-group-btn">
+                      <button class="btn btn-default" type="button"><i class="fa fa-search"></i></button>
+                    </span>
+                </div>
+            </form>
+        </div>
+    </div>
+    
+
+    <table class="table table-hover table-striped">
+        <thead>
+            <tr>
+                <td>编号</td>
+                <td>用户名</td>
+                <td>邮箱</td>
+                <td>创建时间</td>
+                <td>上次登陆</td>
+                <td>登陆IP</td>
+                <td>操作</td>
+            </tr>
+        </thead>
+        <tbody>
+        <foreach name="member" item="v">
+            <tr>
+                <td>{$v.id}</td>
+                <td>{$v.username}</td>
+                <td>{$v.email}</td>
+                <td>{$v.create_at|date="Y/m/d H:i:s",###}</td>
+                <td>{$v.update_at|date="Y/m/d H:i:s",###}</td>
+                <td>{$v.login_ip}</td>
+                <td><a href="{:U('manager/update?id=')}{$v.id}">编辑</a></td>
+            </tr>
+        </foreach>
+        </tbody>
+    </table>
+</div>
+
+<include file="Public/footer" />
--- a/Application/Admin/View/Manager/update.html
+++ b/Application/Admin/View/Manager/update.html
@@ -0,0 +1,25 @@
+<include file="Public/header" title="更新用户" />
+<div id="page-wrapper">
+<form action="{:U('manager/update')}" method="post">
+	<div class="form-group">
+		<label>用户名</label>
+		<input class="form-control" type="text" name="username" value="{$model.username}">
+	</div>
+	<div class="form-group">
+		<label>邮箱</label>
+		<input class="form-control" type="text" name="email" value="{$model.email}">
+	</div>
+	<div class="form-group">
+		<label>新密码</label>
+		<input class="form-control" type="password" name="password" placeholder="不填写则不更改">
+	</div>
+	<div class="form-group">
+		<input type="hidden" name="id" value="{$model.id}">
+		<button class="btn btn-success" type="submit" >更新</button>
+	</div>
+
+
+</form>
+</div>
+
+<include file="Public/footer" />
--- a/Application/Admin/View/Member/add.html
+++ b/Application/Admin/View/Member/add.html
@@ -18,12 +18,18 @@
 		<input class="form-control" type="password" name="repassword" placeholder="repassword">
 	</div>
 	<div class="form-group">
-        <label>用户类型</label>
+        <label>用户等级</label>
        <label class="radio-inline">
-          <input type="radio" name="type" id="type" value="1" checked="checked">前台用户
+          <input type="radio" name="type" id="type" value="1" <if condition="$model.type eq 1">checked="checked"</if>>路人
        </label>
        <label class="radio-inline">
-          <input type="radio" name="type" id="type" value="2">管理员
+          <input type="radio" name="type" id="type" value="2" <if condition="$model.type eq 2">checked="checked"</if>>实习白帽子
+        </label>
+		<label class="radio-inline">
+          <input type="radio" name="type" id="type" value="3" <if condition="$model.type eq 3">checked="checked"</if>>普通白帽子
+        </label>
+        <label class="radio-inline">
+          <input type="radio" name="type" id="type" value="4" <if condition="$model.type eq 4">checked="checked"</if>>核心白帽子
        </label>
    </div>
 	<div class="form-group">
--- a/Application/Admin/View/Member/index.html
+++ b/Application/Admin/View/Member/index.html
@@ -1,4 +1,4 @@
-<include file="Public/header" title="用户列表" />
+<include file="Public/header" title="前台用户管理" />
 <div id="page-wrapper">
    <div class="row">
        <div class="col-md-6">
@@ -41,8 +41,10 @@
                <td>{$v.update_at|date="Y/m/d H:i:s",###}</td>
                <td>{$v.login_ip}</td>
                <td>
-                    <if condition="$v.type eq 1"> <span class="label label-success">会员</span>
-                    <elseif condition="$v.type eq 2"/><span class="label label-danger">管理员</span>
+                    <if condition="$v.type eq 1"> <span class="label label-default">路人</span>
+                    <elseif condition="$v.type eq 2"/><span class="label label-info">实习白帽子</span>
+					<elseif condition="$v.type eq 3"/><span class="label label-success">普通白帽子</span>
+                    <elseif condition="$v.type eq 4"/><span class="label label-danger">核心白帽子</span>
                    </if>
                </td> 
                <td><if condition="$v.status eq 1">正常<else/><span style="color:red">禁用</span></if></td>
--- a/Application/Admin/View/Member/update.html
+++ b/Application/Admin/View/Member/update.html
@@ -14,12 +14,18 @@
 		<input class="form-control" type="password" name="password" placeholder="不填写则不更改">
 	</div>
 	<div class="form-group">
-        <label>用户类型</label>
+        <label>用户等级</label>
        <label class="radio-inline">
-          <input type="radio" name="type" id="type" value="1" <if condition="$model.type eq 1">checked="checked"</if>>前台用户
+          <input type="radio" name="type" id="type" value="1" <if condition="$model.type eq 1">checked="checked"</if>>路人
        </label>
        <label class="radio-inline">
-          <input type="radio" name="type" id="type" value="2" <if condition="$model.type eq 2">checked="checked"</if>>管理员
+          <input type="radio" name="type" id="type" value="2" <if condition="$model.type eq 2">checked="checked"</if>>实习白帽子
+        </label>
+		<label class="radio-inline">
+          <input type="radio" name="type" id="type" value="3" <if condition="$model.type eq 3">checked="checked"</if>>普通白帽子
+        </label>
+        <label class="radio-inline">
+          <input type="radio" name="type" id="type" value="4" <if condition="$model.type eq 4">checked="checked"</if>>核心白帽子
        </label>
    </div>
 	<div class="form-group">
--- a/Application/Admin/View/Post/update.html
+++ b/Application/Admin/View/Post/update.html
@@ -27,7 +27,7 @@
        </div>
 		<div class="form-group">
            <label for="post-content">修复建议</label>
-            <input type="text" name="title" class="form-control" value="{$post.advise}" id="post-title" placeholder="输入修复建议">
+            <input type="text" name="advise" class="form-control" value="{$post.advise}" id="post-title" placeholder="输入修复建议">
        </div>
 		<div class="form-group">
            <label>修补限期</label>
--- a/Application/Admin/View/Public/sidebar.html
+++ b/Application/Admin/View/Public/sidebar.html
@@ -12,9 +12,13 @@
 	<li class="dropdown">
        <a href="{:U('blog/index')}"><i class="fa fa-th-list"></i> 博客管理</a>
    </li>
-    <li class="dropdown">
-        <a href="{:U('member/index')}"><i class="fa fa-users"></i> 用户管理</a>  
-    </li>
+	<li class="dropdown">
+                 <a href="#" class="dropdown-toggle" data-toggle="dropdown" role="button" aria-haspopup="true" aria-expanded="false"><i class="fa fa-users"></i>用户管理<span class="caret"></span></a>
+                  <ul class="dropdown-menu">
+					<li><a href="{:U('member/index')}"><i class="fa fa-tag"></i> 前台用户</a> </li>
+					<li><a href="{:U('manager/index')}"><i class="fa fa-tag"></i> 后台用户</a></li>
+                  </ul>
+                </li>
 	<li class="dropdown">
        <a href="{:U('hall/index')}"><i class="fa fa-star"></i> 贡献榜管理</a>
    </li>
--- a/Application/Common/Conf/config.php
+++ b/Application/Common/Conf/config.php
@@ -14,7 +14,6 @@ return array(
 	'SHOW_ERROR_MSG'        =>  true, 
 	//用户注册默认信息
 	'DEFAULT_SCORE'=>100,
-	//'LOTTERY_NUM'=>3,  //每天最多的抽奖次数
 	'MAIL_ADDRESS'=>'xxxx@126.com', // 此处填写邮箱地址
    'MAIL_SMTP'=>'smtp.126.com', // 邮箱SMTP服务器
    'MAIL_LOGINNAME'=>'xxxxx', // 邮箱登录帐号
--- a/Application/Home/Controller/HallController.class.php
+++ b/Application/Home/Controller/HallController.class.php
@@ -1,7 +1,7 @@
 <?php

