WooYun.org

function exit_group()


    {


        $id = empty($_GET['id']) ? 0 : $_GET['id']; //没过滤你懂的。


        if (!$id)


        {


            $this->show_warning('no_such_groupbuy');


            return false;


        }





        // 判断是否能退团


        if (!$this->_ican($id, ACT)) //跟进


        {


            $this->show_warning('Hacking Attempt');


            return;


        }


......


    }


function _ican($id, $act = '')


    {


......


        $group = current($this->_member_mod->getRelatedData('join_groupbuy', $this->visitor->info['user_id'], array(


                'conditions' => 'gb.group_id=' . $id, //带入


                'order' => 'gb.group_id DESC',


                'fields' => 'gb.state,groupbuy_log.order_id'


        )));


......


    }

function getRelatedData($relation_name, $ids, $find_param = array())


    {


......


        /* 构造查询条件 */


        $conditions = $alias . '.' . $relation_info['foreign_key'] . ' ' . db_create_in($ids);   //主键值限定


        $conditions .= $relation_info['ext_limit'] ?


                            ' AND ' . $this->_getExtLimit($relation_info['ext_limit'], $alias)


                            : '';


        $conditions .= is_string($find_param['conditions']) ? ' AND ' . $find_param['conditions'] : '';


        $find_param['conditions'] = $conditions; //带入


......


 return $model->find($find_param);//跟进


    }


    function find($params = array())


    {


        extract($this->_initFindParams($params));





        /* 字段(SELECT FROM) */


        $fields = $this->getRealFields($fields);


        $fields == '' && $fields = '*';





        $tables = $this->table . ' ' . $this->alias;





        /* 左联结(LEFT JOIN) */


        $join_result = $this->_joinModel($tables, $join);





        /* 原来为($join_result || $index_key)，忘了最初的用意，默认加上主键应该是只为了为获得索引的数组服务的，因此只跟索引键是否是主键有关 */


        if ($index_key == $this->prikey || (is_array($index_key) && in_array($this->prikey, $index_key)))


        {


            /* 如果索引键里有主键，则默认在要查询字段后加上主键 */


            $fields .= ",{$this->alias}.{$this->prikey}";


        }





        /* 条件(WHERE) */


        $conditions = $this->_getConditions($conditions, true);





        /* 排序(ORDER BY) */


        $order && $order = ' ORDER BY ' . $this->getRealFields($order);





        /* 分页(LIMIT) */


        $limit && $limit = ' LIMIT ' . $limit;


        if ($count)


        {


            $this->_updateLastQueryCount("SELECT COUNT(*) as c FROM {$tables}{$conditions}");


        }





        /* 完整的SQL */


        $sql = "SELECT {$fields} FROM {$tables}{$conditions}{$order}{$limit}";





        return $index_key ? $this->db->getAllWithIndex($sql, $index_key) :


                            $this->db->getAll($sql);


//带入查询,结束.


    }

function edit()


    {


        $name = empty($_GET['name']) ? 0 : trim($_GET['name']);


        if (!$name)


        {


            $this->show_warning('no_such_widget');





            return;


        }


        $script_file = $this->_get_file($name, $_GET['file']);


        if (!IS_POST)


        {


            $this->assign('code', file_get_contents($script_file));


            $this->display('widget.form.html');


        }


        else


        {


            if (!file_put_contents($script_file, stripslashes($_POST['code'])))


            {


                $this->show_warning('edit_file_failed');





                return;


            }





            $this->show_message('edit_file_successed');


        }


    }


    function _get_file($name, $type = 'script')


    {


        $file = ROOT_PATH . '/external/widgets/' . $name;


        switch ($type)


        {


            case 'script':


                return $file . '/main.widget.php';


            break;


            case 'template':


                return $file . '/widget.html';


            break;


        }


    }