diff --git a/.htaccess b/.htaccess new file mode 100644 index 0000000..929995c --- /dev/null +++ b/.htaccess @@ -0,0 +1,8 @@ + + Options +FollowSymlinks + RewriteEngine On + + RewriteCond %{REQUEST_FILENAME} !-d + RewriteCond %{REQUEST_FILENAME} !-f + RewriteRule ^(.*)$ index.php/$1 [QSA,PT,L] + \ No newline at end of file diff --git a/Application/Admin/Common/function.php b/Application/Admin/Common/function.php index a8733eb..d0f75d2 100644 --- a/Application/Admin/Common/function.php +++ b/Application/Admin/Common/function.php @@ -1,11 +1,170 @@ m_AllowTag = empty($AllowTag) ? $this->m_AllowTag : $AllowTag; + $this->m_xss = strip_tags($html, '<' . implode('><', $this->m_AllowTag) . '>'); + if (empty($this->m_xss)) { + $this->m_ok = FALSE; + return ; + } + $this->m_xss = "" . $this->m_xss . ""; + $this->m_dom = new DOMDocument(); + $this->m_dom->strictErrorChecking = FALSE; + $this->m_ok = @$this->m_dom->loadHTML($this->m_xss); + } + + /** + * 获得过滤后的内容 + */ + public function getHtml() + { + if (!$this->m_ok) { + return ''; + } + $nodeList = $this->m_dom->getElementsByTagName('*'); + for ($i = 0; $i < $nodeList->length; $i++){ + $node = $nodeList->item($i); + if (in_array($node->nodeName, $this->m_AllowTag)) { + if (method_exists($this, "__node_{$node->nodeName}")) { + call_user_func(array($this, "__node_{$node->nodeName}"), $node); + }else{ + call_user_func(array($this, '__node_default'), $node); + } + } + } + $html = strip_tags($this->m_dom->saveHTML(), '<' . implode('><', $this->m_AllowTag) . '>'); + $html = preg_replace('/^\n(.*)\n$/s', '$1', $html); + return $html; + } + + private function __true_url($url){ + if (preg_match('#^https?://.+#is', $url)) { + return $url; + }else{ + return 'http://' . $url; + } + } + + private function __get_style($node){ + if ($node->attributes->getNamedItem('style')) { + $style = $node->attributes->getNamedItem('style')->nodeValue; + $style = str_replace('\\', ' ', $style); + $style = str_replace(array('&#', '/*', '*/'), ' ', $style); + $style = preg_replace('#e.*x.*p.*r.*e.*s.*s.*i.*o.*n#Uis', ' ', $style); + return $style; + }else{ + return ''; + } + } + + private function __get_link($node, $att){ + $link = $node->attributes->getNamedItem($att); + if ($link) { + return $this->__true_url($link->nodeValue); + }else{ + return ''; + } + } + + private function __setAttr($dom, $attr, $val){ + if (!empty($val)) { + $dom->setAttribute($attr, $val); + } + } + + private function __set_default_attr($node, $attr, $default = '') + { + $o = $node->attributes->getNamedItem($attr); + if ($o) { + $this->__setAttr($node, $attr, $o->nodeValue); + }else{ + $this->__setAttr($node, $attr, $default); + } + } + + private function __common_attr($node) + { + $list = array(); + foreach ($node->attributes as $attr) { + if (!in_array($attr->nodeName, + $this->m_AllowAttr)) { + $list[] = $attr->nodeName; + } + } + foreach ($list as $attr) { + $node->removeAttribute($attr); + } + $style = $this->__get_style($node); + $this->__setAttr($node, 'style', $style); + $this->__set_default_attr($node, 'title'); + $this->__set_default_attr($node, 'id'); + $this->__set_default_attr($node, 'class'); + } + + private function __node_img($node){ + $this->__common_attr($node); + + $this->__set_default_attr($node, 'src'); + $this->__set_default_attr($node, 'width'); + $this->__set_default_attr($node, 'height'); + $this->__set_default_attr($node, 'alt'); + $this->__set_default_attr($node, 'align'); + + } + + private function __node_a($node){ + $this->__common_attr($node); + $href = $this->__get_link($node, 'href'); + + $this->__setAttr($node, 'href', $href); + $this->__set_default_attr($node, 'target', '_blank'); + } + + private function __node_embed($node){ + $this->__common_attr($node); + $link = $this->__get_link($node, 'src'); + + $this->__setAttr($node, 'src', $link); + $this->__setAttr($node, 'allowscriptaccess', 'never'); + $this->__set_default_attr($node, 'width'); + $this->__set_default_attr($node, 'height'); + } + + private function __node_default($node){ + $this->__common_attr($node); + } } + +function waf($data) +{ + $xss = new XssHtml($data); + $html = $xss->getHtml(); + echo $html; + +} + ?