 /**
- * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23
+ * @author Zhou Yuyang <1009465756@qq.com> 13:59 2016/1/25
 * @copyright 2105-2018 SRCMS 
 * @homepage http://www.src.pw
 * @version 1.5
@@ -13,7 +13,7 @@ use Think\Controller;

 class HallController extends Controller{

-    public function index()
+     public function index()
    {
       $xuhao = 1;
       $model = M('member');
--- a/Application/User/Common/function.php
+++ b/Application/User/Common/function.php
@@ -1,11 +1,170 @@
 <?php
-//<2F><><EFBFBD>ı<EFBFBD>XSS<53><53><EFBFBD><EFBFBD>
-function waf($arr) 
-{
-     
-   $ra=Array('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/','/<script/i','/javascript:/i','/vbscript:/i','/expression/i','/applet/','/meta/','/xml/','/blink/','/<link/i','/<embed/i','/<object/i','/frame/i','/iframe/i','/layer/','/title/','/bgsound/','/base/','/onload=/i','/onunload=/i','/onchange=/i','/onsubmit=/i','/onreset=/','/onselect=/i','/onblur=/i','/onfocus=/i','/onabort=/i','/onkeydown=/i','/onkeypress=/i','/onkeyup=/i','/onclick=/i','/ondblclick=/i','/onmousedown=/','/onmousemove=/i','/onmouseout=/i','/onmouseover=/i','/onmouseup=/i','/onunload=/i','/alert/i','/<input/i');
-   
-   $value       = preg_replace($ra,'',$arr);     
-   echo $value;
+/**
+ * PHP <20><><EFBFBD>ı<EFBFBD>XSS<53><53><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
+ *
+ * @package XssHtml
+ * @version 1.0.0 
+ * @link http://phith0n.github.io/XssHtml
+ * @since 20140621
+ * @copyright (c) Phithon All Rights Reserved
+ *
+ */
+
+class XssHtml {
+	private $m_dom;
+	private $m_xss;
+	private $m_ok;
+	private $m_AllowAttr = array('title', 'src', 'href', 'id', 'class', 'style', 'width', 'height', 'alt', 'target', 'align');
+	private $m_AllowTag = array('a', 'img', 'br', 'strong', 'b', 'code', 'pre', 'p', 'div', 'em', 'span', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'table', 'ul', 'ol', 'tr', 'th', 'td', 'hr', 'li', 'u');
+
+	/**
+     * <20><><EFBFBD>캯<EFBFBD><ECBAAF>
+     *
+     * @param string $html <20><><EFBFBD><EFBFBD><EFBFBD>˵<EFBFBD><CBB5>ı<EFBFBD>
+     * @param string $charset <20>ı<EFBFBD><C4B1><EFBFBD><EFBFBD>룬Ĭ<EBA3AC><C4AC>utf-8
+     * @param array $AllowTag <20><><EFBFBD><EFBFBD><EFBFBD>ı<EFBFBD>ǩ<EFBFBD><C7A9><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>뱣<EFBFBD><EBB1A3>Ĭ<EFBFBD>ϣ<EFBFBD>Ĭ<EFBFBD><C4AC><EFBFBD>Ѻ<EFBFBD><D1BA>Ǵ󲿷ֹ<F3B2BFB7><D6B9>ܣ<EFBFBD><DCA3><EFBFBD>Ҫ<EFBFBD><D2AA><EFBFBD><EFBFBD>Σ<EFBFBD>ձ<EFBFBD>ǩ
+     */
+	public function __construct($html, $charset = 'utf-8', $AllowTag = array()){
+		$this->m_AllowTag = empty($AllowTag) ? $this->m_AllowTag : $AllowTag;
+		$this->m_xss = strip_tags($html, '<' . implode('><', $this->m_AllowTag) . '>');
+		if (empty($this->m_xss)) {
+			$this->m_ok = FALSE;
+			return ;
+		}
+		$this->m_xss = "<meta http-equiv=\"Content-Type\" content=\"text/html;charset={$charset}\"><nouse>" . $this->m_xss . "</nouse>";
+		$this->m_dom = new DOMDocument();
+		$this->m_dom->strictErrorChecking = FALSE;
+		$this->m_ok = @$this->m_dom->loadHTML($this->m_xss);
+	}
+
+	/**
+     * <20><><EFBFBD>ù<EFBFBD><C3B9>˺<EFBFBD><CBBA><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
+     */
+	public function getHtml()
+	{
+		if (!$this->m_ok) {
+			return '';
+		}
+		$nodeList = $this->m_dom->getElementsByTagName('*');
+		for ($i = 0; $i < $nodeList->length; $i++){
+			$node = $nodeList->item($i);
+			if (in_array($node->nodeName, $this->m_AllowTag)) {
+				if (method_exists($this, "__node_{$node->nodeName}")) {
+					call_user_func(array($this, "__node_{$node->nodeName}"), $node);
