WooYun.org

...30行
	case "do":
		
		$userid = intval($_GET['userid']);
		$albumid = intval($_GET['albumid']);
		if($userid=='0' || $albumid == 0){
			echo '00000';
			exit;
		}
		
		$attachid = $new['attach']->create('attach',array(
			'userid'	=> $userid,
			'locationid'=>aac('user')->getLocationId($userid),
			'albumid'=>$albumid,
			'addtime'	=> date('Y-m-d H:i:s'),
		));
		
		//上传
		$arrUpload = tsUpload($_FILES['Filedata'],$attachid,'attach',array('pptx','docx','pdf','jpg','gif','png','rar','zip','doc','ppt','txt'));
		
		if($arrUpload){
			$new['attach']->update('attach',array(
				'attachid'=>$attachid,
			),array(
				'attachname'=>$arrUpload['name'],
				'attachtype'=>$arrUpload['type'],
				'attachurl'=>$arrUpload['url'],
				'attachsize'=>$arrUpload['size'],
			));
			
			
			//对积分进行处理
			aac('user')->doScore($app,$ac,$ts,$userid);
			
			
		}
		
		echo $attachid;
		
		break;

/**
 * ThinkSAAS专用上传函数
 * @param unknown $files	要上传的文件 如$_FILES['photo']
 * @param unknown $projectid	上传针对的项目id 如$userid
 * @param unknown $dir	上传到目录 如 user
 * @param unknown $uptypes	上传类型，数组 array('jpg','png','gif')
 * @return multitype:string unknown mixed |boolean	返回数组：array('name'=>'','path'=>'','url'=>'','path'=>'','size'=>'')
 */
function tsUpload($files, $projectid, $dir, $uptypes) {
	if ($files ['size'] > 0) {
		
		$menu2 = intval ( $projectid / 1000 );
		
		$menu1 = intval ( $menu2 / 1000 );
		
		$path = $menu1 . '/' . $menu2;
		
		$dest_dir = 'uploadfile/' . $dir . '/' . $path;
		
		createFolders ( $dest_dir );
		
		//$ext = pathinfo($files['name'],PATHINFO_EXTENSION);
		
		$arrType = explode ( '.', strtolower ( $files ['name'] ) ); // 转小写一下
		
		$type = array_pop ( $arrType );
		
		if (in_array ( $type, $uptypes )) {
			
			$name = $projectid . '.' . $type;
			
			$dest = $dest_dir . '/' . $name;
			
			// 先删除
			unlink ( $dest );
			// 后上传
			move_uploaded_file ( $files ['tmp_name'], mb_convert_encoding ( $dest, "gb2312", "UTF-8" ) );
			
			chmod ( $dest, 0777 );
			
			$filesize = filesize ( $dest );
			if (intval ( $filesize ) > 0) {
				return array (
						'name' => tsFilter($files ['name']),
						'path' => $path,
						'url' => $path . '/' . $name,
						'type' => $type,
						'size' => $files ['size'] 
				);
			} else {
				return false;
			}
		} else {
			return false;
		}
	}
}

/**
 * 针对特殊字符或者内容的特殊过滤
 * @param unknown $value
 * @return Ambigous <string, mixed>
 */
function tsFilter($value){
	$value = trim($value);
	//定义不允许提交的SQl命令和关键字
	$words = array();
	$words[] = "add ";
	$words[] = "and ";
	$words[] = "count ";
	$words[] = "order ";
	$words[] = "table ";
	$words[] = "by ";
	$words[] = "create ";
	$words[] = "delete ";
	$words[] = "drop ";
	$words[] = "from ";
	$words[] = "grant ";
	$words[] = "insert ";
	$words[] = "select ";
	$words[] = "truncate ";
	$words[] = "update ";
	$words[] = "use ";
	$words[] = "--";
	$words[] = "#";
	$words[] = "group_concat";
	$words[] = "column_name";
	$words[] = "information_schema.columns";
	$words[] = "table_schema";
	$words[] = "union ";
	$words[] = "where ";
	$words[] = "alert";
	$value = strtolower($value);//转换为小写
	foreach($words as $word){
		if(strstr($value,$word)){
			$value = str_replace($word,'',$value);
		}
	}
	
	return $value;
}

public function update($table, $conditions, $row) {
		$where = "";
		if (empty ( $row ))
			return FALSE;
		if (is_array ( $conditions )) {
			$join = array ();
			foreach ( $conditions as $key => $condition ) {
				$condition = $this->escape ( $condition );
				$join [] = "{$key} = {$condition}";
			}
			$where = "WHERE " . join ( " AND ", $join );
		} else {
			if (null != $conditions)
				$where = "WHERE " . $conditions;
		}
		foreach ( $row as $key => $value ) {
			$vals [] = "`$key` = '$value'";
		}
		$values = join ( ", ", $vals );
		$sql = "UPDATE " . dbprefix . "{$table} SET {$values} {$where}";
		//echo $sql;exit;
		return $this->db->query ( $sql );
	}