WooYun.org

require(dirname(__FILE__).'/../config.inc.php');
!isset($db)&&$db=connectdb();
require_once(FR_ROOT.'/inc/paylog.inc.php');
if(!$cfg['comment']=='1'){echo "<script language=JavaScript>{alert('本站未开启评论功能！');window.close();}</script>";exit;}
$submit=isset($_POST['Submit'])?$_POST['Submit']:'';
if($submit){
	if($cfg['comment']){
		if($anonymous){
			$c_username ='匿名网友';
		}else{
			$user_login=_getcookie('user_login');
			if($user_login){
				$pjrname=$user_login;
			}
			$c_username=$pjrname;
			$sql="select  m_id,m_pwd,m_typeid,m_groupid,m_name,m_loginip,m_logindate,m_email from {$cfg['tb_pre']}member where m_login='$pjrname'";
			$rs= $db->get_one($sql);

function _getcookie($var) {
	global $cfg;
	$var = $cfg['cookie_pre'].$var;
	return isset($_COOKIE[$var]) ? $_COOKIE[$var] : '';
}

foreach(Array('_GET','_POST','_COOKIE') as $_request){
	foreach($$_request as $_k => $_v) $_k{0} != '_' && ${$_k} = is_array($_v)?_runmagicquotes($_v):cleartags(_runmagicquotes($_v));
    //foreach($$_request as $_k => $_v) ${$_k} = _runmagicquotes($_v);
}
function _runmagicquotes(&$svar){
	if(!get_magic_quotes_gpc()){
		if( is_array($svar) ){
			foreach($svar as $_k => $_v) $svar[$_k] = _runmagicquotes($_v);
		}else{
			$svar = addslashes($svar);
		}
	}
	return $svar;
}

function checksql($dbstr,$querytype='select'){
	$clean = '';
	$old_pos = 0;
	$pos = -1;
	//普通语句，直接过滤特殊语法
	if($querytype=='select'){
		$nastr = "/[^0-9a-z@\._-]{1,}(union|sleep|benchmark|load_file|outfile)[^0-9a-z@\.-]{1,}/i";
		if(preg_match($nastr,$dbstr)){
            log_write($dbstr,'sql');
            showmsg('SafeError:10001', 'javascript:;');
            exit();
		}
	}
	//完整的SQL检查
	while (true){
		$pos = strpos($dbstr, '\'', $pos + 1);
		if ($pos === false){
			break;
		}
		$clean .= substr($dbstr, $old_pos, $pos - $old_pos);
		while (true){
			$pos1 = strpos($dbstr, '\'', $pos + 1);
			$pos2 = strpos($dbstr, '\\', $pos + 1);
			if ($pos1 === false){
				break;
			}
			elseif ($pos2 == false || $pos2 > $pos1){
				$pos = $pos1;
				break;
			}
			$pos = $pos2 + 1;
		}
		$clean .= '$s$';
		$old_pos = $pos + 1;
	}
	$clean .= substr($dbstr, $old_pos);
	$clean = trim(strtolower(preg_replace(array('~\s+~s' ), array(' '), $clean)));
	if (strpos($clean, 'union') !== false && preg_match('~(^|[^a-z])union($|[^[a-z])~s', $clean) != 0){
		$fail = true;
	}
	elseif (strpos($clean, '/*') > 2 || strpos($clean, '--') !== false || strpos($clean, '#') !== false){
		$fail = true;
	}
	elseif (strpos($clean, 'sleep') !== false && preg_match('~(^|[^a-z])sleep($|[^[a-z])~s', $clean) != 0){
		$fail = true;
	}
	elseif (strpos($clean, 'benchmark') !== false && preg_match('~(^|[^a-z])benchmark($|[^[a-z])~s', $clean) != 0){
		$fail = true;
	}
	elseif (strpos($clean, 'load_file') !== false && preg_match('~(^|[^a-z])load_file($|[^[a-z])~s', $clean) != 0){
		$fail = true;
	}
	elseif (strpos($clean, 'into outfile') !== false && preg_match('~(^|[^a-z])into\s+outfile($|[^[a-z])~s', $clean) != 0){
		$fail = true;
	}
	elseif (preg_match('~\([^)]*?select~s', $clean) != 0){
		$fail = true;
	}
	if (!empty($fail)){
        log_write($dbstr,'sql');
        showmsg('SafeError:10002', 'javascript:;');exit;
	}
	else
	{
		return $dbstr;
	}
}

if($rs){
				$typeid=$rs["m_typeid"];$name=$rs['m_name'];$loginip=$rs['m_loginip'];$logindate=$rs['m_logindate'];
            	if($rs['m_groupid']!=''){
                	$rsg=find_value_arr('g_id',$rs['m_groupid'],sysgroup($typeid));$Gintegral=explode(",",$rsg['g_integral']);
                	if($typeid==1){$integral=$Gintegral[6];$integral2=$Gintegral[9];}else{$integral=$Gintegral[5];$integral2=$Gintegral[7];}
            	}else{
                	$integral=$integral2=0;
            	}
				if($pjrpass){
					if($rs['m_pwd']==md5($pjrpass)){
						$pwd=md5($pjrpass);
						$db ->query("update {$cfg['tb_pre']}member set m_loginnum=m_loginnum+1,m_logindate=NOW(),m_loginip='$ip' where m_login='$pjrname'");				
						_setcookie('user_login',$pjrname,3600*24);
						_setcookie('user_pass',$pwd,3600*24);
						_setcookie('user_type',usertype($typeid),3600*24);
						_setcookie('user_name',$name,3600*24);
						_setcookie('user_loginip',$loginip,3600*24);
						_setcookie('user_logindate',$logindate,3600*24);
					
					}else{
						echo "<script language=JavaScript>{alert('用户名密码错误，请重新输入！');window.close();}</script>";exit;
					}
				}
			}