+				}else{
+					call_user_func(array($this, '__node_default'), $node);
+				}
+			}
+		}
+		$html = strip_tags($this->m_dom->saveHTML(), '<' . implode('><', $this->m_AllowTag) . '>');
+		$html = preg_replace('/^\n(.*)\n$/s', '$1', $html);
+		return $html;
+	}
+
+	private function __true_url($url){
+		if (preg_match('#^https?://.+#is', $url)) {
+			return $url;
+		}else{
+			return 'http://' . $url;
+		}
+	}
+
+	private function __get_style($node){
+		if ($node->attributes->getNamedItem('style')) {
+			$style = $node->attributes->getNamedItem('style')->nodeValue;
+			$style = str_replace('\\', ' ', $style);
+			$style = str_replace(array('&#', '/*', '*/'), ' ', $style);
+			$style = preg_replace('#e.*x.*p.*r.*e.*s.*s.*i.*o.*n#Uis', ' ', $style);
+			return $style;
+		}else{
+			return '';
+		}
+	}
+
+	private function __get_link($node, $att){
+		$link = $node->attributes->getNamedItem($att);
+		if ($link) {
+			return $this->__true_url($link->nodeValue);
+		}else{
+			return '';
+		}
+	}
+
+	private function __setAttr($dom, $attr, $val){
+		if (!empty($val)) {
+			$dom->setAttribute($attr, $val);
+		}
+	}
+
+	private function __set_default_attr($node, $attr, $default = '')
+	{
+		$o = $node->attributes->getNamedItem($attr);
+		if ($o) {
+			$this->__setAttr($node, $attr, $o->nodeValue);
+		}else{
+			$this->__setAttr($node, $attr, $default);
+		}
+	}
+
+	private function __common_attr($node)
+	{
+		$list = array();
+		foreach ($node->attributes as $attr) {
+			if (!in_array($attr->nodeName, 
+				$this->m_AllowAttr)) {
+				$list[] = $attr->nodeName;
+			}
+		}
+		foreach ($list as $attr) {
+			$node->removeAttribute($attr);
+		}
+		$style = $this->__get_style($node);
+		$this->__setAttr($node, 'style', $style);
+		$this->__set_default_attr($node, 'title');
+		$this->__set_default_attr($node, 'id');
+		$this->__set_default_attr($node, 'class');
+	}
+
+	private function __node_img($node){
+		$this->__common_attr($node);
+
+		$this->__set_default_attr($node, 'src');
+		$this->__set_default_attr($node, 'width');
+		$this->__set_default_attr($node, 'height');
+		$this->__set_default_attr($node, 'alt');
+		$this->__set_default_attr($node, 'align');
+
+	}
+
+	private function __node_a($node){
+		$this->__common_attr($node);
+		$href = $this->__get_link($node, 'href');
+
+		$this->__setAttr($node, 'href', $href);
+		$this->__set_default_attr($node, 'target', '_blank');
+	}
+
+	private function __node_embed($node){
+		$this->__common_attr($node);
+		$link = $this->__get_link($node, 'src');
+
+		$this->__setAttr($node, 'src', $link);
+		$this->__setAttr($node, 'allowscriptaccess', 'never');
+		$this->__set_default_attr($node, 'width');
+		$this->__set_default_attr($node, 'height');
+	}
+
+	private function __node_default($node){
+		$this->__common_attr($node);
+	}
 }
+
+function waf($data) 
+{
+     $xss = new XssHtml($data);
+     $html = $xss->getHtml();
+	 echo $html;
+   
+}
+
 ?>
--- a/Application/User/Controller/GiftController.class.php
+++ b/Application/User/Controller/GiftController.class.php
@@ -40,7 +40,7 @@ class GiftController extends BaseController{
            $model = D("order");
 			$model->user_id = 1;
 			$model->username = 1;
-            if (!$model->create()) {
+            if (!$model->field('username,email,password,repassword,gid')->create()) {
                // 如果创建失败 表示验证没有通过 输出错误提示信息
                $this->error($model->getError());
                exit();
--- a/Application/User/Controller/IndexController.class.php
+++ b/Application/User/Controller/IndexController.class.php
@@ -11,6 +11,7 @@ use Think\Controller;