> \ No newline at end of file diff --git a/Application/Admin/Controller/LoginController.class.php b/Application/Admin/Controller/LoginController.class.php index 4df8e42..43aa27a 100644 --- a/Application/Admin/Controller/LoginController.class.php +++ b/Application/Admin/Controller/LoginController.class.php @@ -17,7 +17,7 @@ class LoginController extends Controller { //鐧婚檰楠岃瘉 public function login(){ if(!IS_POST)$this->error("闈炴硶璇锋眰"); - $member = M('member'); + $member = M('manager'); $username =I('username'); $password =I('password','','md5'); $code = I('verify','','strtolower'); @@ -32,12 +32,12 @@ class LoginController extends Controller { $this->error('璐﹀彿鎴栧瘑鐮侀敊璇 :(') ; } //楠岃瘉璐︽埛鏄惁琚鐢 - if($user['status'] == 0){ - $this->error('璐﹀彿琚鐢紝璇疯仈绯昏秴绾х鐞嗗憳 :(') ; - } - if($user['type'] == 1){ - $this->error('鎮ㄦ病鏉冮檺鐧婚檰鍚庡彴 :(') ; - } + //if($user['status'] == 0){ + //$this->error('璐﹀彿琚鐢紝璇疯仈绯昏秴绾х鐞嗗憳 :(') ; + //} + //if($user['type'] == 1){ + //$this->error('鎮ㄦ病鏉冮檺鐧婚檰鍚庡彴 :(') ; + //} //楠岃瘉鏄惁涓虹鐞嗗憳 //鏇存柊鐧婚檰淇℃伅 $data =array( @@ -55,7 +55,7 @@ class LoginController extends Controller { $ip = get_client_ip(); $time = date("Y-m-d h:i:sa"); $con='鎮ㄥソ,鎮ㄧ殑鍚庡彴绠＄悊璐︽埛 '.$username.' 浜 '.$time.' 琚櫥褰曪紝鐧诲綍IP鍦板潃涓 '.$ip.' 濡傛灉璇ユ搷浣滈潪鎮ㄦ湰浜烘搷浣滐紝鍙兘甯愬彿淇℃伅宸茬粡琚硠闇诧紝璇锋偍鍙婃椂淇敼瀵嗙爜銆 '; - SendMail('1009465756@qq.com','搴旀ュ搷搴斾腑蹇冨悗鍙扮櫥褰曟彁绀',$con,'搴旀ュ搷搴斾腑蹇'); //浣跨敤鏃舵敞鎰忓皢1009465756@qq.com淇敼涓烘偍鐨勯偖绠卞笎鍙 + SendMail($user['email'],'搴旀ュ搷搴斾腑蹇冨悗鍙扮櫥褰曟彁绀',$con,'搴旀ュ搷搴斾腑蹇'); $this->success("鐧婚檰鎴愬姛",U('Index/index')); } //瀹氬悜涔嬪悗鍙颁富椤 @@ -64,10 +64,10 @@ class LoginController extends Controller { } //楠岃瘉鐮 public function verify(){ - ob_clean(); + ob_clean(); $Verify = new \Think\Verify(); - $Verify->codeSet = '0123456789'; - $Verify->fontSize = 13; + $Verify->codeSet = 'AECDEFGHIGJ123456'; + $Verify->fontSize = 16; $Verify->length = 4; $Verify->entry(); } @@ -81,4 +81,4 @@ class LoginController extends Controller { session('username',null); redirect(U('Login/index')); } -} +} \ No newline at end of file diff --git a/Application/Admin/Controller/ManagerController.class.php b/Application/Admin/Controller/ManagerController.class.php new file mode 100644 index 0000000..61b2ce4 --- /dev/null +++ b/Application/Admin/Controller/ManagerController.class.php @@ -0,0 +1,125 @@ + 12:28 2016/1/26 + * @copyright 2105-2018 SRCMS + * @homepage http://www.src.pw + * @version 1.6 + */ + +/** + * 鍚庡彴鐢ㄦ埛绠＄悊 + */ +class ManagerController extends BaseController +{ + /** + * 鐢ㄦ埛鍒楄〃 + * @return [type] [description] + */ + public function index($key="") + { + if($key == ""){ + $model = M('manager'); + }else{ + $where['username'] = array('like',"%$key%"); + $where['email'] = array('like',"%$key%"); + $where['_logic'] = 'or'; + $model = M('member')->where($where); + } + + $count = $model->where($where)->count();// 鏌ヨ婊¤冻瑕佹眰鐨勬昏褰曟暟 + $Page = new \Extend\Page($count,15);// 瀹炰緥鍖栧垎椤电被 浼犲叆鎬昏褰曟暟鍜屾瘡椤垫樉绀虹殑璁板綍鏁(25) + $show = $Page->show();// 鍒嗛〉鏄剧ず杈撳嚭 + $member = $model->limit($Page->firstRow.','.$Page->listRows)->where($where)->order('id DESC')->select(); + $this->assign('member', $member); + $this->assign('page',$show); + $this->display(); + } + + /** + * 娣诲姞鐢ㄦ埛 + */ + public function add() + { + //榛樿鏄剧ず娣诲姞琛ㄥ崟 + if (!IS_POST) { + $this->display(); + } + if (IS_POST) { + //濡傛灉鐢ㄦ埛鎻愪氦鏁版嵁 + $model = D("Manager"); + if (!$model->field('username,email,password,repassword')->create()) { + // 濡傛灉鍒涘缓澶辫触 琛ㄧず楠岃瘉娌℃湁閫氳繃 杈撳嚭閿欒鎻愮ず淇℃伅 + $this->error($model->getError()); + exit(); + } else { + if ($model->add()) { + $this->success("鍚庡彴鐢ㄦ埛娣诲姞鎴愬姛", U('manager/index')); + } else { + $this->error("鍚庡彴鐢ㄦ埛娣诲姞澶辫触"); + } + } + } + } + /** + * 鏇存柊鍚庡彴鐢ㄦ埛淇℃伅 + * @param [type] $id [绠＄悊鍛業D] + * @return [type] [description] + */ + public function update() + { + //榛樿鏄剧ず娣诲姞琛ㄥ崟 + if (!IS_POST) { + $model = M('manager')->find(I('id',0,'intval')); + $this->assign('model',$model); + $this->display(); + } + if (IS_POST) { + $model = D("manager"); + if (!