WooYun.org

error_reporting(0);


require_once("alipay_config.php");


require_once("class/alipay_service.php");


require_once(dirname(dirname(dirname(__FILE__)))."/data/db.config.php");


require_once(dirname(dirname(dirname(__FILE__)))."/plus/config.php");





require_once(dirname(dirname(dirname(__FILE__)))."/include/mysql.class.php");


//看这里 主要是没包含db.safety.php进来 导致了这里面的_POST啥的不转义 不过滤





$db = new mysql($db_config['dbhost'], $db_config['dbuser'], $db_config['dbpass'], $db_config['dbname'], ALL_PS, $db_config['charset']);


if(!is_numeric($_POST['dingdan'])){die;}


 


$_COOKIE['uid']=(int)$_COOKIE['uid'];


$_POST['is_invoice']=(int)$_POST['is_invoice'];


$_POST['balance']=(int)$_POST['balance']; 


$member_sql=$db->query("SELECT * FROM `".$db_config["def"]."member` WHERE `uid`='".$_COOKIE['uid']."' limit 1");//把自己的账户信息查询出来


$member=mysql_fetch_array($member_sql);  


if($member['username'] != $_COOKIE['username'] || $member['usertype'] != $_COOKIE['usertype']||md5($member['username'].$member['password'].$member['salt'])!=$_COOKIE['shell']){  //验证登录信息


	echo '登录信息验证错误，请重新登录！';die;


}  


$sql=$db->query("select * from `".$db_config["def"]."company_order` where `order_id`='".$_POST['dingdan']."' AND `order_price`>=0");//_POST['dingdan']被转型了  这里是把自己的订单信息查询出来


$row=mysql_fetch_array($sql);


if(!$row['uid'] || $row['uid']!=$_COOKIE['uid']) //这里验证了是不是自己的订单 不是自己的订单或者没有这个订单 就退出了


{


	die;


}


if((int)$_POST['is_invoice']=='1'&&$config["sy_com_invoice"]){


	$invoice_title=",`is_invoice`='".$_POST['is_invoice']."'";


	if($_POST['linkway']=='1'){


		$com_sql=$db->query("select `linkman`,`linktel`,`address` from `".$db_config["def"]."company` where `uid`='".$_COOKIE['uid']."'");//查询余额


		$company=mysql_fetch_array($com_sql);   


		$link=",'".$company['linkman']."','".$company['linktel']."','".$company['address']."'";


		$up_record=",`link_man`='".$company['linkman']."',`link_moblie`='".$company['linktel']."',`address`='".$company['address']."'";


	}else{  


		$link=",'".$_POST['link_man']."','".$_POST['link_moblie']."','".$_POST['address']."'"; 


		$up_record=",`link_man`='".$_POST['link_man']."',`link_moblie`='".$_POST['link_moblie']."',`address`='".$_POST['address']."'";//因为没有包含db.safety.php进来 这里全都可以引入单引号。。


	}


	$record_sql=$db->query("select `id` from `".$db_config["def"]."invoice_record` where `order_id`='".$_POST['dingdan']."' and `uid`='".$_COOKIE['uid']."'");


	$record=mysql_fetch_array($record_sql);  


	if($record['id']){


		$upr_sql=$db->query("update `".$db_config["def"]."invoice_record` set `title`='".trim($_POST['invoice_title'])."',`status`='0',`addtime`='".time()."'".$up_record." where `id`='".$record['id']."'");


		mysql_fetch_array($upr_sql);


	}else{


		$db->query("insert into `".$db_config["def"]."invoice_record`(order_id,uid,title,status,addtime,`link_man`,`link_moblie`,`address`) values('".$row['order_id']."','".$_COOKIE['uid']."','".trim($_POST['invoice_title'])."','0','".time()."'".$link.")");


	} 


}

function dingdan_action(){





		if($_POST['price']){


			if($_POST['comvip']){


				$comvip=(int)$_POST['comvip'];


				$ratinginfo =  $this->obj->DB_select_once("company_rating","`id`='".$comvip."'");


				$price = $ratinginfo['service_price'];


				$data['type']='1';


			}elseif($_POST['price_int']){


				$integral=intval($_POST['price_int']);


				$price = $integral/$this->config['integral_proportion'];


				$data['type']='2';


			}elseif($_POST['price_msg']){


				$integral=intval($_POST['price_msg']);


				$price = $integral/$this->config['integral_msg_proportion'];


				$data['type']='5';


			}else{


 				$this->obj->ACT_layer_msg("参数不正确，请正确填写！",8,$_SERVER['HTTP_REFERER']);


			}


			if(($data['type']=='2'||$data['type']=='5')&&$integral<1){


				$this->obj->ACT_layer_msg("请正确填写购买数量！",8,$_SERVER['HTTP_REFERER']);


			}


			$dingdan=mktime().rand(10000,99999);//不可控


			$data['order_id']=$dingdan;


			$data['order_price']=$price;


			$data['order_time']=mktime();


			$data['order_state']="1";


			$data['order_remark']=trim($_POST['remark']);


			$data['uid']=$this->uid;


			$data['rating']=$_POST['comvip'];


			$data['integral']=$integral;


	


			$id=$this->obj->insert_into("company_order",$data);//入库

function list_action(){


		$this->public_action();


		$where="`nid`='".$_GET['id']."'";


		if($_GET['order']) //当设置order后


		{


			$where.=" order by ".$_GET['t']." ".$_GET['order'];//直接带入无限制 无单引号


			$urlarr['order']=$_GET['order'];


			$urlarr['t']=$_GET['t'];


		}else{


			$where.=" order by `id` desc";


		}


		$urlarr['c']="list";


		$urlarr["id"]=$_GET['id'];


		$urlarr['page']="{{page}}";





		$pageurl=$this->url("index",$_GET['m'],$urlarr);


		$rows=$this->get_page("reward",$where,$pageurl,13);//直接把where带入查询


		$this->yunset("rows",$rows);


		$row=$this->obj->DB_select_all("reward_class");


		$this->yunset("row",$row);


		$this->seo("redeem");


		$this->yun_tpl(array('list'));


	}

function show_action(){


		$this->public_action();


	    $where="`gid`='".$_GET['id']."'";


		if($_GET['order'])


		{


			$where.=" order by ".$_GET['t']." ".$_GET['order'];


			$urlarr['order']=$_GET['order'];


			$urlarr['t']=$_GET['t'];


		}else{


			$where.=" order by `id` desc";


		}


		$urlarr['c']="show";


		$urlarr["id"]=$_GET['id'];


		$urlarr['page']="{{page}}";


		$pageurl=$this->url("index",$_GET['m'],$urlarr);


		$jilu=$this->get_page("change",$where,$pageurl,13);


		$this->yunset("jilu",$jilu);