WooYun.org

/**


     * 执行编辑帖子


     * @return void


     */


    //水平权限缺陷02


    public function doPostEdit(){


        // echo 2;die;


        $checkContent = str_replace(' ', '', $_POST['content']);


        $checkContent = str_replace('<br />', '', $checkContent);


        $checkContent = str_replace('<p>', '', $checkContent);


        $checkContent = str_replace('</p>', '', $checkContent);


        $checkContents = preg_replace('/<img(.*?)src=/i','img',$checkContent);


        $checkContents = preg_replace('/<embed(.*?)src=/i','img',$checkContents);


        if(strlen(t($_POST['title']))==0) $this->error('帖子标题不能为空');


        if(strlen(t($checkContents))==0) $this->error('帖子内容不能为空');


        preg_match_all('/./us', t($_POST['title']), $match);  


        if(count($match[0])>30){     //汉字和字母都为一个字


            $this->error('帖子标题不能超过30个字');


        } 


        $post_id = intval($_POST['post_id']);


        $data['title'] = t($_POST['title']);


        $data['content'] = h($_POST['content']);


        $res = D('weiba_post')->where('post_id='.$post_id)->save($data);//直接提交post_id即可编辑任意帖子，未进行权限认证


        if($res!==false){


            $post_detail = D('weiba_post')->where('post_id='.$post_id)->find();


            if(intval($_POST['log'])==1){


                D('log')->writeLog($post_detail['weiba_id'],$this->mid,'编辑了帖子“<a href="'.U('weiba/Index/postDetail',array('post_id'=>$post_id)).'" target="_blank">'.$post_detail['title'].'</a>”','posts');


            }


            //同步到微博


            $feedInfo = D('feed_data')->where('feed_id='.$post_detail['feed_id'])->find();


            $datas = unserialize($feedInfo['feed_data']);


            $datas['content'] = '【'.$data['title'].'】'.getShort(t($checkContent),100).' ';


            $datas['body'] = $datas['content'];


            $data1['feed_data'] = serialize($datas);


            $data1['feed_content'] = $datas['content'];


            $feed_id = D('feed_data')->where('feed_id='.$post_detail['feed_id'])->save($data1);


            model('Cache')->rm('fd_'.$post_detail['feed_id']);


            return $this->ajaxReturn($post_id, '编辑成功', 1);


        }else{


            $this->error('编辑失败');


        }


    }

/**


     * 删除帖子


     * @return void


     */


    public function postDel(){


         $post_id = intval($_POST['post_id']);//修复了注入问题


        // 水平权限缺陷01


        


        if(D('weiba_post')->where('post_id='.$post_id)->setField('is_del',1)){


            if(intval($_POST['log'])==1){


                $post_detail = D('weiba_post')->where('post_id='.$post_id)->find();


                D('log')->writeLog($post_detail['weiba_id'],$this->mid,'删除了帖子“'.$post_detail['title'].'”','posts');


            }


            D('weiba')->where('weiba_id='.intval($_POST['weiba_id']))->setDec('thread_count');


            echo 1;


        }


    }