 class IndexController extends BaseController {
    public function index(){
+		echo waf('111111');
 		$id = session('userId');
 		$tmodel= M('setting');
 		$title = $tmodel->where('id=1')->select();
--- a/Application/User/Controller/InfoController.class.php
+++ b/Application/User/Controller/InfoController.class.php
@@ -3,10 +3,10 @@ namespace User\Controller;
 use Think\Controller;

 /**
- * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23
+ * @author Zhou Yuyang <1009465756@qq.com> 12:21 2016/1/26
 * @copyright 2105-2018 SRCMS 
 * @homepage http://www.src.pw
- * @version 1.5
+ * @version 1.6
 */

 class InfoController extends BaseController{
@@ -35,7 +35,7 @@ class InfoController extends BaseController{
            $model = D("info");
 			$model->user_id = 1;
 			$model->username = 1;
-            if (!$model->create()) {
+            if (!$model->field('realname,zipcode,location,tel,alipay')->create()) {
                // 如果创建失败 表示验证没有通过 输出错误提示信息
                $this->error($model->getError());
                exit();
@@ -67,15 +67,15 @@ class InfoController extends BaseController{
            $model = D("info");
 			$model->user_id = 1;
 			$model->username = 1;
-            if (!$model->create()) {
+            if (!$model->field('realname,zipcode,location,tel,alipay')->create()) {
                // 如果创建失败 表示验证没有通过 输出错误提示信息
                $this->error($model->getError());
                exit();
            } else {
                if ($model->save()) {
-                    $this->success("更新成功", U('info/index'));
+                    $this->success("联系方式更新成功", U('info/index'));
                } else {
-                    $this->error("更新失败");
+                    $this->error("联系方式更新失败");
                }
            }
        }
--- a/Application/User/Controller/LoginController.class.php
+++ b/Application/User/Controller/LoginController.class.php
@@ -59,7 +59,7 @@ class LoginController extends Controller {
 	
 	//验证码
    public function verify(){
-    	ob_clean();
+		ob_clean();
        $Verify = new \Think\Verify();
        $Verify->codeSet = '123456789abcdefg';
        $Verify->fontSize = 16;
@@ -78,4 +78,4 @@ class LoginController extends Controller {
        session('username',null);
        redirect(U('Login/index'));
    }
-}
+}
--- a/Application/User/Controller/PostController.class.php
+++ b/Application/User/Controller/PostController.class.php
@@ -57,7 +57,7 @@ class PostController extends BaseController
            $model = D("Post");
            $model->time = time();
            $model->user_id = 1;
-            if (!$model->create()) {
+            if (!$model->field('title,user_id,cate_id,content')->create()) {
                // 如果创建失败 表示验证没有通过 输出错误提示信息
                $this->error($model->getError());
                exit();
@@ -77,8 +77,8 @@ class PostController extends BaseController
 	public function view(){
 		$id = session('userId');
 		$rid = I('get.rid',0,'intval');
-	        $model = M("Post");
-                $post = $model->where(array('user_id'=>$id,'id'=>$rid))->find();
+	    $model = M("Post");
+        $post = $model->where(array('user_id'=>$id,'id'=>$rid))->find();  //修复越权漏洞
 		$tmodel= M('setting');
 		$title = $tmodel->where('id=1')->select();
 		$this->assign('title', $title);
--- a/Application/User/Controller/RegController.class.php
+++ b/Application/User/Controller/RegController.class.php
@@ -3,10 +3,10 @@ namespace User\Controller;
 use Think\Controller;

