WooYun.org

if(submitcheck('batchsubmit')) {
        include_once(S_ROOT.'./source/function_delete.php');
        if(!empty($_POST['ids']) && deletedoings($_POST['ids'])) {
                cpmessage('do_success', $_POST['mpurl']);
        } else {
                cpmessage('choose_to_delete_events', $_POST['mpurl']);
        }
}

function cpmessage($msgkey, $url_forward='', $second=1, $values=array()) {
        global $_SGLOBAL, $_SC, $_SCONFIG, $_TPL, $_SN, $space;
        
        //去掉广告
        $_SGLOBAL['ad'] = array();
        include_once(S_ROOT.'./language/lang_cpmessage.php');
        if(isset($_SGLOBAL['cplang'][$msgkey])) {
                $message = lang_replace($_SGLOBAL['cplang'][$msgkey], $values);
        } else {
                $message = $msgkey;
        }
        
        //显示
        obclean();
        
        //菜单激活
        $menuactive = array('index' => ' class="active"');
        
        if(!empty($url_forward)) {
                $second = $second * 1000;
                $message .= "<script>setTimeout(\"window.location.href ='$url_forward';\", $second);</script>";
        }
        include template('admin/tpl/message');
        exit();
}

if(strlen($subject) < 2) showmessage('title_not_too_little');
        
        $_POST['message'] = checkhtml($_POST['message']);
        $_POST['message'] = getstr($_POST['message'], 0, 1, 0, 1, 0, 1);
        $_POST['message'] = preg_replace("/\<div\>\<\/div\>/i", '', $_POST['message']); 
        $message = $_POST['message'];

function checkhtml($html) {
        $html = stripslashes($html);
        if(!checkperm('allowhtml')) {
                
                preg_match_all("/\<([^\<]+)\>/is", $html, $ms);
                $searchs[] = '<';
                $replaces[] = '<';
                $searchs[] = '>';
                $replaces[] = '>';
                
                if($ms[1]) {
                        $allowtags = 'img|a|font|div|table|tbody|caption|tr|td|th|br|p|b|strong|i|u|em|span|ol|ul|li|blockquote|object|param|embed';//允许的标签
                        $ms[1] = array_unique($ms[1]);
                        foreach ($ms[1] as $value) {
                                $searchs[] = "<".$value.">";
                                $value = shtmlspecialchars($value);
                                $value = str_replace(array('\\','/*'), array('.','/.'), $value);
                                $value = preg_replace(array("/(javascript|script|eval|behaviour|expression)/i", "/(\s+|"|')on/i"), array('.', ' .'), $value);
                                if(!preg_match("/^[\/|\s]?($allowtags)(\s+|$)/is", $value)) {
                                        $value = '';
                                }
                                $replaces[] = empty($value)?'':"<".str_replace('"', '"', $value).">";
                        }
                }
                $html = str_replace($searchs, $replaces, $html);
        }
        $html = addslashes($html);
        
        return $html;
}
//视频标签处理
function blog_bbcode($message) {
        $message = preg_replace("/\[flash\=?(media|real)*\](.+?)\[\/flash\]/ie", "blog_flash('\\2', '\\1')", $message);
        return $message;
}
//视频
function blog_flash($swf_url, $type='') {
        $width = '520';
        $height = '390';
        if ($type == 'media') {
                $html = '<object classid="clsid:6bf52a52-394a-11d3-b153-00c04f79faa6" width="'.$width.'" height="'.$height.'">
                        <param name="autostart" value="0">
                        <param name="url" value="'.$swf_url.'">
                        <embed autostart="false" src="'.$swf_url.'" type="video/x-ms-wmv" width="'.$width.'" height="'.$height.'" controls="imagewindow" console="cons"></embed>
                        </object>';
        } elseif ($type == 'real') {
                $html = '<object classid="clsid:cfcdaa03-8be4-11cf-b84b-0020afbbccfa" width="'.$width.'" height="'.$height.'">
                        <param name="autostart" value="0">
                        <param name="src" value="'.$swf_url.'">
                        <param name="controls" value="Imagewindow,controlpanel">
                        <param name="console" value="cons">
                        <embed autostart="false" src="'.$swf_url.'" type="audio/x-pn-realaudio-plugin" width="'.$width.'" height="'.$height.'" controls="controlpanel" console="cons"></embed>
                        </object>';
        } else {
                $html = '<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" width="'.$width.'" height="'.$height.'">
                        <param name="movie" value="'.$swf_url.'">
                        <param name="allowscriptaccess" value="always">
                        <embed src="'.$swf_url.'" type="application/x-shockwave-flash" width="'.$width.'" height="'.$height.'" allowfullscreen="true" allowscriptaccess="always"></embed>
                        </object>';
        }
        return $html;
}