$model->field('username,email,password')->create()) { + $this->error($model->getError()); + }else{ + //楠岃瘉瀵嗙爜鏄惁涓虹┖ + $data = I(); + unset($data['password']); + if(I('password') != ""){ + $data['password'] = md5(I('password')); + } + //鏇存柊 + if ($model->save($data)) { + $this->success("鐢ㄦ埛淇℃伅鏇存柊鎴愬姛", U('manager/index')); + } else { + $this->error("鏈仛浠讳綍淇敼,鐢ㄦ埛淇℃伅鏇存柊澶辫触"); + } + } + } + } + /** + * 鍒犻櫎鍚庡彴鐢ㄦ埛 + * @param [type] $id [description] + * @return [type] [description] + */ + public function delete() + { + $id = I('get.id',0,'intval'); + if(C('SUPER_ADMIN_ID') == $id) $this->error("瓒呯骇绠＄悊鍛樹笉鍙鐢!"); + $model = M('manager'); + //鏌ヨstatus瀛楁鍊 + $result = $model->find($id); + //鏇存柊瀛楁 + $data['id']=$id; + if($result['status'] == 1){ + $data['status']=0; + } + if($result['status'] == 0){ + $data['status']=1; + } + if($model->save($data)){ + $this->success("鐘舵佹洿鏂版垚鍔", U('manager/index')); + }else{ + $this->error("鐘舵佹洿鏂板け璐"); + } + } +} diff --git a/Application/Admin/Model/ManagerModel.class.php b/Application/Admin/Model/ManagerModel.class.php new file mode 100644 index 0000000..2891158 --- /dev/null +++ b/Application/Admin/Model/ManagerModel.class.php @@ -0,0 +1,23 @@ + +
+
+
+ + +
+
+ + +
+
+ + +
+
+ + +
+
+ +
+ + +
+
+ + diff --git a/Application/Admin/View/Manager/index.html b/Application/Admin/View/Manager/index.html new file mode 100644 index 0000000..ce2008f --- /dev/null +++ b/Application/Admin/View/Manager/index.html @@ -0,0 +1,48 @@ + +
+
+
+ 娣诲姞鐢ㄦ埛 +
+
+
+
+ + + + +
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + +
缂栧彿鐢ㄦ埛鍚閭鍒涘缓鏃堕棿涓婃鐧婚檰鐧婚檰IP鎿嶄綔
{$v.id}{$v.username}{$v.email}{$v.create_at|date="Y/m/d H:i:s",###}{$v.update_at|date="Y/m/d H:i:s",###}{$v.login_ip}缂栬緫
+
+ + \ No newline at end of file diff --git a/Application/Admin/View/Manager/update.html b/Application/Admin/View/Manager/update.html new file mode 100644 index 0000000..e5fdddd --- /dev/null +++ b/Application/Admin/View/Manager/update.html @@ -0,0 +1,25 @@ + +
+
+
+ + +
+
+ + +
+
+ + +
+
+ + +
+ + +
+
+ + \ No newline at end of file diff --git a/Application/Admin/View/Member/add.html b/Application/Admin/View/Member/add.html index f4d8354..65b2af5 100644 --- a/Application/Admin/View/Member/add.html +++ b/Application/Admin/View/Member/add.html @@ -18,12 +18,18 @@
- + + +
diff --git a/Application/Admin/View/Member/index.html b/Application/Admin/View/Member/index.html index 971cd47..5e6e96c 100644 --- a/Application/Admin/View/Member/index.html +++ b/Application/Admin/View/Member/index.html @@ -1,4 +1,4 @@ - +
@@ -41,8 +41,10 @@ {$v.update_at|date="Y/m/d H:i:s",###} {$v.login_ip} - 浼氬憳 - 绠＄悊鍛 + 璺汉 + 瀹炰範鐧藉附瀛 + 鏅氱櫧甯藉瓙 + 鏍稿績鐧藉附瀛 姝ｅ父绂佺敤 diff --git a/Application/Admin/View/Member/update.html b/Application/Admin/View/Member/update.html index ec6a437..35028a8 100644 --- a/Application/Admin/View/Member/update.html +++ b/Application/Admin/View/Member/update.html @@ -14,12 +14,18 @@
- + + +
diff --git a/Application/Admin/View/Post/update.html b/Application/Admin/View/Post/update.html index 9c59652..c3bcd79 100644 --- a/Application/Admin/View/Post/update.html +++ b/Application/Admin/View/Post/update.html @@ -27,7 +27,7 @@
- +
diff --git a/Application/Admin/View/Public/sidebar.html b/Application/Admin/View/Public/sidebar.html index 5f1dae6..0678c52 100644 --- a/Application/Admin/View/Public/sidebar.html +++ b/Application/Admin/View/Public/sidebar.html @@ -12,9 +12,13 @@
  • 鍗氬绠＄悊
    • -
  • - 鐢ㄦ埛绠＄悊 -
    • +
  • + + +
  • 璐＄尞姒滅鐞
    • diff --git a/Application/Common/Conf/config.php b/Application/Common/Conf/config.php index 80f2ec3..8959683 100644 --- a/Application/Common/Conf/config.php +++ b/Application/Common/Conf/config.php @@ -14,7 +14,6 @@ return array( 'SHOW_ERROR_MSG' => true, //鐢ㄦ埛娉ㄥ唽榛樿淇℃伅 'DEFAULT_SCORE'=>100, - //'LOTTERY_NUM'=>3, //姣忓ぉ鏈澶氱殑鎶藉娆℃暟 'MAIL_ADDRESS'=>'xxxx@126.com', // 姝ゅ濉啓閭鍦板潃 'MAIL_SMTP'=>'smtp.126.com', // 閭SMTP鏈嶅姟鍣 'MAIL_LOGINNAME'=>'xxxxx', // 閭鐧诲綍甯愬彿 diff --git a/Application/Home/Controller/HallController.class.php b/Application/Home/Controller/HallController.class.php index 5b9d9b5..e6fbd3c 100644 --- a/Application/Home/Controller/HallController.class.php +++ b/Application/Home/Controller/HallController.class.php @@ -1,7 +1,7 @@ 12:28 2016/1/23 + * @author Zhou Yuyang <1009465756@qq.com> 13:59 2016/1/25 * @copyright 2105-2018 SRCMS * @homepage http://www.src.pw * @version 1.5 @@ -13,7 +13,7 @@ use Think\Controller; class HallController extends Controller{ - public function index() + public function index() { $xuhao = 1; $model = M('member'); diff --git a/Application/User/Common/function.php b/Application/User/Common/function.php index a8733eb..d0f75d2 100644 --- a/Application/User/Common/function.php +++ b/Application/User/Common/function.php @@ -1,11 +1,170 @@ m_AllowTag = empty($AllowTag) ? $this->m_AllowTag : $AllowTag; + $this->m_xss = strip_tags($html, '<' . implode('><', $this->m_AllowTag) . '>'); + if (empty($this->m_xss)) { + $this->m_ok = FALSE; + return ; + } + $this->m_xss = "" . $this->m_xss . ""; + $this->m_dom = new DOMDocument(); + $this->m_dom->strictErrorChecking = FALSE; + $this->m_ok = @$this->m_dom->loadHTML($this->m_xss); + } + + /** + * 获得过滤后的内容 + */ + public function getHtml() + { + if (!$this->m_ok) { + return ''; + } + $nodeList = $this->m_dom->getElementsByTagName('*'); + for ($i = 0; $i < $nodeList->length; $i++){ + $node = $nodeList->item($i); + if (in_array($node->nodeName, $this->m_AllowTag)) { + if (method_exists($this, "__node_{$node->nodeName}")) { + call_user_func(array($this, "__node_{$node->nodeName}"), $node); + }else{ + call_user_func(array($this, '__node_default'), $node); + } + } + } + $html = strip_tags($this->m_dom->saveHTML(), '<' . implode('><', $this->m_AllowTag) . '>'); + $html = preg_replace('/^\n(.*)\n$/s', '$1', $html); + return $html; + } + + private function __true_url($url){ + if (preg_match('#^https?://.+#is', $url)) { + return $url; + }else{ + return 'http://' . $url; + } + } + + private function __get_style($node){ + if ($node->attributes->getNamedItem('style')) { + $style = $node->attributes->getNamedItem('style')->nodeValue; + $style = str_replace('\\', ' ', $style); + $style = str_replace(array('&#', '/*', '*/'), ' ', $style); + $style = preg_replace('#e.*x.*p.*r.*e.*s.*s.*i.*o.*n#Uis', ' ', $style); + return $style; + }else{ + return ''; + } + } + + private function __get_link($node, $att){ + $link = $node->attributes->getNamedItem($att); + if ($link) { + return $this->__true_url($link->nodeValue); + }else{ + return ''; + } + } + + private function __setAttr($dom, $attr, $val){ + if (!empty($val)) { + $dom->setAttribute($attr, $val); + } + } + + private function __set_default_attr($node, $attr, $default = '') + { + $o = $node->attributes->getNamedItem($attr); + if ($o) { + $this->__setAttr($node, $attr, $o->nodeValue); + }else{ + $this->__setAttr($node, $attr, $default); + } + } + + private function __common_attr($node) + { + $list = array(); + foreach ($node->attributes as $attr) { + if (!in_array($attr->nodeName, + $this->m_AllowAttr)) { + $list[] = $attr->nodeName; + } + } + foreach ($list as $attr) { + $node->removeAttribute($attr); + } + $style = $this->__get_style($node); + $this->__setAttr($node, 'style', $style); + $this->__set_default_attr($node, 'title'); + $this->__set_default_attr($node, 'id'); + $this->__set_default_attr($node, 'class'); + } + + private function __node_img($node){ + $this->__common_attr($node); + + $this->__set_default_attr($node, 'src'); + $this->__set_default_attr($node, 'width'); + $this->__set_default_attr($node, 'height'); + $this->__set_default_attr($node, 'alt'); + $this->__set_default_attr($node, 'align'); + + } + + private function __node_a($node){ + $this->__common_attr($node); + $href = $this->__get_link($node, 'href'); + + $this->__setAttr($node, 'href', $href); + $this->__set_default_attr($node, 'target', '_blank'); + } + + private function __node_embed($node){ + $this->__common_attr($node); + $link = $this->__get_link($node, 'src'); + + $this->__setAttr($node, 'src', $link); + $this->__setAttr($node, 'allowscriptaccess', 'never'); + $this->__set_default_attr($node, 'width'); + $this->__set_default_attr($node, 'height'); + } + + private function __node_default($node){ + $this->__common_attr($node); + } } + +function waf($data) +{ + $xss = new XssHtml($data); + $html = $xss->getHtml(); + echo $html; + +} + ?