 /**
- * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23
+ * @author Zhou Yuyang <1009465756@qq.com> 11:28 2016/1/26
 * @copyright 2105-2018 SRCMS 
 * @homepage http://www.src.pw
- * @version 1.5
+ * @version 1.6
 */


@@ -38,15 +38,15 @@ class RegController extends Controller{
        if (IS_POST) {
            //如果用户提交数据
            $model = D("Member");
-            if (!$model->create()) {
+            if (!$model->field('username,email,password,repassword')->create()) {
                // 如果创建失败 表示验证没有通过 输出错误提示信息
                $this->error($model->getError());
                exit();
            } else {
                if ($model->add()) {
-                    $this->success("用户添加成功", U('index/index'));
+                    $this->success("注册成功", U('index/index'));
                } else {
-                    $this->error("用户添加失败");
+                    $this->error("注册失败");
                }
            }
        }
--- a/Application/User/Controller/xsshtml.class.php
+++ b/Application/User/Controller/xsshtml.class.php
@@ -0,0 +1,187 @@
+<?php
+/**
+ * PHP 富文本XSS过滤类
+ *
+ * @package XssHtml
+ * @version 1.0.0 
+ * @link http://phith0n.github.io/XssHtml
+ * @since 20140621
+ * @copyright (c) Phithon All Rights Reserved
+ *
+ */
+
+#
+# Written by Phithon <root@leavesongs.com> in 2014 and placed in
+# the public domain.
+#
+# phithon <root@leavesongs.com> 编写于20140621
+# From: XDSEC <www.xdsec.org> & 离别歌 <www.leavesongs.com>
+# Usage: 
+# <?php
+# require('xsshtml.class.php');
+# $html = '<html code>';
+# $xss = new XssHtml($html);
+# $html = $xss->getHtml();
+# ?\>
+# 
+# 需求：
+# PHP Version > 5.0
+# 浏览器版本：IE7+ 或其他浏览器，无法防御IE6及以下版本浏览器中的XSS
+# 更多使用选项见 http://phith0n.github.io/XssHtml
+
+class XssHtml {
+	private $m_dom;
+	private $m_xss;
+	private $m_ok;
+	private $m_AllowAttr = array('title', 'src', 'href', 'id', 'class', 'style', 'width', 'height', 'alt', 'target', 'align');
+	private $m_AllowTag = array('a', 'img', 'br', 'strong', 'b', 'code', 'pre', 'p', 'div', 'em', 'span', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'table', 'ul', 'ol', 'tr', 'th', 'td', 'hr', 'li', 'u');
+
+	/**
+     * 构造函数
+     *
+     * @param string $html 待过滤的文本
+     * @param string $charset 文本编码，默认utf-8
+     * @param array $AllowTag 允许的标签，如果不清楚请保持默认，默认已涵盖大部分功能，不要增加危险标签
+     */
+	public function __construct($html, $charset = 'utf-8', $AllowTag = array()){
+		$this->m_AllowTag = empty($AllowTag) ? $this->m_AllowTag : $AllowTag;
+		$this->m_xss = strip_tags($html, '<' . implode('><', $this->m_AllowTag) . '>');
+		if (empty($this->m_xss)) {
+			$this->m_ok = FALSE;
+			return ;
+		}
+		$this->m_xss = "<meta http-equiv=\"Content-Type\" content=\"text/html;charset={$charset}\"><nouse>" . $this->m_xss . "</nouse>";
+		$this->m_dom = new DOMDocument();
+		$this->m_dom->strictErrorChecking = FALSE;
+		$this->m_ok = @$this->m_dom->loadHTML($this->m_xss);
+	}
+
+	/**
+     * 获得过滤后的内容
+     */
+	public function getHtml()
+	{
+		if (!$this->m_ok) {
+			return '';
+		}
+		$nodeList = $this->m_dom->getElementsByTagName('*');
+		for ($i = 0; $i < $nodeList->length; $i++){
+			$node = $nodeList->item($i);
+			if (in_array($node->nodeName, $this->m_AllowTag)) {
+				if (method_exists($this, "__node_{$node->nodeName}")) {
+					call_user_func(array($this, "__node_{$node->nodeName}"), $node);
+				}else{
+					call_user_func(array($this, '__node_default'), $node);
+				}
+			}
+		}
+		$html = strip_tags($this->m_dom->saveHTML(), '<' . implode('><', $this->m_AllowTag) . '>');
