WooYun.org

error_reporting(0);
require_once("alipay_config.php");
require_once("class/alipay_service.php");
require_once(dirname(dirname(dirname(__FILE__)))."/data/db.config.php");
require_once(dirname(dirname(dirname(__FILE__)))."/plus/config.php");
require_once(dirname(dirname(dirname(__FILE__)))."/include/mysql.class.php");
//看这里 主要是没包含db.safety.php进来 导致了这里面的_POST啥的不转义 不过滤
$db = new mysql($db_config['dbhost'], $db_config['dbuser'], $db_config['dbpass'], $db_config['dbname'], ALL_PS, $db_config['charset']);
if(!is_numeric($_POST['dingdan'])){die;}
 
$_COOKIE['uid']=(int)$_COOKIE['uid'];
$_POST['is_invoice']=(int)$_POST['is_invoice'];
$_POST['balance']=(int)$_POST['balance']; 
$member_sql=$db->query("SELECT * FROM `".$db_config["def"]."member` WHERE `uid`='".$_COOKIE['uid']."' limit 1");//把自己的账户信息查询出来
$member=mysql_fetch_array($member_sql);  
if($member['username'] != $_COOKIE['username'] || $member['usertype'] != $_COOKIE['usertype']||md5($member['username'].$member['password'].$member['salt'])!=$_COOKIE['shell']){  //验证登录信息
	echo '登录信息验证错误，请重新登录！';die;
}  
$sql=$db->query("select * from `".$db_config["def"]."company_order` where `order_id`='".$_POST['dingdan']."' AND `order_price`>=0");//_POST['dingdan']被转型了  这里是把自己的订单信息查询出来
$row=mysql_fetch_array($sql);
if(!$row['uid'] || $row['uid']!=$_COOKIE['uid']) //这里验证了是不是自己的订单 不是自己的订单或者没有这个订单 就退出了
{
	die;
}
if((int)$_POST['is_invoice']=='1'&&$config["sy_com_invoice"]){
	$invoice_title=",`is_invoice`='".$_POST['is_invoice']."'";
	if($_POST['linkway']=='1'){
		$com_sql=$db->query("select `linkman`,`linktel`,`address` from `".$db_config["def"]."company` where `uid`='".$_COOKIE['uid']."'");//查询余额
		$company=mysql_fetch_array($com_sql);   
		$link=",'".$company['linkman']."','".$company['linktel']."','".$company['address']."'";
		$up_record=",`link_man`='".$company['linkman']."',`link_moblie`='".$company['linktel']."',`address`='".$company['address']."'";
	}else{  
		$link=",'".$_POST['link_man']."','".$_POST['link_moblie']."','".$_POST['address']."'"; 
		$up_record=",`link_man`='".$_POST['link_man']."',`link_moblie`='".$_POST['link_moblie']."',`address`='".$_POST['address']."'";//因为没有包含db.safety.php进来 这里全都可以引入单引号。。
	}
	$record_sql=$db->query("select `id` from `".$db_config["def"]."invoice_record` where `order_id`='".$_POST['dingdan']."' and `uid`='".$_COOKIE['uid']."'");
	$record=mysql_fetch_array($record_sql);  
	if($record['id']){
		$upr_sql=$db->query("update `".$db_config["def"]."invoice_record` set `title`='".trim($_POST['invoice_title'])."',`status`='0',`addtime`='".time()."'".$up_record." where `id`='".$record['id']."'");
		mysql_fetch_array($upr_sql);
	}else{
		$db->query("insert into `".$db_config["def"]."invoice_record`(order_id,uid,title,status,addtime,`link_man`,`link_moblie`,`address`) values('".$row['order_id']."','".$_COOKIE['uid']."','".trim($_POST['invoice_title'])."','0','".time()."'".$link.")");
	} 
}

function dingdan_action(){
		if($_POST['price']){
			if($_POST['comvip']){
				$comvip=(int)$_POST['comvip'];
				$ratinginfo =  $this->obj->DB_select_once("company_rating","`id`='".$comvip."'");
				$price = $ratinginfo['service_price'];
				$data['type']='1';
			}elseif($_POST['price_int']){
				$integral=intval($_POST['price_int']);
				$price = $integral/$this->config['integral_proportion'];
				$data['type']='2';
			}elseif($_POST['price_msg']){
				$integral=intval($_POST['price_msg']);
				$price = $integral/$this->config['integral_msg_proportion'];
				$data['type']='5';
			}else{
 				$this->obj->ACT_layer_msg("参数不正确，请正确填写！",8,$_SERVER['HTTP_REFERER']);
			}
			if(($data['type']=='2'||$data['type']=='5')&&$integral<1){
				$this->obj->ACT_layer_msg("请正确填写购买数量！",8,$_SERVER['HTTP_REFERER']);
			}
			$dingdan=mktime().rand(10000,99999);//不可控
			$data['order_id']=$dingdan;
			$data['order_price']=$price;
			$data['order_time']=mktime();
			$data['order_state']="1";
			$data['order_remark']=trim($_POST['remark']);
			$data['uid']=$this->uid;
			$data['rating']=$_POST['comvip'];
			$data['integral']=$integral;
	
			$id=$this->obj->insert_into("company_order",$data);//入库

function list_action(){
		$this->public_action();
		$where="`nid`='".$_GET['id']."'";
		if($_GET['order']) //当设置order后
		{
			$where.=" order by ".$_GET['t']." ".$_GET['order'];//直接带入无限制 无单引号
			$urlarr['order']=$_GET['order'];
			$urlarr['t']=$_GET['t'];
		}else{
			$where.=" order by `id` desc";
		}
		$urlarr['c']="list";
		$urlarr["id"]=$_GET['id'];
		$urlarr['page']="{{page}}";
		$pageurl=$this->url("index",$_GET['m'],$urlarr);
		$rows=$this->get_page("reward",$where,$pageurl,13);//直接把where带入查询
		$this->yunset("rows",$rows);
		$row=$this->obj->DB_select_all("reward_class");
		$this->yunset("row",$row);
		$this->seo("redeem");
		$this->yun_tpl(array('list'));
	}

function show_action(){
		$this->public_action();
	    $where="`gid`='".$_GET['id']."'";
		if($_GET['order'])
		{
			$where.=" order by ".$_GET['t']." ".$_GET['order'];
			$urlarr['order']=$_GET['order'];
			$urlarr['t']=$_GET['t'];
		}else{
			$where.=" order by `id` desc";
		}
		$urlarr['c']="show";
		$urlarr["id"]=$_GET['id'];
		$urlarr['page']="{{page}}";
		$pageurl=$this->url("index",$_GET['m'],$urlarr);
		$jilu=$this->get_page("change",$where,$pageurl,13);
		$this->yunset("jilu",$jilu);