WooYun.org

function attention_action()
	{ 
		$this->is_login();//需要登录会员
		$is_set=$this->obj->DB_select_once("attention","`uid`='".$this->uid."' and `type`='".(int)$_POST['type']."'");//这里让type为1
	
		if($_POST['type']=='1')
		{
			$info=$this->obj->DB_select_once("question","`id`='".(int)$_POST['id']."'","`id`,`title`,`uid`");
			$gourl= $this->aurl(array("url"=>"c:content,id:".$info['id']));
			$content="关注了<a href=\"".$gourl."\" target=\"_blank\">《".$info['title']."》</a>。";
			$n_contemt="取消了对<a href=\"".$gourl."\" target=\"_blank\">《".$info['title']."》</a>的关注。";
			$log="关注了《".$info['title']."》";
			$n_log="取消了对《".$info['title']."》";
		}else{
			$info=$this->obj->DB_select_once("q_class","`id`='".$_POST['id']."'","`id`,`name`");
			$gourl= $this->aurl(array("url"=>"c:getclass,id:".$info['id']));
			$content="关注了<a href=\"".$gourl."\" target=\"_blank\">".$info['name']."</a>。";
			$n_contemt="取消了<a href=\"".$gourl."\" target=\"_blank\">".$info['name']."</a>的关注。";
			$log="关注了".$info['name'];
			$n_log="取消了对".$info['name']."</a>的关注。";
		}
	
		if($info['uid']==$this->uid){
			echo '4';
		}else if(is_array($is_set)){ //这里一开始$is_set为空
所以不会进入这里 当第二次进入的时候 就是数组了 就会进这里面了
所以这个洞 我们一个帐号用一次。
			$ids=@explode(',',$is_set['ids']);
			if(in_array($_POST['id'],$ids))
			{
				if($_POST['type']=='1')
				{
					echo '2';
				}else{
					foreach($ids as $k=>$v )
					{
						if($v!=$_POST['id'])
						{
							$i_ids[]=$v;
						}
					}
					if($i_ids)
					{
						$n_id=$this->obj->update_once("attention",array("ids"=>@implode(',',$i_ids)),array("id"=>$is_set['id']));
					}else{
						$n_id=$this->obj->DB_delete_all("attention","`id`='".$is_set['id']."'");
					}
					if($n_id)
					{
						$data['uid']=$this->uid;
						$data['content']=$n_contemt;
						$data['ctime']=time();
						$this->obj->insert_into("friend_state",$data);
						$this->obj->member_log($n_log);
						echo '3';
					}
				}
			}else{
//当不为数组的时候 就是一开始为空的时候
				$i_ids=$is_set['ids'].','.$_POST['id'];//这里拼接了$_POST['id]  所以也算部分可控了。
		
				$n_id=$this->obj->update_once("attention",array("ids"=>$i_ids),array("id"=>$is_set['id']));//带入到update中入库
				if($n_id)

function attenquestion_action()
	{
		if($this->uid=='')
		{
			$this->obj->ACT_msg($_SERVER['HTTP_REFERER'],"请先登录！");
		}
	
		$this->public_action();
		$ids=$this->obj->DB_select_once("attention","`uid`='".$this->uid."' and `type`='1'","`ids`");//这里出库
		$ids=rtrim($ids['ids'],',');//对刚才入库的 赋值给$ids
	
		$pageurl=$this->aurl(array("url"=>"c:".$_GET['c'].",page:{{page}}"));
		$question=$this->get_page("question","`id` in (".$ids.")  order by `add_time` desc",$pageurl,"10");//没有单引号
		if(!empty($question))
		{
			foreach($question as $k=>$v)
			{
				$uid[]=$v['uid'];
			}
			$uids=implode(',',$uid);
			$friend_info=$this->obj->DB_select_all("friend_info","`uid` in (".$uids.")","`uid`,`pic`");
			foreach($question as $key=>$val)
			{
				foreach($friend_info as $k=>$v)
				{
					if($val['uid']==$v['uid'])
					{
						if($val['uid']==$v['uid'])
						{
							if($v['pic'])
							{
								$question[$key]['pic']=$v['pic'];
							}else{
								$question[$key]['pic']=$this->config['sy_weburl'].'/'.$this->config['sy_friend_icon'];
							}
						}
					}
				}
			}
		}
		$this->yunset("question",$question); //这里直接把数据显示出来

if($config['sy_istemplate']!='1' || md5(md5($config['sy_safekey']).$_GET['m'])!=$_POST['safekey'])
{   
	foreach($_POST  as $id=>$v){
		
		$str = html_entity_decode($v,ENT_QUOTES,"GB2312");
		
		$v = common_htmlspecialchars($id,$v,$str,$config);
		
		safesql($id,$v,"POST",$config);
		
		$id = sfkeyword($id,$config);
		$v = sfkeyword($v,$config);
		$_POST[$id] = $v;
	}
}