+		$html = preg_replace('/^\n(.*)\n$/s', '$1', $html);
+		return $html;
+	}
+
+	private function __true_url($url){
+		if (preg_match('#^https?://.+#is', $url)) {
+			return $url;
+		}else{
+			return 'http://' . $url;
+		}
+	}
+
+	private function __get_style($node){
+		if ($node->attributes->getNamedItem('style')) {
+			$style = $node->attributes->getNamedItem('style')->nodeValue;
+			$style = str_replace('\\', ' ', $style);
+			$style = str_replace(array('&#', '/*', '*/'), ' ', $style);
+			$style = preg_replace('#e.*x.*p.*r.*e.*s.*s.*i.*o.*n#Uis', ' ', $style);
+			return $style;
+		}else{
+			return '';
+		}
+	}
+
+	private function __get_link($node, $att){
+		$link = $node->attributes->getNamedItem($att);
+		if ($link) {
+			return $this->__true_url($link->nodeValue);
+		}else{
+			return '';
+		}
+	}
+
+	private function __setAttr($dom, $attr, $val){
+		if (!empty($val)) {
+			$dom->setAttribute($attr, $val);
+		}
+	}
+
+	private function __set_default_attr($node, $attr, $default = '')
+	{
+		$o = $node->attributes->getNamedItem($attr);
+		if ($o) {
+			$this->__setAttr($node, $attr, $o->nodeValue);
+		}else{
+			$this->__setAttr($node, $attr, $default);
+		}
+	}
+
+	private function __common_attr($node)
+	{
+		$list = array();
+		foreach ($node->attributes as $attr) {
+			if (!in_array($attr->nodeName, 
+				$this->m_AllowAttr)) {
+				$list[] = $attr->nodeName;
+			}
+		}
+		foreach ($list as $attr) {
+			$node->removeAttribute($attr);
+		}
+		$style = $this->__get_style($node);
+		$this->__setAttr($node, 'style', $style);
+		$this->__set_default_attr($node, 'title');
+		$this->__set_default_attr($node, 'id');
+		$this->__set_default_attr($node, 'class');
+	}
+
+	private function __node_img($node){
+		$this->__common_attr($node);
+
+		$this->__set_default_attr($node, 'src');
+		$this->__set_default_attr($node, 'width');
+		$this->__set_default_attr($node, 'height');
+		$this->__set_default_attr($node, 'alt');
+		$this->__set_default_attr($node, 'align');
+
+	}
+
+	private function __node_a($node){
+		$this->__common_attr($node);
+		$href = $this->__get_link($node, 'href');
+
+		$this->__setAttr($node, 'href', $href);
+		$this->__set_default_attr($node, 'target', '_blank');
+	}
+
+	private function __node_embed($node){
+		$this->__common_attr($node);
+		$link = $this->__get_link($node, 'src');
+
+		$this->__setAttr($node, 'src', $link);
+		$this->__setAttr($node, 'allowscriptaccess', 'never');
+		$this->__set_default_attr($node, 'width');
+		$this->__set_default_attr($node, 'height');
+	}
+
+	private function __node_default($node){
+		$this->__common_attr($node);
+	}
+}
+
+// if(php_sapi_name() == "cli"){
+// 	$html = $argv[1];
+// 	$xss = new XssHtml($html);
+// 	$html = $xss->getHtml();
+// 	echo "'$html'";
+// }
+?>
--- a/Application/User/Model/MemberModel.class.php
+++ b/Application/User/Model/MemberModel.class.php
@@ -8,8 +8,8 @@ class MemberModel extends Model{
        array('email','email','邮箱格式错误！'), //默认情况下用正则进行验证
        array('password','require','请填写密码！','','',self::MODEL_INSERT), //默认情况下用正则进行验证
     	array('repassword','password','确认密码不正确',0,'confirm'), // 验证确认密码是否和密码一致
-        array('username','','用户名已存在！',0,'unique',self::MODEL_BOTH), // 在新增的时候验证name字段是否唯一
-        array('email','','邮箱已存在！',0,'unique',self::MODEL_BOTH), // 在新增的时候验证name字段是否唯一
+        array('username','','该用户名已存在',0,'unique',self::MODEL_BOTH), // 在新增的时候验证name字段是否唯一
+        array('email','','该邮箱已存在',0,'unique',self::MODEL_BOTH), // 在新增的时候验证name字段是否唯一
    );

