WooYun.org

//用户登录
function login_act()
{
	$login_info = IFilter::act(IReq::get('login_info','post'));
	$password   = IReq::get('password','post');
	$remember   = IFilter::act(IReq::get('remember','post'));
	$autoLogin  = IFilter::act(IReq::get('autoLogin','post'));//通过post传入autoLogin
	$callback   = IFilter::act(IReq::get('callback'),'text');
		$message    = '';
		$password   = md5($password);
	if($login_info == '')
	{
		$message = '请填写用户名或者邮箱';
	}
		else if(!preg_match('|\S{6,32}|',$password))
	{
		$message = '密码格式不正确,请输入6-32个字符';
	}
	else
	{
		if($userRow = CheckRights::isValidUser($login_info,$password))
		{
				CheckRights::loginAfter($userRow);
				//记住帐号
				if($remember == 1)
				{
					ICookie::set('loginName',$login_info);
				}
				//自动登录
				if($autoLogin == 1) // "1xxoo" == 1 为真,提交 "1+payload"就能满足此条件
				{
					ICookie::set('autoLogin',$autoLogin); //写入cookie
				}
				......

public static function getUser()
{
	$user = array(
		'user_id'  => ISafe::get('user_id'), //user_id从cookie中取值后没有intval
		'username' => ISafe::get('username'),
		'head_ico' => ISafe::get('head_ico'),
		'user_pwd' => ISafe::get('user_pwd'),
	);
	if(self::isValidUser($user['username'],$user['user_pwd']))
	{
		return $user; //返回数组
	}
	else
	{
		ISafe::clear('user_id');
		ISafe::clear('username');
		ISafe::clear('head_ico');
		ISafe::clear('user_pwd');
		return null;
	}
}

public function order_detail()
{
    $id = IFilter::act(IReq::get('id'),'int');
    $orderObj = new order_class();
    $this->order_info = $orderObj->getOrderShow($id,$this->user['user_id']);//跟进getOrderShow函数
    if(!$this->order_info)
    {
    	IError::show(403,'订单信息不存在');
    }
    $this->redirect('order_detail',false);
}

public function getOrderShow($order_id,$user_id = 0)
{
	$where = 'id = '.$order_id;
	if($user_id !== 0)
	{
		$where .= ' and user_id = '.$user_id; //没有引号保护
	}
	$data = array();
	//获得对象
	$tb_order = new IModel('order');
 		$data = $tb_order->getObj($where); //进入查询
 		if($data)
 		{
 		......