> \ No newline at end of file diff --git a/Application/User/Controller/GiftController.class.php b/Application/User/Controller/GiftController.class.php index c7f7f69..f591bd0 100644 --- a/Application/User/Controller/GiftController.class.php +++ b/Application/User/Controller/GiftController.class.php @@ -40,7 +40,7 @@ class GiftController extends BaseController{ $model = D("order"); $model->user_id = 1; $model->username = 1; - if (!$model->create()) { + if (!$model->field('username,email,password,repassword,gid')->create()) { // 濡傛灉鍒涘缓澶辫触 琛ㄧず楠岃瘉娌℃湁閫氳繃 杈撳嚭閿欒鎻愮ず淇℃伅 $this->error($model->getError()); exit(); diff --git a/Application/User/Controller/IndexController.class.php b/Application/User/Controller/IndexController.class.php index 6b8c5e9..17848fd 100644 --- a/Application/User/Controller/IndexController.class.php +++ b/Application/User/Controller/IndexController.class.php @@ -11,6 +11,7 @@ use Think\Controller; class IndexController extends BaseController { public function index(){ + echo waf('111111'); $id = session('userId'); $tmodel= M('setting'); $title = $tmodel->where('id=1')->select(); diff --git a/Application/User/Controller/InfoController.class.php b/Application/User/Controller/InfoController.class.php index 9a86c4e..f47199f 100644 --- a/Application/User/Controller/InfoController.class.php +++ b/Application/User/Controller/InfoController.class.php @@ -3,10 +3,10 @@ namespace User\Controller; use Think\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 + * @author Zhou Yuyang <1009465756@qq.com> 12:21 2016/1/26 * @copyright 2105-2018 SRCMS * @homepage http://www.src.pw - * @version 1.5 + * @version 1.6 */ class InfoController extends BaseController{ @@ -35,7 +35,7 @@ class InfoController extends BaseController{ $model = D("info"); $model->user_id = 1; $model->username = 1; - if (!$model->create()) { + if (!$model->field('realname,zipcode,location,tel,alipay')->create()) { // 濡傛灉鍒涘缓澶辫触 琛ㄧず楠岃瘉娌℃湁閫氳繃 杈撳嚭閿欒鎻愮ず淇℃伅 $this->error($model->getError()); exit(); @@ -67,15 +67,15 @@ class InfoController extends BaseController{ $model = D("info"); $model->user_id = 1; $model->username = 1; - if (!$model->create()) { + if (!$model->field('realname,zipcode,location,tel,alipay')->create()) { // 濡傛灉鍒涘缓澶辫触 琛ㄧず楠岃瘉娌℃湁閫氳繃 杈撳嚭閿欒鎻愮ず淇℃伅 $this->error($model->getError()); exit(); } else { if ($model->save()) { - $this->success("鏇存柊鎴愬姛", U('info/index')); + $this->success("鑱旂郴鏂瑰紡鏇存柊鎴愬姛", U('info/index')); } else { - $this->error("鏇存柊澶辫触"); + $this->error("鑱旂郴鏂瑰紡鏇存柊澶辫触"); } } } diff --git a/Application/User/Controller/LoginController.class.php b/Application/User/Controller/LoginController.class.php index 20ebeb4..11df61e 100644 --- a/Application/User/Controller/LoginController.class.php +++ b/Application/User/Controller/LoginController.class.php @@ -59,7 +59,7 @@ class LoginController extends Controller { //楠岃瘉鐮 public function verify(){ - ob_clean(); + ob_clean(); $Verify = new \Think\Verify(); $Verify->codeSet = '123456789abcdefg'; $Verify->fontSize = 16; @@ -78,4 +78,4 @@ class LoginController extends Controller { session('username',null); redirect(U('Login/index')); } -} +} \ No newline at end of file diff --git a/Application/User/Controller/PostController.class.php b/Application/User/Controller/PostController.class.php index 2c2968b..7580743 100644 --- a/Application/User/Controller/PostController.class.php +++ b/Application/User/Controller/PostController.class.php @@ -57,7 +57,7 @@ class PostController extends BaseController $model = D("Post"); $model->time = time(); $model->user_id = 1; - if (!$model->create()) { + if (!