WooYun.org

function douploadimg() {
		$imgname=$_FILES['photofile']['name'];
		$extname=file::extname($imgname);
		$destfile=$_ENV['attachment']->makepath($extname);
		$arrupload=file::uploadfile($_FILES['photofile'],$destfile);
		
		if($arrupload['result']==true){
			if(isset($this->setting['watermark'])){
				$_ENV['watermark']->image($destfile,$destfile);
			}
			$uid=intval($this->user['uid'])?$this->user['uid']:0;
			$did=intval($this->get['2'])?$this->get['2']:0;
			$_ENV['attachment']->add_attachment($uid ,$did,$imgname ,$destfile ,htmlspecialchars($this->post['picAlt']) ,$extname);

function dodownload(){
		if(!isset($this->get[2]) || !is_numeric($this->get[2])){
			$this->message($this->view->lang['parameterError'],'BACK');
		}
		$result=$_ENV['attachment']->get_attachment('id',$this->get[2],0);
		if(!(bool)$attachment=$result[0]){
			$this->message($this->view->lang['attachIsNotExist'],'BACK');
		}
		if($this->user['uid'] != $attachment['uid']) {
			// 判断金币
			$credit1 = $this->user['credit1'];		// 拥有金币数
			$coindown = $attachment['coindown'];	// 下载此附件需要消耗金币数
			if(0 > $credit1 - $coindown) {
				// 金币不足
				$this->message($this->view->lang['goldNotEnough'],"index.php?doc-view-".$attachment['did'],0);
			}
			// 扣除金币
			$_ENV['user']->add_credit($this->user['uid'],'attachment-down',0,-$coindown);
			// 增加金币
			$_ENV['user']->add_credit($attachment['uid'],'attachment-down',0,$coindown);
		}
		$_ENV['attachment']->update_downloads($attachment['id']);
		file::downloadfile($attachment['attachment'],$attachment['filename']);
	}