WooYun.org

function onadd() {


        $navtitle = "提出问题";


        if (isset($this->post['submit'])) {


            $title = htmlspecialchars($this->post['title']);


            $description = $this->post['description'];//未做处理


            $cid1 = $this->post['cid1'];


            $cid2 = $this->post['cid2'];


            $cid3 = $this->post['cid3'];


            $cid = $this->post['cid'];


            $hidanswer = intval($this->post['hidanswer']) ? 1 : 0;


            $price = abs($this->post['givescore']);


            $askfromuid = $this->post['askfromuid'];


            $this->setting['code_ask'] && $this->checkcode(); //检查验证码


            $offerscore = $price;


            ($hidanswer) && $offerscore+=10;


            (intval($this->user['credit2']) < $offerscore) && $this->message("财富值不够!", 'BACK');


            //检查审核和内容外部URL过滤(此处也不是处理特使字符，只是审核和检查有没有外部url)


            $status = intval(1 != (1 & $this->setting['verify_question']));


            $allow = $this->setting['allow_outer'];


            if (3 != $allow && has_outer($description)) {


                0 == $allow && $this->message("内容包含外部链接，发布失败!", 'BACK');


                1 == $allow && $status = 0;


                2 == $allow && $description = filter_outer($description);


            }


            //检查标题违禁词（这也不是处理）


            $contentarray = checkwords($title);


            1 == $contentarray[0] && $status = 0;


            2 == $contentarray[0] && $this->message("问题包含非法关键词，发布失败!", 'BACK');


            $title = $contentarray[1];





            //检查问题描述违禁词（也不是）


            $descarray = checkwords($description);


            1 == $descarray[0] && $status = 0;


            2 == $descarray[0] && $this->message("问题描述包含非法关键词，发布失败!", 'BACK');


            $description = $descarray[1];





            /* 检查提问数是否超过组设置 */


            ($this->user['questionlimits'] && ($_ENV['userlog']->rownum_by_time('ask') >= $this->user['questionlimits'])) &&


                    $this->message("你已超过每小时最大提问数" . $this->user['questionlimits'] . ',请稍后再试！', 'BACK');





            $qid = $_ENV['question']->add($title, $description, $hidanswer, $price, $cid, $cid1, $cid2, $cid3, $status);