$model->field('title,user_id,cate_id,content')->create()) { // 濡傛灉鍒涘缓澶辫触 琛ㄧず楠岃瘉娌℃湁閫氳繃 杈撳嚭閿欒鎻愮ず淇℃伅 $this->error($model->getError()); exit(); @@ -77,8 +77,8 @@ class PostController extends BaseController public function view(){ $id = session('userId'); $rid = I('get.rid',0,'intval'); - $model = M("Post"); - $post = $model->where(array('user_id'=>$id,'id'=>$rid))->find(); + $model = M("Post"); + $post = $model->where(array('user_id'=>$id,'id'=>$rid))->find(); //淇瓒婃潈婕忔礊 $tmodel= M('setting'); $title = $tmodel->where('id=1')->select(); $this->assign('title', $title); diff --git a/Application/User/Controller/RegController.class.php b/Application/User/Controller/RegController.class.php index fdbd147..f64a107 100644 --- a/Application/User/Controller/RegController.class.php +++ b/Application/User/Controller/RegController.class.php @@ -3,10 +3,10 @@ namespace User\Controller; use Think\Controller; /** - * @author Zhou Yuyang <1009465756@qq.com> 12:28 2016/1/23 + * @author Zhou Yuyang <1009465756@qq.com> 11:28 2016/1/26 * @copyright 2105-2018 SRCMS * @homepage http://www.src.pw - * @version 1.5 + * @version 1.6 */ @@ -38,15 +38,15 @@ class RegController extends Controller{ if (IS_POST) { //濡傛灉鐢ㄦ埛鎻愪氦鏁版嵁 $model = D("Member"); - if (!$model->create()) { + if (!$model->field('username,email,password,repassword')->create()) { // 濡傛灉鍒涘缓澶辫触 琛ㄧず楠岃瘉娌℃湁閫氳繃 杈撳嚭閿欒鎻愮ず淇℃伅 $this->error($model->getError()); exit(); } else { if ($model->add()) { - $this->success("鐢ㄦ埛娣诲姞鎴愬姛", U('index/index')); + $this->success("娉ㄥ唽鎴愬姛", U('index/index')); } else { - $this->error("鐢ㄦ埛娣诲姞澶辫触"); + $this->error("娉ㄥ唽澶辫触"); } } } diff --git a/Application/User/Controller/xsshtml.class.php b/Application/User/Controller/xsshtml.class.php new file mode 100644 index 0000000..57cbb10 --- /dev/null +++ b/Application/User/Controller/xsshtml.class.php @@ -0,0 +1,187 @@ + in 2014 and placed in +# the public domain. +# +# phithon 缂栧啓浜20140621 +# From: XDSEC & 绂诲埆姝 +# Usage: +# '; +# $xss = new XssHtml($html); +# $html = $xss->getHtml(); +# ?\> +# +# 闇姹傦細 +# PHP Version > 5.0 +# 娴忚鍣ㄧ増鏈細IE7+ 鎴栧叾浠栨祻瑙堝櫒锛屾棤娉曢槻寰E6鍙婁互涓嬬増鏈祻瑙堝櫒涓殑XSS +# 鏇村浣跨敤閫夐」瑙 http://phith0n.github.io/XssHtml + +class XssHtml { + private $m_dom; + private $m_xss; + private $m_ok; + private $m_AllowAttr = array('title', 'src', 'href', 'id', 'class', 'style', 'width', 'height', 'alt', 'target', 'align'); + private $m_AllowTag = array('a', 'img', 'br', 'strong', 'b', 'code', 'pre', 'p', 'div', 'em', 'span', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'table', 'ul', 'ol', 'tr', 'th', 'td', 'hr', 'li', 'u'); + + /** + * 鏋勯犲嚱鏁 + * + * @param string $html 寰呰繃婊ょ殑鏂囨湰 + * @param string $charset 鏂囨湰缂栫爜锛岄粯璁tf-8 + * @param array $AllowTag 鍏佽鐨勬爣绛撅紝濡傛灉涓嶆竻妤氳淇濇寔榛樿锛岄粯璁ゅ凡娑电洊澶ч儴鍒嗗姛鑳斤紝涓嶈澧炲姞鍗遍櫓鏍囩 + */ + public function __construct($html, $charset = 'utf-8', $AllowTag = array()){ + $this->m_AllowTag = empty($AllowTag) ? $this->m_AllowTag : $AllowTag; + $this->m_xss = strip_tags($html, '<' . implode('><', $this->m_AllowTag) . '>'); + if (empty($this->m_xss)) { + $this->m_ok = FALSE; + return ; + } + $this->m_xss = "" . $this->m_xss . ""; + $this->m_dom = new DOMDocument(); + $this->m_dom->strictErrorChecking = FALSE; + $this->m_ok = @$this->m_dom->loadHTML($this->m_xss); + } + + /** + * 鑾峰緱杩囨护鍚庣殑鍐呭 + */ + public function getHtml() + { + if (!$this->m_ok) { + return ''; + } + $nodeList = $this->m_dom->getElementsByTagName('*'); + for ($i = 0; $i < $nodeList->length; $i++){ + $node = $nodeList->item($i); + if (in_array($node->nodeName, $this->m_AllowTag)) { + if (method_exists($this, "__node_{$node->nodeName}")) { + call_user_func(array($this, "__node_{$node->nodeName}"), $node); + }else{ + call_user_func(array($this, '__node_default'), $node); + } + } + } + $html = strip_tags($this->m_dom->saveHTML(), '<' . implode('><', $this->m_AllowTag) . '>'); + $html = preg_replace('/^\n(.*)\n$/s', '$1', $html); + return $html; + } + + private function __true_url($url){ + if (preg_match('#^https?://.+#is', $url)) { + return $url; + }else{ + return 'http://' . $url; + } + } + + private function __get_style($node){ + if ($node->attributes->getNamedItem('style')) { + $style = $node->attributes->getNamedItem('style')->nodeValue; + $style = str_replace('\\', ' ', $style); + $style = str_replace(array('&#', '/*', '*/'), ' ', $style); + $style = preg_replace('#e.*x.*p.*r.*e.*s.*s.*i.*o.