    protected $_auto = array(
--- a/Application/User/View/Reg/index.html
+++ b/Application/User/View/Reg/index.html
@@ -3,40 +3,56 @@
 	<head>
 		<meta http-equiv="content-type" content="text/html; charset=UTF-8">
 		<meta charset="utf-8">
-		<title>应急响应中心</title>
-		<meta name="generator" content="Bootply" />
+		<title><foreach name="title" item="v">{$v.value}</foreach>安全应急响应中心</title>
 		<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
 		<link href="__PUBLIC__/Home/css/bootstrap.min.css" rel="stylesheet">
-		<link href="//netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.min.css" rel="stylesheet">
+		<link href="__PUBLIC__/User/font-awesome/css/font-awesome.css" rel="stylesheet">
+		<link href="__PUBLIC__/Home/index/carousel.css" rel="stylesheet">
 		<!--[if lt IE 9]>
 			<script src="//html5shim.googlecode.com/svn/trunk/html5.js"></script>
 		<![endif]-->
 		<link href="__PUBLIC__/Home/css/styles.css" rel="stylesheet">
 	</head>
-	<body>
-
-<div class="navbar navbar-fixed-top navbar-bold" data-spy="affix" data-offset-top="1000">
-  <div class="container">
-    <div class="navbar-header">
-      <a href="__ROOT__/index.php" class="navbar-brand">应急响应中心</a>
-      <a class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
-        <span class="icon-bar"></span>
-        <span class="icon-bar"></span>
-        <span class="icon-bar"></span>
-      </a>
-    </div>
-    <div class="navbar-collapse collapse" id="navbar">
-      <ul class="nav navbar-nav">
-	    <li><a href="{:U('index/index')}">个人中心</a></li>
-		<!--<li><a href="{:U('post/index')}">漏洞列表</a></li>
-		<li><a href="{:U('post/add')}">报告漏洞</a></li>
-        <li><a href="__ROOT__/index.php?m=&c=page&a=index">公告</a></li>
-        <li><a href="__ROOT__/index.php?m=&c=hall&a=index">贡献榜</a></li>
-		<li><a href="__ROOT__/index.php?m=&c=gift&a=index">礼品库</a></li>-->
-      </ul>
-    </div>
-   </div>
-</div>
+ <body>
+    <nav class="navbar navbar-default navbar-fixed-top">
+      <div class="container">
+        <div class="navbar-header">
+          <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#navbar" aria-expanded="false" aria-controls="navbar">
+            <span class="yahei sr-only">Toggle navigation</span>
+            <span class="yahei icon-bar"></span>
+            <span class="yahei icon-bar"></span>
+            <span class="yaheiicon-bar"></span>
+          </button>
+          <a class="yahei navbar-brand" href="__ROOT__"><strong><foreach name="title" item="v">{$v.value}</foreach></strong>
+          <span class="yahei navbar-brand-subtitle">安全应急响应中心</span>
+          </a>
+        </div>
+        <div id="navbar" class="navbar-collapse collapse">
+              <ul class="yahei nav navbar-nav">
+             <li><a href="{:U('index/index')}">个人中心</a></li>
+			   <li><a href="{:U('post/add')}">报告漏洞</a></li>
+		      <li><a href="{:U('post/index')}">漏洞列表</a></li>
+		      <li><a href="{:U('gift/index')}">礼品兑换</a></li>
+			  <li><a href="{:U('info/index')}">联系方式</a></li>
+              </ul>
+			  <ul class="yahei nav navbar-nav navbar-right">
+			  <li class="dropdown">
+                 <a href="#" class="dropdown-toggle" data-toggle="dropdown" role="button" aria-haspopup="true" aria-expanded="false"><?php echo session('username')?><span class="caret"></span></a>
+                  <ul class="dropdown-menu">
+                    <!--<li><a href="#">Action</a></li>
+                    <li><a href="#">更改密码</a></li>
+                    <li><a href="#">Something else here</a></li>
+                    <li role="separator" class="divider"></li>
+                    <li class="dropdown-header">Nav header</li>-->
+					<li><a href="{:U('change/index')}">更改密码</a></li>
+                    <li><a href="{:U('login/logout')}">退出登录</a></li>
+                  </ul>
+                </li>
+              </ul>
+            </div>
+        </div><!--/.navbar-collapse -->
+      </div>
+    </nav>

 <div class="gallery">
   <div class="row">
--- a/DB/srcms.sql
+++ b/DB/srcms.sql
@@ -3,7 +3,7 @@
 -- http://www.phpmyadmin.net
 --
 -- 主机: localhost
-- 生成日期: 2016 年 01 月 24 日 10:47
+-- 生成日期: 2016 年 01 月 26 日 14:02
 -- 服务器版本: 5.5.40
 -- PHP 版本: 5.3.29

@@ -124,7 +124,7 @@ CREATE TABLE IF NOT EXISTS `info` (

 INSERT INTO `info` (`user_id`, `username`, `realname`, `location`, `tel`, `zipcode`, `alipay`) VALUES
 (1, 'admin', '周三&lt;input&gt;', '北京市百度科技大厦', '15176528910', '10092@', ''),
-(2, 'martin', '王二', '江苏', '18712345612', '214000', '1009465@qq.com');
+(2, 'admin2', '王二', '江苏', '18712345612', '214000', '1009465@qq.com');

