WooYun.org

function set_password()


    {


        if (!IS_POST) 


        {


            ......        


        }


        else //POST提交


        {


            if (empty($_POST['new_password']) || empty($_POST['confirm_password']))


            {


                $this->show_warning("unsettled_required");


                return ;


            }


            if (trim($_POST['new_password']) != trim($_POST['confirm_password'])) 


            {


                $this->show_warning("password_not_equal");


                return ;


            }


            $password = trim($_POST['new_password']);


            $passlen = strlen($password);


            if ($passlen < 6 || $passlen > 20)


            {


                $this->show_warning('password_length_error');





                return;


            }





            $id = intval($_GET['id']);//虽然是过滤了,但是不影响利用.


            $word = $this->_rand();


            $md5word = md5($word);





            $ms =& ms();        //连接用户系统


            $ms->user->edit($id, '', array('password' => $password), true); //强制修改 !!问题就出在这儿,false是需要验证的,不知道程序员为什么要设置成非验证修改,偷懒也不是这么偷的吧...


            if ($ms->user->has_error())


            {


                $this->show_warning($ms->user->get_error());





                return;


            }


            $ret = $this->_password_mod->edit($id, array('activation' => $md5word));





            $this->show_message("edit_success",


                'login_in', 'index.php?app=member&act=login',


                'back_index', 'index.php');


            return ;


        }





    }

function edit($user_id, $old_password, $items, $force = false)


    {


        if (!$force) //为false时需要验证,为ture时直接跳过执行下面的操作


        {


            $info = $this->get($user_id);


            if (md5($old_password) != $info['password'])


            {


                $this->_error('auth_failed');





                return false;


            }


        }


        $edit_data = array();


        if (isset($items['password']))


        {


            $edit_data['password']  = md5($items['password']);


        }


        if (isset($items['email']))


        {


            $edit_data['email'] = $items['email'];


        }





        if (empty($edit_data))


        {


            return false;


        }


        //编辑本地数据


        $this->_local_edit($user_id, $edit_data);//跟进





        return true;


    }

function _local_edit($user_id, $data)


    {


        $model_member =& m('member');


        $model_member->edit($user_id, $data);\\执行update





        return true;


    }