*n#Uis', ' ', $style); + return $style; + }else{ + return ''; + } + } + + private function __get_link($node, $att){ + $link = $node->attributes->getNamedItem($att); + if ($link) { + return $this->__true_url($link->nodeValue); + }else{ + return ''; + } + } + + private function __setAttr($dom, $attr, $val){ + if (!empty($val)) { + $dom->setAttribute($attr, $val); + } + } + + private function __set_default_attr($node, $attr, $default = '') + { + $o = $node->attributes->getNamedItem($attr); + if ($o) { + $this->__setAttr($node, $attr, $o->nodeValue); + }else{ + $this->__setAttr($node, $attr, $default); + } + } + + private function __common_attr($node) + { + $list = array(); + foreach ($node->attributes as $attr) { + if (!in_array($attr->nodeName, + $this->m_AllowAttr)) { + $list[] = $attr->nodeName; + } + } + foreach ($list as $attr) { + $node->removeAttribute($attr); + } + $style = $this->__get_style($node); + $this->__setAttr($node, 'style', $style); + $this->__set_default_attr($node, 'title'); + $this->__set_default_attr($node, 'id'); + $this->__set_default_attr($node, 'class'); + } + + private function __node_img($node){ + $this->__common_attr($node); + + $this->__set_default_attr($node, 'src'); + $this->__set_default_attr($node, 'width'); + $this->__set_default_attr($node, 'height'); + $this->__set_default_attr($node, 'alt'); + $this->__set_default_attr($node, 'align'); + + } + + private function __node_a($node){ + $this->__common_attr($node); + $href = $this->__get_link($node, 'href'); + + $this->__setAttr($node, 'href', $href); + $this->__set_default_attr($node, 'target', '_blank'); + } + + private function __node_embed($node){ + $this->__common_attr($node); + $link = $this->__get_link($node, 'src'); + + $this->__setAttr($node, 'src', $link); + $this->__setAttr($node, 'allowscriptaccess', 'never'); + $this->__set_default_attr($node, 'width'); + $this->__set_default_attr($node, 'height'); + } + + private function __node_default($node){ + $this->__common_attr($node); + } +} + +// if(php_sapi_name() == "cli"){ +// $html = $argv[1]; +// $xss = new XssHtml($html); +// $html = $xss->getHtml(); +// echo "'$html'"; +// } +?> \ No newline at end of file diff --git a/Application/User/Model/MemberModel.class.php b/Application/User/Model/MemberModel.class.php index 9530519..236683d 100644 --- a/Application/User/Model/MemberModel.class.php +++ b/Application/User/Model/MemberModel.class.php @@ -8,8 +8,8 @@ class MemberModel extends Model{ array('email','email','閭鏍煎紡閿欒锛'), //榛樿鎯呭喌涓嬬敤姝ｅ垯杩涜楠岃瘉 array('password','require','璇峰～鍐欏瘑鐮侊紒','','',self::MODEL_INSERT), //榛樿鎯呭喌涓嬬敤姝ｅ垯杩涜楠岃瘉 array('repassword','password','纭瀵嗙爜涓嶆纭',0,'confirm'), // 楠岃瘉纭瀵嗙爜鏄惁鍜屽瘑鐮佷竴鑷 - array('username','','鐢ㄦ埛鍚嶅凡瀛樺湪锛',0,'unique',self::MODEL_BOTH), // 鍦ㄦ柊澧炵殑鏃跺欓獙璇乶ame瀛楁鏄惁鍞竴 - array('email','','閭宸插瓨鍦紒',0,'unique',self::MODEL_BOTH), // 鍦ㄦ柊澧炵殑鏃跺欓獙璇乶ame瀛楁鏄惁鍞竴 + array('username','','璇ョ敤鎴峰悕宸插瓨鍦',0,'unique',self::MODEL_BOTH), // 鍦ㄦ柊澧炵殑鏃跺欓獙璇乶ame瀛楁鏄惁鍞竴 + array('email','','璇ラ偖绠卞凡瀛樺湪',0,'unique',self::MODEL_BOTH), // 鍦ㄦ柊澧炵殑鏃跺欓獙璇乶ame瀛楁鏄惁鍞竴 ); protected $_auto = array( diff --git a/Application/User/View/Reg/index.html b/Application/User/View/Reg/index.html index 885e771..7d25d7e 100644 --- a/Application/User/View/Reg/index.html +++ b/Application/User/View/Reg/index.html @@ -3,40 +3,56 @@ - 搴旀ュ搷搴斾腑蹇 - + <foreach name="title" item="v">{$v.value}</foreach>瀹夊叏搴旀ュ搷搴斾腑蹇 - + + - - -
    -
    -
    - 搴旀ュ搷搴斾腑蹇 - - - - - -
    - -
    -
    + +
    +
    diff --git a/DB/srcms.sql b/DB/srcms.sql index 21a7bc4..224ffad 100644 --- a/DB/srcms.sql +++ b/DB/srcms.sql @@ -3,7 +3,7 @@ -- http://www.phpmyadmin.net -- -- 涓绘満: localhost --- 鐢熸垚鏃ユ湡: 2016 骞 01 鏈 24 鏃 10:47 +-- 鐢熸垚鏃ユ湡: 2016 骞 01 鏈 26 鏃 14:02 -- 鏈嶅姟鍣ㄧ増鏈: 5.5.40 -- PHP 鐗堟湰: 5.3.29 @@ -124,7 +124,7 @@ CREATE TABLE IF NOT EXISTS `info` ( INSERT INTO `info` (`user_id`, `username`, `realname`, `location`, `tel`, `zipcode`, `alipay`) VALUES (1, 'admin', '鍛ㄤ笁<input>', '鍖椾含甯傜櫨搴︾鎶澶у帵', '15176528910', '10092@', ''), -(2, 'martin', '鐜嬩簩', '姹熻嫃', '18712345612', '214000', '1009465@qq.com'); +(2, 'admin2', '鐜嬩簩', '姹熻嫃', '18712345612', '214000', '1009465@qq.com'); -- -------------------------------------------------------- @@ -152,6 +152,30 @@ INSERT INTO `links` (`id`, `title`, `url`, `sort`) VALUES -- -------------------------------------------------------- +-- +-- 琛ㄧ殑缁撴瀯 `manager` +-- + +CREATE TABLE IF NOT EXISTS `manager` ( + `id` int(2) NOT NULL AUTO_INCREMENT, + `username` varchar(20) NOT NULL, + `email` varchar(100) NOT NULL, + `password` varchar(32) NOT NULL, + `login_ip` varchar(20) NOT NULL, + `create_at` varchar(11) NOT NULL, + `update_at` varchar(11) NOT NULL, + PRIMARY KEY (`id`) +) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=2 ; + +-- +-- 杞瓨琛ㄤ腑鐨勬暟鎹 `manager` +-- + +INSERT INTO `manager` (`id`, `username`, `email`, `password`, `login_ip`, `create_at`, `update_at`) VALUES +(1, 'admin', '100946575@qq.com', '21232f297a57a5a743894a0e4a801fc3', '0.0.0.0', '1453778451', '1453787197'); + +-- -------------------------------------------------------- + -- -- 琛ㄧ殑缁撴瀯 `member` -- @@ -171,15 +195,7 @@ CREATE TABLE IF NOT EXISTS `member` ( PRIMARY KEY (`id`), KEY `username` (`username`) USING BTREE, KEY `password` (`password`) USING BTREE -) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=3 ; - --- --- 杞瓨琛ㄤ腑鐨勬暟鎹 `member` --- - -INSERT INTO `member` (`id`, `username`, `email`, `password`, `avatar`, `create_at`, `update_at`, `login_ip`, `status`, `type`, `jifen`) VALUES -(1, 'admin', '1009465756@qq.com', '21232f297a57a5a743894a0e4a801fc3', NULL, '1436679338', '1453600331', '0.0.0.0', 1, 2, 0), -(2, 'martin', '1009465756@qq.com', '21232f297a57a5a743894a0e4a801fc3', NULL, '1438016593', '1453552900', '0.0.0.0', 1, 1, 105); +) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ; -- -------------------------------------------------------- @@ -243,14 +259,7 @@ CREATE TABLE IF NOT EXISTS `post` ( PRIMARY KEY (`id`), KEY `cate_id` (`cate_id`), KEY `user_id` (`user_id`) -) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=2 ; - --- --- 杞瓨琛ㄤ腑鐨勬暟鎹 `post` --- - -INSERT INTO `post` (`id`, `session`, `title`, `content`, `advise`, `time`, `day`, `cate_id`, `user_id`, `rank`, `type`) VALUES -(1, '04b9c8e7ed9989c', '绀轰緥婕忔礊鎶ュ憡', '<p>杩欓噷鏄ず渚嬫紡娲炴姤鍛婄殑鍐厏瀹广</p><p><img src="http://localhost/dev/Public/Home/images/unknow.jpeg"/></p>', '寤鸿杩囨护鐗规畩瀛楃', '1438043542', 4, 2, 2, 2, 4); +) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ; -- -------------------------------------------------------- diff --git a/README.md b/README.md index d9d1c80..9ace04c 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# 娆㈣繋浣跨敤SRCMS路杞诲搷搴旀鏋 V1.5姝ｅ紡鐗 +# 娆㈣繋浣跨敤SRCMS路杞诲搷搴旀鏋 V1.6姝ｅ紡鐗 **SRCMS**鏄笓闂ㄤ负涓皬浼佷笟鍜屼簰鑱旂綉浜у搧鍒涗笟鍥㈤槦鎵撻犵殑搴旀ュ搷搴斾腑蹇冪綉绔欏缓绔欐鏋躲傛湁浜嗗畠锛屽浠婁綘鍙互鍍忎娇鐢ㄥ姙鍏蒋浠朵竴鏍峰鏄擄紝涓轰綘鐨勪紒涓氬缓绔嬭捣缇庤瀹屽鐨勫畨鍏ㄥ簲鎬ュ搷搴斾腑蹇 > * **椤圭洰缁存姢:** Martin Zhou > * **E-Mail**:1009465756@qq.com @@ -24,6 +24,12 @@ --- ##鐗堟湰鏇存柊鏃ュ織 +#####2016-01-26 +* **淇** 涓夊涓ラ噸鐨勫墠鍙颁釜浜轰腑蹇冨畨鍏ㄩ棶棰(Issued By phithon) +* **淇** 瀵屾枃鏈繃婊や笉涓ユ牸鐨勯棶棰(Issued By mramydnei) +* **淇** 鍚庡彴婕忔礊瀹℃牳BUG +* **淇** 鍏抽棴寮鍙戞ā寮忥紝闃叉鎶ラ敊鏄剧ず鏁忔劅淇℃伅 + #####2016-01-24 * **鏂板** 鏂扮増棣栭〉锛氱畝娲併佸ぇ鏂广佹洿涓虹伒娲伙紝鏂逛究鎮ㄥ缓绔嬫湁鑷繁鐗硅壊鐨勫畨鍏ㄥ簲鎬ュ搷搴斾腑蹇 * **鏂板** 鏂扮増鍓嶅彴涓汉涓績锛氭敮鎸佹敮浠樺疂璐﹀彿鐨勫綍鍏 diff --git a/admin.php b/admin.php index 181a707..7af01cc 100644 --- a/admin.php +++ b/admin.php @@ -18,7 +18,7 @@ if(version_compare(PHP_VERSION,'5.3.0','<')) die('require PHP > 5.3.0 !'); define('BIND_MODULE','Admin'); // 寮鍚皟璇曟ā寮 寤鸿寮鍙戦樁娈靛紑鍚 閮ㄧ讲闃舵娉ㄩ噴鎴栬呰涓篺alse -define('APP_DEBUG',True); +define('APP_DEBUG',False); // 瀹氫箟搴旂敤鐩綍 define('APP_PATH','./Application/'); diff --git a/index.php b/index.php index 92b1b89..e2b0da8 100644 --- a/index.php +++ b/index.php @@ -20,7 +20,7 @@ if(version_compare(PHP_VERSION,'5.3.0','<')) die('require PHP > 5.3.0 !'); define('BIND_MODULE','Home'); // 寮鍚皟璇曟ā寮 寤鸿寮鍙戦樁娈靛紑鍚 閮ㄧ讲闃舵娉ㄩ噴鎴栬呰涓篺alse -define('APP_DEBUG',True); +define('APP_DEBUG',False); // 瀹氫箟搴旂敤鐩綍 define('APP_PATH','./Application/'); diff --git a/user.php b/user.php index 058c5f6..4000560 100644 --- a/user.php +++ b/user.php @@ -20,7 +20,7 @@ if(version_compare(PHP_VERSION,'5.3.0','<')) die('require PHP > 5.3.0 !'); define('BIND_MODULE','User'); // 寮鍚皟璇曟ā寮 寤鸿寮鍙戦樁娈靛紑鍚 閮ㄧ讲闃舵娉ㄩ噴鎴栬呰涓篺alse -define('APP_DEBUG',True); +define('APP_DEBUG',False); // 瀹氫箟搴旂敤鐩綍 define('APP_PATH','./Application/');