 -- --------------------------------------------------------

@@ -152,6 +152,30 @@ INSERT INTO `links` (`id`, `title`, `url`, `sort`) VALUES

 -- --------------------------------------------------------

+--
+-- 表的结构 `manager`
+--
+
+CREATE TABLE IF NOT EXISTS `manager` (
+  `id` int(2) NOT NULL AUTO_INCREMENT,
+  `username` varchar(20) NOT NULL,
+  `email` varchar(100) NOT NULL,
+  `password` varchar(32) NOT NULL,
+  `login_ip` varchar(20) NOT NULL,
+  `create_at` varchar(11) NOT NULL,
+  `update_at` varchar(11) NOT NULL,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB  DEFAULT CHARSET=utf8 AUTO_INCREMENT=2 ;
+
+--
+-- 转存表中的数据 `manager`
+--
+
+INSERT INTO `manager` (`id`, `username`, `email`, `password`, `login_ip`, `create_at`, `update_at`) VALUES
+(1, 'admin', '100946575@qq.com', '21232f297a57a5a743894a0e4a801fc3', '0.0.0.0', '1453778451', '1453787197');
+
+-- --------------------------------------------------------
+
 --
 -- 表的结构 `member`
 --
@@ -171,15 +195,7 @@ CREATE TABLE IF NOT EXISTS `member` (
  PRIMARY KEY (`id`),
  KEY `username` (`username`) USING BTREE,
  KEY `password` (`password`) USING BTREE
-) ENGINE=InnoDB  DEFAULT CHARSET=utf8 AUTO_INCREMENT=3 ;
-
--
-- 转存表中的数据 `member`
--
-
-INSERT INTO `member` (`id`, `username`, `email`, `password`, `avatar`, `create_at`, `update_at`, `login_ip`, `status`, `type`, `jifen`) VALUES
-(1, 'admin', '1009465756@qq.com', '21232f297a57a5a743894a0e4a801fc3', NULL, '1436679338', '1453600331', '0.0.0.0', 1, 2, 0),
-(2, 'martin', '1009465756@qq.com', '21232f297a57a5a743894a0e4a801fc3', NULL, '1438016593', '1453552900', '0.0.0.0', 1, 1, 105);
+) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;

 -- --------------------------------------------------------

@@ -243,14 +259,7 @@ CREATE TABLE IF NOT EXISTS `post` (
  PRIMARY KEY (`id`),
  KEY `cate_id` (`cate_id`),
  KEY `user_id` (`user_id`)
-) ENGINE=InnoDB  DEFAULT CHARSET=utf8 AUTO_INCREMENT=2 ;
-
--
-- 转存表中的数据 `post`
--
-
-INSERT INTO `post` (`id`, `session`, `title`, `content`, `advise`, `time`, `day`, `cate_id`, `user_id`, `rank`, `type`) VALUES
-(1, '04b9c8e7ed9989c', '示例漏洞报告', '&lt;p&gt;这里是示例漏洞报告的内~容。&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;http://localhost/dev/Public/Home/images/unknow.jpeg&quot;/&gt;&lt;/p&gt;', '建议过滤特殊字符', '1438043542', 4, 2, 2, 2, 4);
+) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;

 -- --------------------------------------------------------

--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# 欢迎使用SRCMS·轻响应框架 V1.5正式版
+# 欢迎使用SRCMS·轻响应框架 V1.6正式版
 **SRCMS**是专门为中小企业和互联网产品创业团队打造的应急响应中心网站建站框架。有了它，如今你可以像使用办公软件一样容易，为你的企业建立起美观完备的安全应急响应中心
 > * **项目维护:** Martin Zhou
 > * **E-Mail**:1009465756@qq.com
@@ -24,6 +24,12 @@

 ---
 ##版本更新日志
+#####2016-01-26
+* **修复** 三处严重的前台个人中心安全问题(Issued By phithon)
+* **修复** 富文本过滤不严格的问题(Issued By mramydnei)
+* **修复** 后台漏洞审核BUG
+* **修复** 关闭开发模式，防止报错显示敏感信息
+
 #####2016-01-24
 * **新增** 新版首页：简洁、大方、更为灵活，方便您建立有自己特色的安全应急响应中心
 * **新增** 新版前台个人中心：支持支付宝账号的录入
--- a/admin.php
+++ b/admin.php
@@ -18,7 +18,7 @@ if(version_compare(PHP_VERSION,'5.3.0','<'))  die('require PHP > 5.3.0 !');
 define('BIND_MODULE','Admin');

 // 开启调试模式 建议开发阶段开启 部署阶段注释或者设为false
-define('APP_DEBUG',True);
+define('APP_DEBUG',False);

 // 定义应用目录
 define('APP_PATH','./Application/');
--- a/index.php
+++ b/index.php
@@ -20,7 +20,7 @@ if(version_compare(PHP_VERSION,'5.3.0','<'))  die('require PHP > 5.3.0 !');
 define('BIND_MODULE','Home');

 // 开启调试模式 建议开发阶段开启 部署阶段注释或者设为false
-define('APP_DEBUG',True);
+define('APP_DEBUG',False);

 // 定义应用目录
 define('APP_PATH','./Application/');
--- a/user.php
+++ b/user.php
@@ -20,7 +20,7 @@ if(version_compare(PHP_VERSION,'5.3.0','<'))  die('require PHP > 5.3.0 !');
 define('BIND_MODULE','User');

 // 开启调试模式 建议开发阶段开启 部署阶段注释或者设为false
-define('APP_DEBUG',True);
+define('APP_DEBUG',False);

 // 定义应用目录
 define('APP_PATH','./Application/');